Every release, newest first.

A small feature release on 0.1.98. No database, data-model or classification change — the test corpus is bit-identical.

Added

• App shortcuts. Long-press the AuraSpend icon for Quick Add, Activity and Review SMS. Each opens the thing it names, including when the app is already running.
• A written reason for the SMS permission. Before Android's prompt, the app says what it reads, what it ignores, and that parsing stays on the device — in English and Hindi.

Changed

• The transaction detail screen now runs on a ViewModel. State, lookups and saving moved out of the composable, with a 214-line test suite behind it. The same screen, with a testable spine.

Site

• A day/night switch in the header, replacing the moon/sun icon button, adapted to the site's own palette.
• Two comparison pages published: expense trackers in India, and offline expense trackers for Android.

A presentation release, and a subtraction. No database, data-model or classification change — the test corpus is bit-identical.

Changed

• Page changes are instant. There is no slide, no fade and no zoom between screens: the next screen is simply there. Moving between screens used to slide the new page in while the old one faded, and Back nudged the page before removing it. Now nothing moves except the touch ripple.

Fixed (site)

• The privacy policy is generated from one source and now lists every permission the app asks for and why each one is needed.

Patch on 0.1.96. No database, data-model or classification change — the test corpus is bit-identical. But five families of silent wrong rows, found in a real export, are fixed.

Fixed

• A bank's balance could be booked as the transaction amount. One bank writes the movement bare and the balance rupee-marked, so the balance was the only rupee figure in the message and won. Balance clauses are now masked before amounts are read.
• A statement summary could be booked as one movement. A numbered list of legs closed with a balance, and the balance was taken. A numbered leg list is now refused outright.
• A counterparty's receipt could be booked as your income. “Your payment has been received” from a utility, an insurer or a lender carries a credit word. A payment confirmation that is your only record of a real expense still books.
• Both legs of your own transfer could be booked as spending. One message describing a debit from one account and a credit into another is now a transfer, which the totals exclude.
• Real merchants were filed as transfers, which removed them from every spending total. Hospitals, pharmacies, fuel stations, restaurants, bakeries, sweets and supermarkets are now categorised.

This release is forward-only. Transactions already in your database keep the amounts, dates and categories they were given; a re-ingest is the only way to correct history.

Patch on 0.1.95. No database, data-model or classification change — the test corpus is bit-identical.

Fixed

• A transaction could be dated by the day the app scanned your messages rather than the day the message arrived. An advertisement that happened to say “today” was read as a date, which booked a message from 2021 on the day of a re-scan. A message that names no date now takes its arrival time.

Patch on 0.1.94. The golden corpus scores exactly as before — the marketing this release refuses was never in it. Two UI defects, and one class of phantom transaction.

Fixed

• “See all” on Home opened Activity with {query} written into the search box, which filtered every row out. The template is no longer navigable, so the tab opens clean.
• The Activity tab now draws itself as the selected tab. It never could: the bar compared the destination's route pattern with the bare route, and the two never matched.
• Advertising is no longer booked as money. A message that quotes a price and a link, a cashback offer, a coupon, a prize pool, a “spend and earn” prompt or a wallet credit that wants a click is not a payment. A cashback that has been credited still is, and so is a real debit.

Patch on 0.1.93. No schema migration and no classification change — but the Play build's update check now has somewhere to speak, so this is not a presentation release either.

Added

• The update check is quiet and visible at once. One silent check, at most once a day, feeds a line in Settings → About, a dot on the header avatar, and one dismissible strip below the balance on Home. Nothing starts on its own unless the release is marked urgent.
• A download that finished while the app was closed now offers its restart on the next launch, instead of waiting to be found in Settings.
• A release can be marked urgent. Priority 4 or 5 opens Play's own full-screen update flow on launch; a routine release never interrupts.
• One notification, for people who have not opened the app. An update waiting three days or more produces a single notification on its own channel — announced once per release, and never for an urgent one.

Site

• A wrong address now serves a real 404 page in the site's own layout, the FAQ chevrons are no longer clipped, and footer links clear a 24 px tap target.

Patch on 0.1.92. No data, schema or classification change — but one thing behaves differently now, and three things a screen reader could not read are fixed.

Fixed

• The search field had no accessible name. The hint was drawn next to the field rather than attached to it, so a screen reader announced a text field and not what it was for. The merchant field in Quick Add had the same problem.
• The settings switches had no accessible name either — "switch, off", and nothing after it.
• Tapping a setting's name now turns it on or off, as every other row in that screen already did. Only the switch itself used to respond.

