Nothing to collect.

One thing, and only with your permission: notifications posted by banking apps.

You enable this in Android’s own Notification Access settings, not through a prompt inside the app. Only notifications from a fixed, bundled list of bank, wallet and UPI packages are read, and only their title, text, expanded text and package name. A notification from any other app on your phone — your messages, your mail, anything at all — is discarded natively, before it reaches any code that could store it.

From those alerts the app extracts an amount, a direction, the last four digits of the account or card, a merchant name, a reference number and, where present, an available balance. You can also add transactions by hand, and the app works entirely that way if you grant nothing at all.

SpendPot does not read your SMS. READ_SMS is a restricted permission on Google Play and expense tracking is not among Google’s approved use cases, so the shipped build does not declare it, cannot request it, and has no screen that mentions it.

Nothing. Not a transaction, not an aggregate, not a crash report, not a count of how often you open the app.

This is enforced by the build rather than promised by us. The release binary is compiled without android.permission.INTERNET, so it has no way to open a socket. The same build has Android’s Auto Backup disabled, because leaving it on would have quietly copied the database to Google Drive.

The cost of this is real and worth naming: there are no over-the-air updates and no crash reporting. Fixes ship as a new build, and crashes are written to a local log you can read in Settings → Diagnostics and choose to share.

On your phone, in an SQLCipher database encrypted with a 256-bit key. The key is generated on your device on first run and wrapped by Android’s hardware-backed keystore, so it is never written to storage in a readable form. You can add a PIN, and optionally unlock with a fingerprint or face; your biometric never leaves the phone’s secure hardware and the app never sees it.

The app also sets FLAG_SECURE, so its contents are hidden in the app switcher and screenshots are blocked by default.

What encryption does not protect against. It protects your data from someone who has the files — a lost phone, a backup, a repair shop. It cannot protect against software running as SpendPot itself on an unlocked, compromised phone. No app can honestly claim otherwise.

Every permission the release build holds, and what each one actually accesses. The same list is shown inside the app under Settings → Privacy, and it is the list the app’s manifest is generated from, so the two cannot drift apart.

• Show you notifications

  POST_NOTIFICATIONS

  Used for budget alerts, bill reminders and subscription warnings. These are created on your phone — SpendPot cannot receive a push message, because it has no internet access.

• Use your fingerprint or face to unlock

  USE_BIOMETRIC

  Only if you turn on the app lock and choose biometric unlock. Your fingerprint never leaves the phone’s secure hardware, and SpendPot never sees it.

• Use your fingerprint (older Android)

  USE_FINGERPRINTFrom a support library

  The same feature as above, on Android 8 and 9 where the system used an older interface. It comes from the Android support library SpendPot uses for secure storage.

• Know when your phone restarts

  RECEIVE_BOOT_COMPLETED

  Reminders you have scheduled are cancelled by Android on a restart. This lets SpendPot set them up again so a bill reminder is not silently lost.

• Vibrate for alerts

  VIBRATEFrom a support library

  Used by the notification channels so a budget alert can be felt, not just seen.

• Read notifications from banking apps

  BIND_NOTIFICATION_LISTENER_SERVICE

  Granted by you in Android’s own Notification Access settings, never by a prompt inside the app. Only notifications from a fixed list of bank, wallet and UPI apps are looked at, and only their title and text — everything else is discarded before it reaches SpendPot’s code.

Every one of them is optional. Decline them all and SpendPot still works as a manual tracker, and you can change your mind later in Settings.

Absence is invisible, so it is worth listing. These are things an expense tracker is commonly assumed to want, and SpendPot does not hold any of them.

• Internet accessThe app cannot open a network connection at all.
• Your locationNever requested.
• Your contactsNever requested, even to name a payee.
• Camera or photosNever requested.
• Your accounts on this deviceThere is no sign-in.

Your transactions stay until you delete them. Raw captured messages are held only as long as they are useful: once a message has been processed successfully it is purged thirty days later, which is long enough for you to see the original text behind a transaction you are checking, and no longer.

Corrections you make — a renamed merchant, a re-categorised payment, a sender you marked as never a transaction — are stored as local rules so future messages parse the way you want. They are yours and they never leave the device either.

Backups are something you take, not something that happens to you. A backup is a single encrypted file, protected by a passphrase you choose that is independent of your app PIN, written wherever you point Android’s file picker — a folder on the device, an SD card, or a cloud drive if that is what you decide.

If you put a backup somewhere synced, that copy is then subject to whoever runs that service. SpendPot cannot see it, and cannot upload one for you. CSV exports and PDF statements are plain files and are not encrypted; treat them accordingly.

Settings → Erase all data destroys the database and the encryption key with it. There is no copy anywhere else, so this cannot be undone and there is nobody to ask for a restore. It asks twice before doing it.

Uninstalling the app has the same effect. Any backup file you exported earlier survives, because it is your file in your storage.

Budget alerts, bill reminders, subscription warnings and new-transaction alerts are all scheduled and posted on your device. SpendPot cannot receive a push notification, because push requires a network connection it does not have. Notifications are opt-out per source in Settings.

SpendPot is not directed at children and collects no personal information from anyone, of any age, because it collects no personal information at all.

There are none. No analytics SDK, no advertising SDK, no crash reporter, no attribution library, no A/B testing service. A dependency audit runs on every build and fails it if any package — including one arriving indirectly through another — is capable of opening a network connection.

Because there is no data to disclose, there is nothing to sell or share, and no third party has ever received any of it.

If this policy changes, the date at the top changes with it, and any change that widens what the app reads would arrive alongside a new build and a fresh in-app disclosure before any new permission was requested. The app never gains a capability silently: it cannot update itself over the air.

Questions about this policy, or about anything the app does, are welcome. Because SpendPot holds no data about you, there is no account to close and no data request to make — but if something here is unclear or looks wrong, say so and it will be corrected.

This policy describes the SpendPot Android app. It does not cover this website, which is a set of static files and sets no cookies, runs no analytics and stores nothing about your visit.