Privacy policy

Who we are

Expense Tracker is a small, self-hosted, invite-only app that turns bank transaction alerts and statements into a private record of your spending. It is run by an individual, not a company, and has no advertising, analytics or tracking of any kind.

What we collect

• Your account: name, email address and a hashed password.
• Transactions: amount, date, merchant, account or card (last four digits only) and reference, taken from bank alert emails and from statements you upload.
• Things you enter: categories, budgets, recurring payments, UPI IDs, and the contacts and splits you create.
• If you enable notifications, a browser push subscription.

Gmail access

If you connect Gmail, the app requests read-only access and uses it only to:

• search for and read messages from a fixed list of bank and card alert senders (for example HDFC Bank and YES BANK alert addresses). Other email is never fetched;
• extract the transaction details listed above from those alerts.

The app never sends, deletes or modifies email. The Google access token is stored encrypted (AES-256-GCM), and you can disconnect Gmail at any time in Settings or at myaccount.google.com/permissions.

Expense Tracker’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Gmail is used only to provide this app’s features to you. It is not sold, not used for advertising, and not used to train AI models.

Service providers

To work, the app relies on:

• Hetzner (Germany) — the server and database that store your data.
• Anthropic(Claude API) — two narrow uses. (1) When an alert email’s format is not yet recognised, its text is sent to learn the format, after every amount, account number, balance, reference and merchant name in it has been replaced with a fake value. (2) Merchant names, on their own and without any link to you, are sent to pick a spending category. Anthropic does not train models on data sent through its API.
• Google — Gmail access as described above, if you connect it.
• Your browser’s push service (Apple, Google or Mozilla) — delivers notifications, if you enable them.

Who can see your data

Only you. Each account’s data is private to it. If someone adds you to a split using your email address, you are asked first; only after you accept do they see that you owe them for that split, and you see only your share — never the rest of their data. The person running the server has technical access to the database, as with any hosted service, and does not look at users’ data except to fix a problem you report.

Security

Traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Mail credentials and tokens are encrypted with a key kept outside the database. Backups are encrypted.

Keeping and deleting your data

Your data is kept while your account exists. You can delete your account at any time from Settings → Delete account: this permanently deletes your transactions, accounts, contacts, splits and any stored Gmail access, immediately. Encrypted backups are rotated out within 14 days.

Contact

Questions or requests about your data: karmanyasharma5@gmail.com. If this policy changes, the effective date above will change too.