> For the complete documentation index, see [llms.txt](https://tribalfs.gitbook.io/accountant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tribalfs.gitbook.io/accountant/agreements/privacy-policy.md). # Privacy Policy Last updated: November 6, 2026 This Privacy Policy explains what information the **Accountant** app collects, why it collects it, and who receives it. The app has the package name `com.tribalfs.acct` and is published on Google Play by **Tribalfs** ("we", "us"). This policy covers the app and this website. {% hint style="success" %} **In short:** your ledger stays on your device, or in your own Google Drive if you turn on sync. We never receive your ledger. Google services and ad partners do collect device identifiers and usage data, as described below. {% endhint %} ## 1. Data that stays on your device These are stored only on your phone, in the app's private storage: * **Your ledger:** accounts, transactions, categories, labels, budgets, cards, loans, goals, subscriptions, bank details (including account numbers you enter), exchange rates and reports. * **Attachments**, such as receipt photos and documents you add to transactions. * **Your settings**, including the app-lock PIN. Android handles fingerprint and face unlock, and the app never sees your biometric data. * **API keys** you enter for cloud AI (see section 6) and the stock price key (see section 7), encrypted with the Android Keystore. * **Sync keys:** if you turn on sync, the key that encrypts your synced ledger, encrypted with the Android Keystore (see section 5). Receipt scanning, text recognition (OCR), QR code scanning and reading dates and amounts from receipts run **on your device**, using Google ML Kit. The receipt scanner and the on-device AI engine are downloaded from Google Play the first time you use them, and the QR code model comes through Google Play services. Receipt images leave your device only if you choose a cloud AI provider (see section 6). Android's automatic cloud backup is turned off for this app, and the app's data isn't copied when you move to a new phone with a device-to-device transfer (such as Smart Switch). To back up your data, use **Create backup** or **Sync across devices** in Settings. A backup can be protected with a password; it is encrypted on your device, and we can't recover a forgotten password. ### Drafts from bank alerts (optional) If you turn on **Settings › Bank alerts** and give the app **notification access**, the app reads notifications from your text messaging app, your email apps and the apps of your banks and e-wallets. It reads only alerts from the banks of accounts you switched on, and turns money alerts into draft transactions. Other notifications are ignored and not stored. Alerts are processed on your device. An alert the app can't read is sent to your AI provider only if you set up a cloud provider (see section 6), with account numbers masked. You can turn this off at any time, and withdraw notification access in Android settings. ## 2. Data collected automatically by Google services The app uses Google Firebase and Google Play services. They collect the following automatically: | Service | Data | Purpose | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------- | | Firebase Analytics | App instance ID, advertising ID, app opens and sessions, device model, OS version, language, approximate location derived from IP address | Understanding how the app is used | | Firebase Authentication (anonymous) | A random anonymous user ID. No name, email or password | Securing access to app services | | Firebase App Check / Play Integrity | Device and app integrity signals | Protecting against tampered apps and abuse | | Firebase Remote Config | App instance ID | Delivering app settings, such as the list of on-device AI models, ad settings and which features are part of Premium | | Firebase Crashlytics | Crash reports: stack traces, device model, OS version, app version and a random installation ID. Error messages are removed before sending, so they don't contain your records | Finding and fixing crashes | | Google Play in-app updates | App version | Telling you when an update is available | Google processes this data under the [Google Privacy Policy](https://policies.google.com/privacy) and the [Firebase privacy terms](https://firebase.google.com/support/privacy). None of it contains your ledger. ## 3. Advertising The free version of the app shows ads from **Google AdMob** (Google Mobile Ads SDK). AdMob may also show ads from these mediation partners: * [Unity Ads](https://unity.com/legal/game-player-and-app-user-privacy-policy) * [Liftoff (Vungle)](https://liftoff.io/privacy-policy/) * [Mintegral](https://www.mintegral.com/en/privacy) These partners' SDKs are built into the app and may start when the app starts. For advertising, analytics and fraud prevention, Google and these partners may collect and share: * your IP address, which may be used to estimate your general location * your advertising ID, app set ID and other device identifiers * ad interactions, such as views and taps * diagnostics such as crash logs and performance data, and device information Data is encrypted in transit. To learn more, see [how Google uses information from apps that use its services](https://policies.google.com/technologies/partner-sites). **Your choices:** * You can reset or delete your advertising ID in your device's Android settings, under **Privacy › Ads** or **Google › Ads**. Once you delete it, apps