Added

• An end-to-end UI test suite — thirteen flows that drive the app the way a person does. It found the three fixes above in its first hour, and it is now what keeps them fixed.

The second patch of the 0.1.9 line. It does carry a database migration this time — two extra columns, both optional — and two features.

Added

• The home screen, rebuilt. Your balance, this month's money in and out, a seven-day spending chart, your budgets as rings, your subscriptions, and the accounts your bank told us about.
• Accounts and cards as a ledger. When a bank message states a balance, the app keeps it: one row per account, with the last four digits and when the figure was last seen.
• A fresh install reads your inbox at once, instead of waiting for the next hourly pass.

Fixed

• Amounts with paise could be rounded wrongly — ₹1,23,456.78 shown as ₹1,23,456.80. The Indian digit grouping rounded to one decimal and filled the second with a zero.
• The Activity header counted the whole month even when the list was filtered to one category or one direction — and an empty filtered list sat under a large number.
• More shop and travel names are filed under the right category, and a payee name now ends where the message says it does.

A patch on 0.1.9. No data, schema or classification change — presentation only.

Fixed

• Plan said “0 active subscriptions” above a Subscriptions screen listing four. The hub read only the tracked rows, while that screen also shows the recurring payments the classifier detected. It now reads both and says “N active · M detected”.

Added

• Home shows the last seven days as a strip of columns, today's column in ink. Below the budgets card, a day with no transactions used to leave the screen empty.

Changed

• Tab switches are instant. A cross-fade put each of two full screens into its own alpha layer; the worst tab frame was 17.4 ms against a 16.7 ms budget.

A release-only crash fix. 0.1.8 aborted the moment the on-device categoriser ran — that is, the moment a bank message was classified. Nothing changed in what the app does, only in what R8 is allowed to remove.

Fixed

• The production build crashed while categorising a message. R8 had stripped ai.onnxruntime.TensorInfo and OnnxJavaType; the runtime's JNI constructs them by literal name, so the lookup returned null and the VM aborted. A JNI abort cannot be caught, so the whole app died. Debug builds are not minified, which is why every earlier on-device check had passed: the encoder had never run in a minified build.

Changed

• The R8 release check now derives the classes the JNI needs from the shipped native library instead of a hand-written list of three, so an ONNX Runtime upgrade that adds a class fails the gate rather than the app.

The Quiet Ledger interface: the app redrawn on a new concept. Monochrome chrome with colour only in the data, a typographic hero instead of the gradient, bars instead of rings and donuts, and a first-run that speaks the same language. No data, schema or classification change — the SMS pipeline, the money arithmetic and the stored data are untouched.

Changed

• A new look, app-wide. Warm paper and ink with a single violet accent, red demoted to a status colour, and the typeface carrying the hierarchy at its real weights — every bold had been rendering at regular weight, because one variable font was registered six times.
• Home is a glance, not a dashboard. Balance, a flow bar, a “needs you” rail, one budget aggregate, recent activity and cash flow. The spending chart moved to Insights as a daily strip.
• Activity gained a month-and-total sub-line, one filter row on the app's standard chip, and row metadata that is the time of day. Insights ranks categories and merchants, capped at six rows with a summed tail.
• Plan states how far over you are and on what; over-budget rows show the true percentage instead of clamping at 100 %.
• Settings regrouped into Money / Messages / Appearance / Data / About, with the theme behind a sheet and a live review-queue count.
• Quick Add follows the concept's order and opens expanded, so Save is never below the fold. One chip control is now shared by Activity, Quick Add, the editor, classification, budgets and subscriptions.

Fixed

• Screen transitions no longer rebuild the app. Every top-level ↔ detail crossing moved the whole navigation subtree in the composition; it is one stable slot now. Home's load no longer re-runs on every return.
• A fresh baseline profile — the old one knew none of the current screens. Worst UI-thread frame on Activity → detail → back, release build: 66 ms → 33 ms.

A UI-correctness patch from a full on-device walk. No database, data-model or classification change.

Fixed

• Quick Add's category picker now uses the app's standard chip — the same control as the Activity filter row and the transaction editor. The tile it replaces had labels overflowing a fixed pill and an invisible selected state.
• Budget percentages no longer clamp at 100 %. The Plan hub said “100 % used” next to ₹33,467 of ₹26,000; it now reads 128 % with an error colour and “Over by ₹7,467”.
• The Insights saving badge takes its minus from the shared money helper, matching the net amount beside it.
• The Plan hub scrolls at very large font scales instead of clipping its last rows.

