Privacy Policy

App: ExpensO - The Expense Organiser  ·  Publisher: the developer of ExpensO (an individual developer based in India)  ·  Policy version: 2  ·  Effective: 2026-09-02

This Privacy Policy explains what data ExpensO handles, where it lives, and the choices you have. ExpensO is an offline-first, end-to-end-encrypted personal finance app: your financial data stays on your device. The free version is ad-supported (Google AdMob); a one-time "ExpensO Full" purchase removes all ads. Ads only run after you agree through the Google consent prompt, and the ad software is never even started for ExpensO Full owners.

1. Summary

• Your financial data (transactions, balances, budgets, attachments, …) is stored only on your device, in a database encrypted at rest (SQLCipher, AES-256). There is no ExpensO server; the developer never receives it.
• ExpensO contains no first-party analytics, no telemetry, and no crash-reporting SDK for the developer.
• On the free tier, ExpensO shows ads via Google AdMob. For ads, Google (and its ad partners) may process your advertising ID, IP address (from which a coarse, city-level location is inferred), device and app info, and ad-interaction events. This happens only where the Google User Messaging Platform (UMP) consent flow permits it, and on iOS only if you also allow tracking in the system prompt.
• ExpensO Full (a one-time purchase) removes every ad: the ad SDK is not initialised, no advertising ID is read, and no ad request or ad telemetry leaves your device.
• The store (Google Play / Apple App Store) processes your purchase; the developer receives only anonymised/aggregated payout and tax reporting from the store, never your payment details.
• Other ways data can leave your device are features you turn on: encrypted cloud sync to your own Google Drive app folder (ciphertext only), peer-to-peer sync between your devices (ciphertext only), and an optional exchange-rate lookup.
• You can export all your data and erase everything (including keys) from inside the app, and change your ad-consent choices at any time.

2. Who is responsible for your data

For data that stays on your device, the individual developer identified above is the nominal data controller / data fiduciary, but because ExpensO has no backend, you are effectively in sole control and the developer cannot access, restore, or delete it.

For advertising data processed through AdMob, Google Ireland Limited / Google LLC acts as an independent controller (and, in some regions, as the developer's processor) under Google's own privacy policy (policies.google.com/privacy) and the AdMob/Google Ads data terms. A list of Google's advertising technology providers is at support.google.com/admob/answer/9012903.

3. What data ExpensO processes, and where

3.1 Data you enter (stays on device)

Transactions, amounts, dates, payees, notes, categories, tags, accounts and the last four digits of an account label (full card/account numbers are rejected on entry), budgets, savings goals, recurring rules, bill reminders, attached receipt images, and app settings.

• Storage: a local SQLCipher-encrypted database and an encrypted attachment vault in the app's private storage.
• Retention: until you delete the entry or erase the app data. Uninstalling removes it.
• The developer's access: none. Advertising's access: none — no entry, amount, balance, category or attachment is ever sent to any ad system.

3.2 Advertising (free tier only — Google AdMob)

When you are not an ExpensO Full owner, ads are shown by the Google Mobile Ads (AdMob) SDK. Subject to your consent (section 3.3):

• Advertising identifier — Android Advertising ID (GAID) / iOS IDFA (the latter only if you allow tracking). Used to select and cap ads and to measure ad performance. You can reset or delete it in your device settings.
• IP address — seen by Google's ad servers on every ad request; used for ad delivery, fraud/invalid-traffic prevention, and to infer an approximate (city-level) coarse location. ExpensO does not request GPS/precise location and holds no location permission.
• Device & app information — device model, OS version, language, coarse screen metrics, the ExpensO app id and version, and general connection type.
• Ad-interaction events — ad impressions, clicks, viewability and (for install-attribution) SKAdNetwork/limited signals on iOS.
• No financial data. The ad SDK receives none of your ledger content.

Legal bases: consent (GDPR Art. 6(1)(a); ePrivacy) where the UMP form asks for it; a US-state "Do Not Sell or Share / opt out of targeted advertising" signal is offered where applicable; DPDP Act 2023 — consent for a lawful purpose. Ads may be personalised (if you consent) or non-personalised / contextual (if you decline where a decline option is offered).