can no longer use it. * On Android versions that support it, you can manage ad topics and other ad privacy settings under **Privacy › Ads › Ad privacy**. * Where the law requires it (for example in the EEA, the UK and Switzerland), we ask for your consent before showing personalised ads. * Some features let you watch a **rewarded ad** for extra uses. This is always your choice. * **Premium** removes ads. ## 4. Purchases **Google Play** processes Premium purchases (monthly and yearly subscriptions, and a one-time Lifetime purchase). We never see your card or payment details. See the [Google Play Terms of Service](https://play.google.com/about/play-terms/). To confirm a purchase, the app sends our verification service (Firebase Cloud Functions, in Google's Singapore region) the purchase token, a Play Integrity check, the anonymous user ID (see section 2) and a random key created for this installation. The service checks the purchase with Google Play and keeps a record of it in Firebase Firestore: the purchase token, the kind of purchase and when it ends. These records aren't linked to your name or email, and your ledger is never sent. ## 5. Sync across devices and shared ledgers (optional) Sync is off until you turn it on in **Settings › Sync across devices** and sign in with a Google account. * The app asks only for Google Drive's **`drive.file`** permission. This lets it see only the files it creates or that you open with it, not the rest of your Drive. * Your ledger is stored in **your own Google Drive**, in a folder named **Accountant sync** with one file per device. Attachments are stored in the `.accountant_dont_delete` folder, one **Accountant receipts** folder per ledger. * **Encrypted on your device:** before upload, each sync file and attachment is encrypted (AES-256-GCM) with a key that belongs to that ledger. Google, and anyone who gets a copy of the files, can't read them without that key. Google Drive still sees the file and folder names (which include your Device ID), the ledger ID and transaction counts. * The ledger key is kept on your device, encrypted with the Android Keystore. Sync requires **App lock**, which protects it. You can save a copy of the key as a **recovery key** file, wherever you choose, to open your synced ledger on a new phone. We never receive this key and can't recover it for you. * Each sync file includes three things that let the app tell your devices apart and recognise a reinstall: * the Device ID name you choose * the device model * a one-way hashed device identifier * Your Google account email is stored on your device so the app can reconnect. The app also reads your Google profile picture from Drive, and those of the people in a shared ledger, to show them in the app. * Attachments no transaction uses any more are deleted from your phones after 30 days, and moved to your Google Drive trash after 60 days. * We don't run a server for sync. Your data goes directly between your device and Google Drive, under [Google's privacy policy](https://policies.google.com/privacy). **Shared ledger:** when you share a ledger, the people you add get read access, through their Google accounts, to your sync file in Drive and to that ledger's receipts folder. The QR codes you scan during setup contain each person's email address and device name. The **ledger code** also contains the ledger ID, its reporting currency and the **ledger key**, so send it only to the person joining, and delete it after they scan it. People you share with can see every ledger record and open its attachments, plus the members' emails and Device IDs. Settings and API keys are not shared. You can stop sharing with a person at any time (**Remove from ledger**). They keep what had already reached their device, including the ledger key, but lose access to your files and stop receiving changes. ## 6. AI Accountant (optional) AI features are off until you choose an engine in Settings. * **On-device engine** (a downloadable model): your data, including receipt pictures, stays on your device. Downloadable models come from [Hugging Face](https://huggingface.co/privacy), which receives only the download request. The engine that runs them is downloaded from Google Play with the first model. * **Cloud engines** ([Google Gemini](https://ai.google.dev/gemini-api/terms), [OpenAI](https://openai.com/policies/privacy-policy), [Anthropic Claude](https://www.anthropic.com/legal/privacy)): you supply **your own API key**. When you use an AI feature, the app sends the content the feature needs **only to the provider you selected**. This can include: * your chat messages * figures the AI looks up in your ledger, such as balances, transactions and budgets * dashboard summaries used for insights * a scanned **receipt**: the picture and the text read from it, if the model can read pictures; otherwise only the text * bank alerts the app couldn't read itself, if you use [Drafts from bank alerts](#drafts-from-bank-alerts-optional) * for accounts with bank details, the bank name, interest terms and the **last 4 digits** of the account number (never the full number) * for **Look up online** in Bank details: the bank name, account type, currency, your country (from your mobile network, SIM or phone region) and a time deposit's term. The provider searches the web for that bank's published terms. Your account number, account holder, balance and notes are never sent. With Gemini, the app also shows Google Search suggestions that come with the answer. The