A Play-distribution release. No database, data-model or classification change.

Added

• Play-only in-app updates. Settings → About now has Check for updates in the Play build. It asks Play whether an update is available, starts a flexible download, and turns into “Update ready — tap to restart” when the download finishes. There is no forced update and no prompt on launch.
• The F-Droid build has no Play Core dependency and no update row; F-Droid handles updates there. The dev build also hides the row.

A classification-correctness release, prompted by a closed tester's export. No visual redesign, no new feature, no schema change, and no change to the encrypted database — existing rows carry over unchanged.

Changed

• Classification accuracy re-measured honestly — the golden corpus now scores amount and date and counts correct rejections as passes. Measured: 80/82 exact (97.6 %), type 98.8 %, category 100 %, merchant 98.8 %, amount 98.8 %, date 100 %.

Fixed

• Informational messages are no longer saved as transactions. Reward points, mutual-fund NAV notices, card offers and expiry reminders all carried an amount plus a word the movement lexicon knows. They are vetoed now, with the load-bearing rule that a completed debit outranks every informational phrase.
• Payment rails are not categories. upi, neft, imps and rtgs were category cues, which filed 43 % of a closed tester's export under “Transfer”. A rail with a person-shaped counterparty is a person-to-person transfer, where money received is income and money sent is an expense.
• Mutual-fund and SIP debits are investments, and a fund's NAV can no longer become the merchant.
• Payee names survive the compact “Refno” form, which used to take the counterparty with it.
• HDFC's “If not you” tail no longer drops a genuine debit.
• Sender routing merges over the global parse, so a per-bank parser can no longer blank a merchant or date the global parser already resolved.
• Own-account transfers are excluded from every total.
• Corrections teach future messages. Detail-screen edits learn, memory generalises location suffixes, and a remembered category no longer suppresses recurring detection.

A privacy release: the top two items of the improvement list, as separate pull requests that landed together.

Added

• App lock: an opt-in four-digit PIN, stored only as a salted PBKDF2 hash, with a biometric shortcut where the hardware supports it. It locks on every cold start and again after more than a minute in the background. “Forgot PIN” wipes through the same sweep as Delete all data; there is no back door.
• The database is encrypted at rest (SQLCipher). The passphrase is derived from a non-exportable Android Keystore key and never stored anywhere; an existing database is upgraded in place, once, before the app opens it.

Notes

• The one-time upgrade is crash-safe: the plaintext original is moved aside rather than deleted, the encrypted copy takes its place, and only then is the backup removed.
• Do not sideload an older release over 0.1.5 — a pre-0.1.5 build cannot open the encrypted database.

A correctness release measured against a real inbox: the on-device classifier runs for the first time, the reconstructed books match message for message, and the app gains its F-Droid build.

Added

• Detected subscriptions — recurring payments the classifier had always flagged now surface under a “Detected from your messages” section, each with a one-tap Track that opens the add sheet prefilled.
• Skipped-message history in Smart Add — “Skipped (N)”, Classify again and Skip all — so a parser fix can reach messages that were set aside.
• Activity browsing: month navigation, a newest/oldest sort toggle, and drill-down from Insights into the filtered list.
• Settings: SMS-access status, a categorisation-notifications toggle, and Delete all data (wipe, re-seed, re-scan).
• Category icon and colour pickers in the category editor.
• Transaction detail: tap the hero to re-categorize, Share as plain text, and the original SMS with sender and received time.
• Investments category — EPF contribution confirmations book as an investment, not income.
• F-Droid build — a third flavour without Google Play Services, and therefore without Drive backup.

Fixed

• The optional on-device classifier now actually runs. A wrong tokenizer filename and a missing model input had kept it inert behind caught exceptions while the UI said “ready”.
• Dates: month-first formats parse, and messages without a date are booked at their arrival time instead of when they were scanned.
• Smart Add no longer lags while a drain is classifying messages.
• Fewer wrongly skipped payments — the duplicate guard is paise-flat, and payments it had swallowed are restored on the next pass.
• Dark and AMOLED visibility: back buttons, month chevrons and the navigation-bar icons were black on every background.

A categorisation fix release, measured by draining a real 1,952-message inbox on a device: the triage surface became visible, and four defects that had silently dropped or mis-filed real money are fixed.