ExpensO Full owners: the ad SDK is not initialised at all. No advertising ID is accessed, no ad request is made, and nothing ad-related leaves the device.

3.3 Ad consent — Google UMP and Apple ATT

Before any ad loads, ExpensO runs the Google User Messaging Platform (UMP) consent flow:

• In the EEA, UK and Switzerland, a GDPR/ePrivacy consent message asks you to consent or manage options (purposes and vendors) before personalised — and, in most configurations, any — ads are requested.
• Where applicable in the United States, a CCPA/CPRA message provides a "Do Not Sell or Share My Personal Information" choice.
• Elsewhere, a message may still be shown depending on local rules.

Your choices are stored on your device by the UMP SDK. You can reopen the form any time from Settings → "Ad privacy choices" (shown where UMP requires it). On iOS 14.5+, after the UMP step ExpensO also shows Apple's App Tracking Transparency prompt; if you deny it, the advertising identifier is not used and ads are non-personalised.

3.4 In-app purchase ("ExpensO Full")

"ExpensO Full" is a one-time, non-consumable purchase processed by Google Play Billing or the Apple App Store. The store handles your payment, billing address and taxes under its own privacy policy and terms; ExpensO never sees or stores your card or payment details. ExpensO stores a single local flag ("purchased: yes/no"), on-device only, not synced. The developer receives only the store's standard aggregated sales, payout and tax reports. Restore-purchases re-checks your entitlement with the store.

3.5 Google account data (only if you enable cloud sync)

If — and only if — you sign in with Google and grant the in-app cloud-sync consent:

• Email address: used solely to bind the encrypted sync files to your account and to show which account is connected.
• OAuth scope: drive.appdata only — a private app-data folder in your Drive that other apps cannot see. ExpensO cannot see the rest of your Drive.
• What is uploaded: an append-only log of encrypted change records (XChaCha20-Poly1305). Google stores ciphertext; neither Google (readably) nor the developer can decrypt it.
• Legal basis: your consent. Withdraw it in Settings; revoke Drive access at myaccount.google.com/permissions.

3.6 Peer-to-peer sync data (only if you use Wi-Fi sync)

ExpensO advertises the device over mDNS on your local network and exchanges encrypted change records over a direct socket with devices you paired by QR code. Payload is ciphertext; an on-network observer sees only timing, size and mDNS presence. Nothing is sent to the internet.

3.7 Exchange rates (optional, off by default)

If you enable online exchange-rate refresh and grant the fx_fetch consent, ExpensO requests public, non-personal currency rates over HTTPS. The request contains no account data and no identifiers beyond the IP address any HTTPS request exposes.

3.8 Local notifications

Bill and recurring-transaction reminders are scheduled on the device by the operating system. No notification content is sent anywhere.

4. What ExpensO does NOT do

• No first-party analytics, usage tracking, or telemetry for the developer.
• No third-party crash/performance reporting.
• The ad SDK never receives your transactions, balances, categories, notes or attachments.
• No sale of personal data for money. Where a US state defines "sharing" for cross-context behavioural advertising, that occurs only with your consent and you can opt out via the UMP form.
• No precise/GPS location; no contacts, SMS, call log or health data.
• No profiling or automated decision-making with legal or similarly significant effects.

5. Permissions and why

Permission	Why
Internet / network state	Ads (free tier); cloud sync to your Drive; optional exchange rates; store billing.
AD_ID (Android advertising ID)	Serve and frequency-cap ads and measure ad performance on the free tier. Not accessed for ExpensO Full.
Local network / multicast (Wi-Fi)	Discover your other devices for peer-to-peer sync.
Camera	Scan the pairing QR code and capture receipt images (encrypted immediately; nothing uploaded).
Biometric / device credential	Unlock the app and confirm high-value actions (export, erase).
Notifications	Show bill and recurring-transaction reminders.
Schedule alarms / run at boot	Fire reminders on time and re-register them after a restart.
Billing	Process the one-time "ExpensO Full" purchase.

6. Data sharing and international transfers

The developer does not sell or share your ledger data with anyone.

