1. Introduction

Family Budget Tracker ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal and financial data.

2. Data We Collect

2.1 Account Information

• Email address (for login and communication)
• Password (hashed and never stored in plain text)
• Subscription status and payment information (processed by Stripe)

2.2 Financial Data (You Provide)

• Transaction details (dates, descriptions, amounts, categories)
• Account names and balances
• Budget limits and savings goals
• Bank statements (if you use AI upload feature)

2.3 Optional Android Notification and SMS Capture

• Android notification access exposes notification events to the listener. FBT processes notification text from supported bank and Wallet packages selected for capture; other notification content is discarded on the device and is not sent to our API or Gemini.
• Optional SMS sync requires your affirmative in-app consent and Android SMS permission. Android delivers new incoming SMS messages to FBT for on-device filtering. Sender IDs are inactive until you explicitly approve them in Settings; account names and notification-app selections never approve SMS senders automatically.
• FBT checks message text on the device for transaction-like financial alerts and common OTP/security wording. This filter can miss a sensitive message. Only a financial-looking message from an approved sender is queued for transaction processing; unapproved and non-qualifying message text is discarded on the device.
• Eligible alert text and sender ID are sent securely to our server for transaction extraction and may be sent to Google Gemini for extraction and categorization. The server stores resulting transaction or review data under your account, not the raw SMS body in notification audit logs.
• Unsent SMS alerts are encrypted at rest with an Android Keystore key and held in a queue capped at 500 messages. In the Google Play version, queued alerts are associated with the signed-in FBT account and capture pauses at logout; queued messages are not sent to another account. When the queue is full, new alerts are not added. Messages older than 7 days are discarded the next time FBT processes the queue; a stopped app may retain encrypted queue data until it runs again. Disabling SMS sync or removing a sender deletes its unsent messages. An alert already being transmitted may finish processing.
• If you explicitly enable rejected-alert troubleshooting, up to 20 rejected bank or Wallet alerts are stored in encrypted, device-bound storage for 30 days. They are never uploaded as diagnostics, are visible only inside your signed-in app, can be protected by the optional biometric app lock, can be deleted in Settings, and are cleared at logout. Authentication codes are never retained in this vault.
• SMS sync is optional. You can disable it in FBT or revoke SMS permission in Android settings. Ordinary budgeting and manual transaction entry remain available. Android may show a service notification while an eligible alert is being synchronized.

2.4 Usage and Direct APK Metrics

• Number of accounts, categories, and transactions created
• Number of statements uploaded
• Feature usage statistics (for service improvement)
• Login timestamps, IP addresses, and approximate country derived from the login IP (for security and administrator support)
• Anonymous landing and activation events, APK download sessions, app version, and last app launch
• Installation metrics use a random app token. We do not collect IMEI, Android ID, advertising ID, phone number, or raw hardware identifiers for these metrics.
• SMS message text, sender IDs, permission status, and SMS sync status are not included in anonymous installation telemetry.
• When you sign in and enable push notifications, the registered app version and last registration time are associated with your account for update delivery and support. Push tokens are not displayed in the admin user interface.

3. How We Use Your Data

• Provide the Service: Store and display your budget data
• AI Processing: Extract transactions from uploaded statements (Premium only)
• Improve the Service: Analyze usage patterns to fix bugs and add features
• Communication: Send important updates, security alerts, and subscription notifications
• Billing: Process subscription payments via Stripe

Note on Anonymized Intelligence: To improve categorization for all users, we maintain a Global Merchant Cache. This only stores the mapping of Merchant Name → Category (e.g., "Tesco → Groceries"). All personal metadata (amounts, dates, card numbers, user IDs) is stripped away before this mapping leaves your private database.

4. AI-Powered Statement Processing (Premium Feature)

If you use the AI statement upload feature, your bank statement is processed using Google Gemini AI.

4.1 What Data is Sent to Google Gemini

• Your full PDF bank statement (including account numbers, balances, transactions)
• Visual document processing is used to improve extraction, but accuracy varies by bank, country, language and statement layout.

4.2 Google's Data Protection

• Gemini is called through a paid API account under Google's then-current data terms.
• We request deletion of uploaded Gemini Files after processing, including when processing fails.
• Google may retain or process request data for limited service, security or abuse-monitoring purposes as described in its terms. We do not promise immediate deletion from every provider system.

