Privacy Policy

1. About expTracker and information it handles

expTracker is a personal finance journal for tracking income, expenses, balances, savings goals, diary entries, planned purchases or payments, calendar events, and reminder settings. It processes the information you enter and the records created from your entries.

The app does not run an expTracker server that stores your finance records. The operator does not receive your records through an expTracker backend.

2. Google account and Google Drive data

What Google data expTracker accesses

When you sign in, expTracker receives your Google account email address and a Google account identifier. These identify the account associated with the local records and backup. To provide backup and restore, the app requests the https://www.googleapis.com/auth/drive.appdata scope. This permission lets expTracker access its own hidden app-data area in your Drive; expTracker does not request permission to browse your other Drive files.

How expTracker uses Google data

The email address and account identifier are used to show which account is connected and to keep each account’s records associated with that account on the device or browser. When you sync, expTracker searches for, creates, reads, or updates its backup in the private app-data area. The JSON backup can contain your balance and savings goal, income and expense records, diary entries, planned items, and calendar events.

Google account and Drive data are used only to provide sign-in and the backup or restore features you request. expTracker does not sell this data, use it for advertising or credit decisions, or use it to train generalized AI or machine-learning models.

Who receives Google data

Google processes sign-in and Drive requests as the service that provides those features. expTracker does not send Google account data to an expTracker server. If you explicitly request an AI feature, relevant app content may be sent directly from your device or browser to the AI provider you configured; see Section 4 for details. It is not sent to advertising networks or data brokers.

3. Where records are stored and protected

On your device or in your browser

On Android and iOS, finance records are stored in an encrypted local database, with its encryption key held in the operating system’s secure storage. In a supported web browser, finance records are encrypted in browser storage using Web Crypto. Account connection details, such as the Google account identifier, email, and sync metadata, are stored locally on that device or browser. Records are not automatically copied between devices unless you use Drive sync.

Google Drive backup

The backup is stored in Google Drive’s private app-data area and is not shown as a regular Drive file. It is transmitted over HTTPS as JSON. expTracker does not add end-to-end encryption to the Drive backup, so Google’s storage and security practices apply while it is in Drive.

Exported files

If you export a backup, expTracker creates a JSON file for you to save. The file is not encrypted by the app. Choose a secure place to store it. API keys are not included in exported backups.

4. Optional AI features and sharing

AI is optional. You choose a provider and enter its API key in expTracker. The key is stored in the phone’s secure storage or encrypted browser settings and is not included in Drive backups or exported files. The key is sent directly from your app or browser to that provider when you request an AI feature; the operator does not receive it through an expTracker server.

• Diary analysis: the diary text you ask the app to analyze is sent to your selected provider to produce suggestions. You review suggestions before adding them to your records.
• AI assistant: when you send a message, your question and recent chat context are sent with relevant app context, such as recent transactions, diary excerpts, plans, upcoming events, balances, and savings totals.
• Chat retention: chat messages are kept in memory during the current app session. expTracker does not save chat history to its finance database or Drive backup.

AI requests are sent only when you choose an AI feature; signing in or syncing Drive alone does not send records to an AI provider. The provider may process or retain requests under its own privacy policy, terms, and data-use settings. Review those terms before enabling AI, and choose settings that do not allow your prompts to be used to train generalized models. Provider usage fees or limits may apply.

Other than Google for sign-in and Drive backup, and the AI provider you select when you request AI, expTracker does not disclose your finance or diary records to third parties. The app does not sell those records.

If this policy site is published using GitHub Pages, GitHub may process technical information, such as visitor IP addresses, for service security under its own policies.

5. Retention and deletion

Local finance records remain on your device until you delete them in the app, remove the app’s data, or uninstall the app. In a browser, they remain until you delete them in the app or clear the site’s browser storage. The connected account identifier, email, and sync metadata remain locally while the connection is saved; disconnecting Google removes that saved connection from the app.

A Drive backup remains in your Google account until it is deleted from the app-data area. Signing out or disconnecting the app does not delete that backup. You can revoke the app’s Google access in your Google Account and manage or delete its stored app data through Google’s Drive or account controls. If you need help locating the deletion controls, contact the operator below. AI providers may retain a request according to their own retention policies.

You may request help with privacy questions or deletion instructions using the contact details below. Because expTracker has no server copy of your finance records, the operator cannot directly erase the local data on your device or browser.

6. Security

expTracker encrypts local finance storage on supported devices and browsers, keeps the mobile database key in operating-system secure storage, and uses HTTPS for Google and AI provider requests. The Drive backup itself is JSON and is not end-to-end encrypted by expTracker. No storage method or internet transmission can be guaranteed completely secure. Protect your device, browser profile, Google account, and AI provider key.

7. Google API data-use commitment

expTracker’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide the sign-in, backup, and restore features described in this policy. It is not sold, used for advertising or credit decisions, or used by expTracker to train generalized AI or machine-learning models.