• Advertising: ad data is processed by Google and its ad-technology partners, on Google infrastructure that may be outside your country. Transfers rely on Google's Standard Contractual Clauses and equivalent safeguards. See Google's privacy policy and the AdMob partner list linked in section 2.
• Purchases: processed by Google / Apple under their terms.
• Cloud sync (if enabled): you transfer ciphertext to your Google account; the content is end-to-end encrypted, so no readable personal data is exposed to Google or the developer.

7. Children

ExpensO is a general-audience finance tool, not directed to children. AdMob is configured with tagForChildDirectedTreatment not set to child-directed and a maximum ad content rating of "G". The app does not knowingly process data of children under 13 (or the minimum digital-consent age in your jurisdiction). If you believe a child has used the app, erase the data from Settings and contact the developer.

8. Security

• Database encrypted at rest with SQLCipher (AES-256); attachments in a separate encrypted vault. Keys held in the Android Keystore / iOS Keychain.
• App content excluded from OS auto-backup and the app-switcher preview (FLAG_SECURE / resign blur).
• Sync payloads use authenticated encryption; peers are fingerprint-verified.
• No transport is perfectly private: sync and ad requests reveal metadata (timing, sizes, IP, which devices are online).
• Keeping backups is your responsibility; the developer cannot restore lost data or keys.

9. Your rights and choices

9.1 Everyone

• Turn ads off entirely: buy ExpensO Full (Settings → ExpensO Full).
• Change ad consent: Settings → "Ad privacy choices" (where shown); on iOS, Settings → Privacy & Security → Tracking.
• Reset the advertising ID: your device settings.
• Access / correct any entry in the app; export everything (Settings → Export); erase everything and the keys (Settings → Erase everything — see the Data Deletion page; this also clears your stored ad-consent choices); withdraw cloud-sync / FX consent via the Settings toggles.

9.2 EEA / UK / Switzerland (GDPR, UK GDPR, Swiss FADP)

Lawful bases: contract/legitimate interests for on-device app functionality; consent for advertising and for cloud sync/FX. You have the rights of access, rectification, erasure, restriction, portability, and objection (including objection to direct marketing / profiling), and the right to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your supervisory authority. As a sole developer established in India with EEA/UK users, the developer relies on Google's advertising SCCs for transfers; contact the developer for any Art. 27 representative query.

9.3 United States (CCPA/CPRA and other state laws — VA, CO, CT, UT, TX, OR, MT, and others)

The developer does not sell personal information for money. Behavioural advertising via AdMob may be treated as "sharing" / "targeted advertising"; you can opt out through the UMP "Do Not Sell or Share" message, the iOS ATT prompt, or by buying ExpensO Full. You may request to know, delete, and correct; you will not be discriminated against for exercising a right. Global Privacy Control signals, where the platform surfaces them, are honoured by the UMP framework.

9.4 India (DPDP Act 2023)

Processing is on the basis of your consent for a lawful purpose (advertising, cloud sync, FX) or as necessary to provide the app. You may withdraw consent, seek correction/erasure, and nominate a person to exercise rights on your behalf. Grievances: contact the developer (details in Settings → Legal); if unresolved, you may approach the Data Protection Board of India.

9.5 Other regions

Brazil (LGPD): rights of confirmation, access, correction, anonymisation, portability, deletion, and information about sharing; legal basis is consent for advertising. Canada (PIPEDA / Québec Law 25): consent-based; access and correction rights; the developer is accountable for transfers to Google. Australia (Privacy Act / APPs): access and correction; APP 7 direct-marketing opt-out via the UMP form. South Korea (PIPA): consent for advertising data; withdrawal and access rights. Residents of any other jurisdiction retain whatever rights local law grants and may contact the developer to exercise them.

10. Retention

On-device data: until you delete it or uninstall. Ad-consent choices: until you change them or clear app data. Purchase entitlement flag: until you erase app data (your store account retains the purchase). Advertising data held by Google is retained under Google's retention policies.

11. Contact

Developer contact details are in the app under Settings → Legal. For advertising data held by Google, use Google's privacy tools and the links in section 2.

12. Changes to this policy

If this policy changes materially, the in-app version number is incremented and the acceptance screen is shown again so you can review it before continuing. The current text is always available under Settings → Legal, and this page is updated to match.