AutoExpense - Privacy Policy
Last updated: September 7, 2026
Overview
AutoExpense reads your SMS messages to automatically track your financial transactions. Your privacy is our top priority.
Data Collection
What we read:
- SMS messages from known bank sender IDs (e.g., AXISBK, HDFCBK, SBIINB, CUBANK)
- Only transactional messages containing debit/credit keywords
What we DO NOT read:
- Personal messages
- OTPs or verification codes
- Promotional SMS
- Messages from non-banking senders
Data Storage
- On-device processing: All SMS parsing and categorization happens locally on your device
- Cloud sync (optional): If you sign in with Google, your transaction data (amount, merchant, category, date) is stored in Google Firebase under your authenticated account
- Raw SMS text: Stored only on your device for reference, never uploaded to any server without your explicit consent
Data Sharing
We do NOT:
- Sell your data to third parties
- Share your financial information with advertisers
- Upload your SMS to external servers for processing
- Track your location or behavior
Permissions Used
| Permission | Purpose |
|---|
| READ_SMS | Read bank transaction messages from your SMS inbox for expense tracking — processed on-device only |
| RECEIVE_SMS | Detect new bank transaction SMS in real-time as they arrive |
| READ_CONTACTS | Look up contact names when splitting an expense with friends — optional feature, never uploaded |
| PACKAGE_USAGE_STATS | Detect when a UPI payment app is used to auto-capture UPI transactions — on-device only |
| POST_NOTIFICATIONS | Send spending alerts and budget reminders |
| RECEIVE_BOOT_COMPLETED | Restart background SMS detection after device reboot |
| INTERNET | Optional cloud backup via Firebase |
Data Security
- Data is encrypted in transit (HTTPS/TLS)
- Firebase data is protected by authentication and security rules
- Firebase App Check ensures only the official app can access your data
- Optional PIN + Biometric app lock for on-device protection
Data Deletion
- All local data can be deleted by clearing app data or uninstalling the app
- Cloud data can be deleted by signing out from Settings
- You can request complete data deletion by contacting us
Third-Party Services
We use the following third-party services:
- Firebase Analytics: Collects anonymised usage events (app opens, number of SMS scanned, expense categories, budget actions). Transaction amounts may be included in aggregate analytics. No SMS content is sent.
- Firebase Crashlytics: Collects crash reports to help fix bugs. No financial or SMS data is included in crash reports.
- Firebase Auth: Manages Google Sign-In. Your Google account email and name are stored only if you choose to sign in.
- Firebase Firestore: Stores your transaction history in the cloud only if you sign in and enable sync. Raw SMS text is never stored.
- Google Play Services: Google Sign-In authentication.
Children's Privacy
AutoExpense is not intended for use by children under 13. We do not knowingly collect data from children.
Contact
For questions about this privacy policy or to request data deletion:
Email: pramodh2492@gmail.com
Changes
We may update this policy. Changes will be posted on this page with an updated date.
© 2026 LazySloth. All rights reserved.