4.3 Data Retention

• Original PDF: Scheduled for deletion from our temporary storage after processing; failures are retried and monitored
• Extracted transactions: Stored in your account until you delete them
• Cloudflare R2: Temporary storage during processing, with provider-managed encryption at rest

For full details: AI Statement Processing Disclosure

5. Third-Party Services

5.1 Google Gemini AI

• Purpose: Extract transactions from bank statements
• Data shared: PDF bank statements (Premium users only)
• Data retention: Uploaded Gemini Files are deleted by our application after processing; Google-controlled retention is governed by the applicable paid API terms
• Privacy policy: Google Cloud Privacy Notice

5.2 Cloudflare R2

• Purpose: Secure, temporary file storage during statement processing and encrypted backups
• Data shared: Encrypted PDF files and encrypted database backups
• Data retention: Statements are deleted after processing (typically within minutes). Backups are retained for 30 days.
• Privacy policy: Cloudflare Privacy Policy

5.3 Neon Database

• Purpose: Primary data storage for your financial records and account settings
• Data shared: All application data (encrypted at rest)
• Data retention: Retained while account is active
• Privacy policy: Neon Privacy Policy

5.4 Stripe

• Purpose: Payment processing for subscriptions
• Data shared: Email address, payment information
• Data retention: Stored by Stripe for billing purposes
• Privacy policy: Stripe Privacy Policy

5.5 Google Drive API

• Purpose: Automatic statement fetching via Magic Drop
• Data shared: The current Magic Drop service account can access only the folder to which you grant it access. A legacy Google Picker path, if used, accesses files selected through the connected Google account.
• Data retention: Files are processed and optionally archived/trashed in your Drive
• Privacy policy: Google Privacy Policy

5.6 Firebase Cloud Messaging

• Purpose: Deliver optional Android push notifications
• Data shared: App push token and notification delivery data

5.7 Resend

• Purpose: Send verification, support, security and service emails
• Data shared: Email address, recipient name where supplied, and email content

6. Data Security

• Encryption at Rest: All data is stored using industry-standard AES-256 encryption. Our primary sub-processors (Neon and Cloudflare) enforce encryption at rest by default.
• Encryption in Transit: All communication between your device and our servers is secured via TLS 1.2+ (HTTPS).
• Sub-processor Compliance: We select partners that adhere to strict security frameworks, including SOC 2 Type II and ISO 27001.
• Password Protection: Passwords are hashed using PBKDF2 with a SHA256 salt (industry standard).
• Access Control: We use role-based and least-privilege controls. Authorized operators may access underlying systems when needed for security, legal obligations or user-requested troubleshooting.
• Regular Backups: Full database backups are performed daily and stored with 256-bit encryption in Cloudflare R2.

7. Admin Access & Transparency

What the App Owner Can See:

• ✅ Your email address and subscription status
• ✅ Number of statements uploaded, accounts created, etc.
• ✅ System usage statistics (for debugging)

What the Admin Dashboard Does Not Display:

• ❌ Your transaction details (descriptions, amounts)
• ❌ Account balances or financial data
• ❌ Statement content or PDFs

These dashboard limits do not mean the operator is technically unable to access underlying hosted systems. Access is restricted to legitimate support, security, legal and operational needs.

8. Your Rights (UK GDPR & EU GDPR)

• Right to Access: Request a copy of your data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Delete your account and all data
• Right to Data Portability: Request a portable copy of your data at no charge, regardless of plan
• Right to Object: Opt-out of AI processing (use manual entry)

To exercise these rights, visit Settings or contact us at support@getdigraw.com. Formal privacy requests are free.

9. Account Deletion

You can delete your account at any time from Settings → Delete Account. If you cannot sign in, use our public account-deletion page.

What Gets Deleted:

• All transactions, categories, and accounts
• All uploaded statements and extracted data
• All savings goals and budgets
• Your email and personal information
• Your Stripe subscription (automatically canceled)

What We Keep (Anonymized):

• Aggregated usage statistics (e.g., "A user uploaded 5 statements in December 2025")
• No personally identifiable information is retained

Delete My Account

10. Cookies & Tracking

We use minimal cookies for:

• Authentication: Keep you logged in
• Session Management: Remember your preferences
• First-party measurement: Count anonymous landing journeys and APK download sessions

We do not use Google Analytics, advertising cookies, or cross-site tracking. Reinstalling the Android app creates a new random anonymous installation record.

11. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the app. Continued use after changes constitutes acceptance.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

• 📧 Email: support@getdigraw.com
• 💬 Support Center: Visit Support

Related Pages:

• Terms of Service
• AI Processing Disclosure