Added

• Visible categorisation status. The triage tab shows a determinate progress header, an “N messages waiting” line and a “Categorizing…” chip on the message being processed.
• One honest notification per drain — a single ongoing determinate notification while messages are categorised, and one summary at the end.
• OTPs, alerts and promos are dropped when messages are ingested, so the queue, its progress count and the pick-list hold only real candidates.

Fixed

• Genuine card spends were silently deleted. One bank appends an anti-fraud warning to every card alert, and the hard anti-fraud veto treated that tail as a phishing lure — three real spends appeared nowhere. The veto now has one narrow exception for the bank's own alarm shape.
• The triage screen no longer hides behind the optional 22 MB model. The queue, its progress and its swipe actions render whether or not the model is downloaded.
• Credits phrased around their reversal were skipped as typeless, and now record as income.
• Dashed month-name dates never parsed, so those transactions were saved with the time they were processed. The date pattern, month-name matching and the duplicate check's amount gate are all fixed.
• “Payment attempt … unsuccessful” and “refund … has been initiated” are treated as alerts instead of piling into the unrecognised list.

The reliability release. A 32-finding code review is fixed end to end — the on-device categoriser had been silently inert in production, and three separate paths could lose, hide or overwrite real money — plus Google Drive backup, a currency picker, and guarded release signing.

Added

• Google Drive backup. The app could restore from Drive but had no way to create a backup; Settings → Data now has both. The backup serialises every user-owned table inside one transaction, and restore (a replace, not a merge) asks for confirmation first.
• Currency picker. 30 currencies, captured offline as a source constant, with the device currency preselected. Formatting only — no FX conversion, and the picker says so.
• The test suite grew 256 → 350, and a privacy-claims check joined the licence check in CI: an absolute privacy claim without its exception now fails the build.

Fixed

• The flagship on-device categoriser was inert in production. The centroid asset is little-endian; the reader parsed big-endian, failed, and the failure was swallowed into “model unavailable” while settings said “ready”. The asset digest is now pinned and a test decodes the real asset.
• The model's discard gate was dead code, so the threshold could never fire; a test now fails if it becomes unreachable again.
• A duplicate source reference could delete the user's edited transaction. Writes are now update-if-present, insert-if-absent, and CSV import is one all-or-nothing batch.
• A fresh install never ingested its SMS history. A single watermark advanced past everything older than the newest 500 messages; the scan now keeps a high-water mark plus a downwards history walk.
• Deposits and refunds with a balance tail were dropped before parsing, and sender-first routing had no production callers. Both fixed.
• Restore re-imported unmasked message bodies from pre-masker backups; restore now masks the message queue on the way in.
• The 30-day unrecognised-message purge was never called; it now runs on the periodic worker tick.
• The R8 and native-runtime audits are now CI gates.

A substantial pre-1.0 release. The headline is that the on-device categoriser shrank from 468 MB to 22 MB, and the project changed licence.

Changed

• Licence: Apache-2.0 → AGPL-3.0-or-later, so that a modified AuraSpend offered to users over a network must offer its source too. Irreversible for this code, and recorded in ADR 0009.
• On-device categoriser: 468 MB generative model → 22 MB int8 encoder. Five candidate runtimes were measured before the choice was made.
• Two ABIs instead of four. The bundle went from 35.4 MB to 20.5 MB, the APK from 78.8 MB to 37.2 MB.
• The model is downloaded at runtime after an explicit opt-in, and its digest is verified before use.

Fixed

• A fresh install silently downloaded the model and enabled auto-read with no prompt. Consent was a tap on an inline card instead.
• Swipe-to-save and swipe-to-delete were silent no-ops. Both used a callback that is deprecated without replacement, so it was never invoked — the row animated, painted a coloured background, and changed nothing. Both now drive off the settled state, and both are undoable.
• The triage inbox never drained. Saved and dismissed messages stayed listed forever. They now leave the list, and undo brings them back.
• Plan reported ₹0 while the home screen reported real spend — a stale cached column.
• Unguarded enum parsing in the mapper — one corrupt value could brick the dashboard.

Added

• Open-source licenses screen in the app, which AGPL-3.0 §4 requires. Before this the app displayed only the licence string with no way to read anything.
• A CLA with copyright assignment, so contributions can be relicensed as a whole later.
• A licence-consistency check, run in CI. The licence had already drifted across eleven files.

First alpha. Feature-complete for its scope: a Material 3 interface, bank SMS classification, budgets, subscriptions, savings goals, and Google Drive backup. Licensed under Apache-2.0 at the time — releases up to and including this one remain under that licence.