Privacy Policy — Expense & Budget Tracker App
Last updated: 3 October 2026
Applies to: the iOS app "Expense & Budget Tracker App", bundle com.expensemanager.expensetracker.app, version 2.0 and later.
This policy describes this iOS app only. It does not cover any other app, website or
platform. It was written against the app's own source code, and every statement below can
be checked in it.
Contact for anything in this document, including a data deletion request:
md.goaltech@gmail.com
1. The short version
• You do not create an account. There is no email address, no password, no sign-up
form and no "continue with Google/Apple/Facebook" button anywhere in the app.
• The app silently creates an anonymous account on our backend so your records have
somewhere to live. It holds a random identifier and nothing that identifies you.
• The money records you type in — transactions, budgets, savings goals, shopping
lists, tracked subscriptions and your conversation with the finance coach — are stored
in that anonymous account on our cloud database (Supabase).
• Receipt photos stay on your iPhone or iPad. They are not uploaded to our servers.
• A receipt photo, or the text of something you said, is sent to Google Gemini only at
the moment you use the receipt scanner, voice entry or the finance coach.
• The free version shows ads supplied by Google AdMob; Premium removes them. The app does send anonymous usage
statistics and crash reports to Google Firebase so we can see which features are
used and fix crashes — never your financial records, your notes or anything that
identifies you.
• We do not sell your data and we do not share your records with data brokers. The only thing our ad network receives is the advertising identifier described in section 3.5.
2. Your account
When the app first opens it calls signInAnonymously() on Supabase. That creates a user
record identified by a random UUID. It has no email address, no phone number, no name and
no password, and it is not linked to your Apple ID, to any social account or to any
identity we hold elsewhere.
What that means in practice: the account lives in the app's stored session on that
device. If you delete the app, or reset the device, the session is gone and there is no
way for you — or for us — to sign back into that particular anonymous account. Your data
is not lost from the database, but it becomes an orphaned, unreachable row. See
section 8 on deletion.
3. What is collected, and where it goes
3.1 Stored in your anonymous account on our cloud database (Supabase)
Everything here is data you enter yourself:
| Data | Detail |
|---|---|
| Transactions | Amount, category, payment method (cash / card / wallet / bank), your note, the date |
| Budgets | The category, the limit, whether it is weekly or monthly |
| Savings goals | Target amount, amount saved so far, optional deadline, the icon you picked |
| Shopping list | Item names, quantities, prices, and your grocery budget |
| Tracked subscriptions | Name, cost, billing period and renewal date of the services you pay for |
| Profile | Your chosen display name and currency code |
| Finance coach chat | Both sides of the conversation, so it is still there next time you open it |
| Notifications and spending alerts | Alert rows generated for your account |
Our database is hosted by Supabase (supabase.com), which acts as our data processor.
Access is restricted by row-level security so that one anonymous account cannot read
another's rows.
We do not collect: your name, email address, phone number, postal address, contacts,
precise or coarse location, health data, browsing history, or your bank, card or account
numbers. The app never connects to a bank. There is no bank-linking feature and no
open-banking integration in it.
3.2 Stored only on your device
| Data | Detail |
|---|---|
| Receipt photos | Saved in the app's private documents folder with a small index file. They are not uploaded to our database or to any storage bucket. They do not follow you to a new phone, they are not backed up by us, and deleting the app deletes them. You can also delete any single receipt from the Receipts screen. |
| Premium status | The result of your last App Store purchase check, cached so the app knows you are Premium while offline |
| Preferences | Your currency and whether you have seen the onboarding screens |
> A change that is planned but has not shipped. A database migration exists that would
> move receipt photos into a private Supabase storage bucket. It has not been applied:
> as the app stands today, the bucket does not exist and photos stay on the device. If that
> changes, this policy will be updated and re-published before the version that uploads
> photos is released.
