Your privacy is
our priority.

Wallet names, transaction details, categories, labels, and any financial data you enter. By default this is stored only in your device's private local storage. If you turn on Web Sync — which is optional, off unless you enable it, and a one-time purchase — an end-to-end encrypted copy is also stored on our servers so it can sync with the web app. See Section 05 for exactly what that means.

If you choose to sign in with Google to enable Google Drive backup, the app receives your Google account ID and display name. The account ID is also used as your purchase identifier with RevenueCat, so a Web Sync purchase can be restored on another device, and to count exchange-rate refreshes (see below).

The app shows no advertisements and contains no advertising, analytics, or crash-reporting SDK. We do not collect usage statistics, advertising IDs, or behavioural data from the app.

Your name, email address, an optional subject, and your message. We use these solely to read your inquiry and reply by email.

Along with your message we automatically collect technical metadata from your browser to help us reproduce bug reports, diagnose issues, and prevent abuse:

• Browser user agent, Client Hints (brands, platform, architecture, model, bitness), vendor/product strings, and webdriver flag
• Language, languages list, locale, Intl locale details, timezone name/offset, and formatted date/time sample
• Screen size, available size, color/pixel depth, orientation, device pixel ratio, viewport and visual-viewport metrics
• Hardware concurrency (CPU cores), device memory, max touch points, battery status (where available)
• Network connection type/effective type, downlink, RTT, save-data flag; WebRTC-discovered local/LAN IPs when the browser exposes them
• Canvas, audio, and WebGL fingerprints (GPU vendor/renderer and related capability params)
• Storage estimate (quota/usage), media-device counts (camera/mic/speaker), permission states, plugins and MIME types
• Speech synthesis voice list (sample), cookie/online/DNT/GPC flags, PDF viewer enabled, history length
• CSS media-query preferences (color scheme, reduced motion, pointer/hover, contrast, display mode)
• Page URL, pathname, search, hash, origin, referrer, document title/character set/visibility, and a session id for the tab
• Performance timing and JS heap memory (where exposed)
• API availability flags (USB, Bluetooth, HID, serial, XR, share, credentials, service worker) — presence only, not device contents

Browsers do not expose your OS username or laptop hostname to websites. We cannot collect those fields.

When the form reaches our server, we additionally log the following technical request data:

• Your IP address (from x-forwarded-for, x-real-ip, cf-connecting-ip, or true-client-ip)
• Forwarded proto/host/port, Host, Via, CDN-Loop, and request IDs when present
• Request headers: User-Agent, Accept*, Referer, Origin, DNT, Sec-GPC, Cache-Control, Priority
• Client Hints headers (sec-ch-ua*, viewport, DPR, device-memory, prefers-color-scheme) when the browser sends them
• Fetch metadata (sec-fetch-site/mode/dest/user)
• Cloudflare / edge metadata when available: country, city, continent, region, postal code, latitude/longitude, timezone, ASN, bot score, JA3/JA4, CF-Ray, and related CF headers

This metadata is used strictly to:

• Reply to your message at the email address you provided
• Reproduce and debug bug reports (browser, device, locale, network conditions)
• Detect and prevent spam, abuse, and automated submissions
• Maintain a basic audit trail of legitimate support requests

Submissions are forwarded to our private email inbox via our mailer service and retained only as long as needed to handle your request and keep a record of legitimate correspondence. We never sell, rent, or share contact-form data with any third party for marketing.

Your data lives in your device's private app storage. It is not accessible to other apps and is permanently removed when you uninstall Budgetify: Money Manager.

No account is required to use Budgetify, and with Web Sync off your financial records never leave your device unless you explicitly create a backup. If you enable Web Sync, we do store an encrypted copy on our servers — see Section 05.

Your data is encrypted on your own device before it is sent, using a key derived from your password. We store that key only in a form that your password (or your recovery key) can unlock. Amounts, wallet and transaction names, balances, notes, and currencies are unreadable to us — not as a policy promise, but because we do not hold the means to decrypt them.

Being honest about the limits of the above: to keep your data consistent and enforce plan limits, our servers do store some structural information in readable form — how many transactions and wallets exist, the dates they are dated, which wallet and category each belongs to (by random ID, not by name), and status flags. We can see that a transaction exists on a date; we cannot see what it was for or how much it was.

Your data cannot be recovered — by you or by us. This is a direct consequence of the encryption design, not an operational limitation. Please store your recovery key somewhere safe.

So your phone picks up changes made on the web within seconds, the app registers a Firebase Cloud Messaging (FCM) token with our server, together with a coarse device label such as "Android 14". The notifications we send through Google's FCM service only say "something changed" — they carry no financial content. The token is removed when you sign out. If you deny notification permission, sync still works, just a little slower.

When you are signed in on Android, the app tells our server your RevenueCat customer ID (your Google account ID, or a random anonymous ID). We store it with your account so the web app's billing page can show your Web Sync purchase. We read it from RevenueCat; we never see card details.

Deleting your account from the app, the web dashboard, or the public delete-account page permanently removes your encrypted data from our servers. Deleted individual records are retained briefly as empty markers so your other devices learn about the deletion, and carry no content. An account created but never email-confirmed is deleted automatically after 7 days.

Encrypted account data is stored on servers operated by Render and on a virtual private server, with the website served through Cloudflare. Transactional email (verification codes, security notices, deletion confirmations) is sent via Resend. Push notifications are delivered through Google Firebase Cloud Messaging.

Every backup file — whether saved locally or to Google Drive — is encrypted using AES-256. No third party, including us, can read the contents of your backup without the app.

Save an encrypted backup directly to your device storage at any time. Free for everyone.

Encrypted backups are uploaded to the hidden app folderof your personal Google Drive — invisible to other apps and only accessible by Budgetify: Money Manager. Google's privacy policy governs this storage.

Schedule automatic backups at custom intervals and choose how many backup versions to retain. Your backup history is viewable and any version can be restored at any time. Free for everyone.

Used optionally when enabling Google Drive backup. We request only the minimum: your account ID, display name, and access to the app's own hidden Drive folder.

Used exclusively to read and write your encrypted backup file to the hidden app-specific folder. We never access any other files in your Drive.

Used only when Web Sync is on and notification permission is granted, to tell your phone that something changed on the web. Messages carry no financial content.

Processes the optional Web Sync purchase. Google handles all payment details; we never receive them.

All payment transactions are handled entirely by Google Play. We never receive or store your payment card information.

We use RevenueCat to record whether you own Web Sync, so it can be restored on another device. RevenueCat identifies you by your Google account ID if you signed in with Google, or otherwise by a random anonymous ID. Their privacy policy is available at revenuecat.com/privacy.