provider handles this content under its own terms and your account with it. Those terms may let it keep or use the content; some free API tiers do. Your API keys are stored only on your device and are sent only to the matching provider. We never receive your prompts, the AI's replies or your keys. AI output may be inaccurate and is not professional accounting, tax or legal advice. ## 7. Exchange rates and stock prices To convert currencies, the app downloads exchange rates from these sources: * currency-api, served through [jsDelivr](https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net), with a backup at currency-api.pages.dev * [Polygon.io](https://polygon.io/privacy) * as backups, [ExchangeRate-API](https://www.exchangerate-api.com) and [Frankfurter](https://frankfurter.dev), which serves the European Central Bank's rates The list of cryptocurrencies comes from [CoinGecko](https://www.coingecko.com/en/privacy). These requests contain only currency codes and dates. Like any web server, these services see your IP address. **Stock and fund prices (optional):** if you add a key from [EODHD](https://eodhd.com) (in **Settings › Stock and fund prices**, or when you search for a stock), the app gets prices, splits and search results from EODHD using **your own key**. The requests contain the key, the symbols of the stocks and funds in your ledger, dates, and what you type when you search. Your key is stored only on your device. The prices it downloads sync to your other devices with your ledger. ## 8. Information you send us We receive information only when you choose to send it: * **Contact us** opens your email app. We receive your email address and whatever you write. * **Request import support** opens your email app with a sample file you choose, plus your device model, Android version and app language. Before sending, the app asks you to use dummy data. * **Send feedback**, where shown, sends what you wrote in the form directly to us, through Firebase Realtime Database (in Google's Singapore region). It includes the email address you add for a reply (optional), the app version, Android version, device make and model, and app language, under the anonymous user ID (see section 2). It doesn't include your records, logs or attachments. We use this information only to reply to you and to improve the app, and we delete it when we no longer need it. ## 9. Permissions | Permission | Why the app needs it | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Camera | Scanning receipts and QR codes, and taking photos to attach to transactions | | Notifications | Reminders for loans, credit cards, savings goals, subscriptions, time deposits, budgets and scheduled transactions, plus the optional daily reminder and monthly summary | | Notification access (optional) | Reading bank alerts to create drafts, only if you turn on Bank alerts | | Run at startup | Restoring reminders and scheduled transactions after the phone restarts | | Internet | Exchange rates, stock prices, sync, cloud AI, model downloads, Premium verification, feedback and ads | | Foreground service (data sync) | Downloading on-device AI models in the background | | Advertising ID | Ads and analytics | | Storage (Android 9 and older) | Saving exports | ## 10. Security Data sent over the internet uses encrypted connections (HTTPS/TLS). Sync files and attachments are also encrypted on your device before they're uploaded (see section 5). You can lock the app with a PIN or biometrics. We don't keep a copy of your ledger, so a breach of our systems could not expose it. ## 11. Keeping and deleting your data * **On your device:** uninstalling the app or clearing its storage deletes your ledger, attachments, settings and API keys. * **In Google Drive:** delete the **Accountant sync** and `.accountant_dont_delete` folders. To remove the app's access, go to [Google Account › Security › Third-party connections](https://myaccount.google.com/connections). * **Recovery key:** if you saved a recovery key file, delete it from wherever you saved it. * **Advertising ID:** reset or delete it in Android settings (see section 3). * **Firebase data:** this is linked to random IDs, not to your name, and Google keeps it only for a limited time. Feedback you send and Premium purchase records are kept until we no longer need them. To ask us to delete the data linked to your app installation, email us (see section 14). ## 12. Children The app is meant for adults managing their own finances and is not directed to children under 13. We do not knowingly collect personal information from children. If you think a child has given us information, contact us and we will delete it. ## 13. Your rights and international transfers Depending on where you live (for example under the GDPR or California law), you may have the right to: * access, correct or delete your personal information * object to how it is processed * withdraw your consent Most of your data is under your direct control, on your device and in your Google Drive. For anything else, contact us. Google and the partners listed above may process data in other countries, including the United States, under their own safeguards. We do not sell your personal information. Advertising partners may use identifiers as described in section 3. ## 14. Changes and contact We may update this policy. When we do, we will post the new version on this page and change the "Last updated" date at the top. If you have questions or requests, email ****.