3.3 Sent to Google Gemini when you use an AI feature
Three features call Google's Gemini API directly, using our own API key, and only after you tap Allow on the in-app "Use Google Gemini?" screen (you can change this any time in More > AI features):
| Feature | What is sent | When |
|---|---|---|
| Receipt scanning | The receipt photo itself | Only when you take or choose a photo to scan |
| Voice entry | The text of what you said. Your speech is turned into text by Apple's iOS speech recognition, which may use Apple's servers; this app itself never records or uploads audio | Only while you hold the microphone button and confirm |
| Finance coach | Your question, and the figures from your own records needed to answer it | Only when you send a message in the coach |
Nothing is sent to Google in the background, on a schedule, or while you are simply
browsing your figures. We do not send your anonymous account identifier to Google.
What Google does with that content is governed by Google's own terms for the Gemini API
(https://ai.google.dev/gemini-api/terms) and the Google Privacy Policy
(https://policies.google.com/privacy). Google processes the content in order to return the
result to the app.
If you would rather nothing left the device at all, simply do not use the scanner, the
microphone or the coach: every other part of the app — typing a transaction, budgets,
goals, lists, subscriptions and statistics — works without them.
3.4 Purchases
Premium is sold through Apple's In-App Purchase system. Apple handles the entire
payment. We never see and never receive your card number, your Apple ID, your billing
address or any other payment detail. From Apple's StoreKit the app learns only which
product was bought and when, and it stores that answer on your device so it knows whether
to unlock Premium. Apple's handling of the transaction is covered by Apple's own privacy
policy.
3.5 Analytics, crash reporting and advertising
Analytics — Google Firebase Analytics. The app records anonymous events so we can see
which features people use and where they get stuck: opening a screen, finishing
onboarding (with the currency you chose), adding a transaction (and whether you typed it,
scanned a receipt or dictated it), creating a budget or goal, opening the Premium screen
and which part of the app you opened it from, and the outcome of a purchase (with the
price and currency Apple reported).
We deliberately do not send: your name, your email, your Supabase account identifier,
the amounts or descriptions of your transactions, merchant names, note text, receipt
contents or anything you say to the coach. A filter in the code rejects free text before
it can be sent. Firebase assigns its own random app-instance identifier; we never attach
your identity to it.
Crash reporting — Firebase Crashlytics. If the app crashes or hits an error we
receive the crash, the device model and OS version, and a short technical trail of the
last screens you opened — again with no financial data and nothing that identifies you.
Advertising: Google AdMob, from version 2.1. The free version of the app shows a banner above the tab bar and, from time to time, a full-screen ad when you open Statistics or Monthly folders. An ad never appears while something is being saved, and never more than one every four minutes. Buying Premium removes every ad the moment the purchase completes.
To serve an ad, Google receives your device's advertising identifier, the fact that an ad was requested, shown or tapped, basic technical details of the device, and an approximate location worked out from your IP address. It does not receive your financial records: no amount, no category, no note, no merchant, no receipt and nothing you say to the coach.
iOS asks you once whether this app may track you across other companies' apps and websites. Decline and the ads are not personalised and no advertising identifier is used to track you; accept and they are. Either way the ads still appear, and you can change your answer at any time in Settings > Privacy & Security > Tracking. What Google does with this data is described at policies.google.com/technologies/partner-sites.
3.6 Permissions the app asks for
| Permission | Why | When asked |
|---|---|---|
| Camera | To photograph a receipt | The first time you choose "Scan a receipt" |
| Photo library | To use a receipt photo you already saved | The first time you pick from photos |
| Microphone | To let you say an expense instead of typing it | The first time you hold the microphone button |
| Speech recognition | To turn what you said into text, on your device | Together with the microphone |
None of these is requested at launch, and refusing any of them leaves the rest of the app
fully usable.
4. Why we process this data
Only to run the features you are using: to show you your own records, to calculate your
budgets, statistics and totals, to read a receipt you asked us to read, to answer a
question you asked the coach, and to unlock Premium if you bought it.We do not profile you from your financial records, and we do not
sell it or share it with data brokers.
5. Legal bases (UK/EU users)
Performance of the contract (Article 6(1)(b) UK/EU GDPR) for storing and showing the
records you enter and for delivering a purchase you made; consent (Article 6(1)(a)) for
camera, photo, microphone and speech access, which you give through the iOS permission
prompt and can withdraw at any time in iOS Settings.
6. How long it is kept
Your records stay in the database until they are deleted — by you, inside the app, or by
us on request (section 8). Receipt photos stay on your device until you delete the receipt
or delete the app. The cached Premium status stays on your device until you delete the app.
7. Who else sees it
| Processor | What they handle |
|---|---|
| Supabase Inc. | Hosts the database holding your anonymous account and the records you enter |
| Google LLC (Gemini API) | Receives a receipt image, voice text or coach question only at the moment you use those features |
| Apple Inc. | Handles purchases and subscription billing |
| Google LLC (AdMob) | Serves the ads in the free version and receives the advertising identifier described in 3.5 |
Google Firebase receives the anonymous usage events and crash reports described in 3.5.
Nobody else. Apart from the advertising identifier and ad-interaction data that AdMob receives, we do not share your data with ad networks, other analytics companies
or data brokers, and we do not sell it. We would disclose data only if we were legally
required to.
8. Deleting your data — what the app can actually do today
We would rather tell you exactly what is possible than promise a button that is not there.
Inside the app, right now, you can:
• Delete any individual transaction, budget, savings goal, shopping-list item or tracked
subscription — swipe it away or use the delete action. That removes the row from the
database.
• Delete any receipt photo from the Receipts screen. Deleting a transaction also removes
its receipt photo.
• Export everything first, if you want a copy: More › Export data writes every
transaction to a CSV file and hands it to the iOS share sheet.
• Delete the app. That removes every receipt photo, your cached Premium status and your
preferences from the device, and it ends the anonymous session for good.
You can delete everything at any time inside the app: More > Delete all my data. After you confirm, it permanently erases every transaction, budget, savings goal, shopping-list item, tracked subscription and finance-coach conversation from our database, removes your receipt photos, cards, folders and preferences from the device, and then starts a fresh, empty anonymous account. It cannot be undone. A Premium purchase is held by Apple, not by us, so it is kept: use Restore purchases to get it back.
If you cannot use the app (for example, you have already deleted it), email md.goaltech@gmail.com and we will help. Because the account is anonymous we hold no email address to match a request against, so where possible use the in-app option above, which deletes exactly your own data and no one else's.
9. Children
This app is not directed at children under 13 (and not to children under 16 where
local law sets that age). We do not knowingly collect data from them. It is not part of
Apple's Kids Category and it carries no child-directed content or advertising. If you
believe a child has entered data into the app, email us and we will delete it.
10. Security
Traffic between the app and our database and between the app and Google is encrypted in
transit (HTTPS/TLS). Row-level security in the database scopes every read and write to the
signed-in anonymous account. Receipt photos are held in the app's private container, which
iOS keeps separate from other apps. No system is perfectly secure, and an anonymous account
cannot be recovered if the device that holds its session is lost.
11. Your rights
Depending on where you live you may have the right to access, correct, export or erase
your data, and to object to or restrict its processing. The app already gives you access
(everything is on screen), correction (edit any record) and export (CSV). For erasure, see
section 8. To exercise any other right, email md.goaltech@gmail.com.
12. International transfers
Our database and Google's Gemini API may process data on servers outside your country,
including in the United States. Those transfers rely on the standard contractual clauses
offered by the respective providers.
13. Changes to this policy
If we change what is collected or where it goes (for example, if receipt photos start being uploaded), we will update this page and the App Store privacy label before releasing the version that makes the change.
14. Contact
md.goaltech@gmail.com
Afex Digitals