Privacy Policy

2. Bank SMS

If you turn on Auto-categorize messages in Settings, AuraSpend asks Android for permission to read SMS (READ_SMS). Only then does it read your inbox, and only for messages it can take as bank or card activity.

• Processing happens on your device. Message text is never uploaded.
• Messages that look like one-time passwords or alerts are skipped unless they also describe a movement of money. Messages that contain an amount but that no parser recognises are kept in a separate list for you to review, rather than discarded.
• Identifiers are masked before storage. Phone numbers, UPI references, UTRs, folio ids and hash-like tokens are removed from the message text before it is written to the database, and from the notes and exports as well. Amounts, dates and the bank's own card mask are left intact so that the app still works. A one-off backfill masked the messages stored before this behaviour existed.
• You can turn the feature off at any time. Turning it off stops new messages being read. It does not delete the transactions it has already created.
• You can deny the permission and use AuraSpend fully. Expenses can be entered by hand, or imported from a CSV file.

Android's Auto Backup is configured to exclude the app's database, its SMS queue, its preferences and the model directory, so these are not copied to Google's backup service, and they are not carried over in a device-to-device transfer.

3. Network use

AuraSpend requests the Internet permission for two optional features. Those are the only times the app connects to anything.

Nothing else is contacted. The app has no server of its own.

4. Google Drive

Google Drive is used for two things, and only when you ask: backing up your data to your own Drive, and restoring a backup. Both live under Settings → Data; restore is also offered during onboarding. This feature is not present in the F-Droid build — see section 8.

• Scope: the app requests the drive.file scope. This lets it read and write only the files it creates, not the rest of your Drive.
• Where it lives: the backup is a file named auraspend_backup.json in your own Google Drive.
• Contents: transactions, categories, budgets, subscriptions, savings goals, the stored bank-message queue, the messages the app could not turn into a transaction, and the classification memory. Message bodies are stored with phone numbers, account fragments and reference ids masked, but they are still message text. The file is not encrypted by AuraSpend, so anyone who can open your Drive can read it.
• Restore replaces data: restoring replaces the data on the device in a single transaction. If the restore fails, the existing data is left as it was.
• Authentication: sign-in is handled by Google. We never see your Google password.

A backup runs only when you tap it, and it overwrites the previous backup file. There is no scheduled or background sync, and nothing is uploaded on its own.

Google's handling of data in your Drive is governed by Google's Privacy Policy.

5. On-device model

The smart-categories model is a sentence encoder, about 22 MB, used to suggest categories. It is downloaded from Hugging Face only after you tap the download button, and it runs entirely on your phone. AuraSpend is fully functional without it — the parsing layer does the categorising on its own.

• The file is checked against a fixed SHA-256 digest before it is used. A file that does not match is rejected.
• You can delete the model in Settings. The app keeps working, and your transactions are not affected.

Hugging Face's handling of requests is governed by its privacy policy.

6. Storage and deletion

Your data is stored on this device, and kept until you remove it.

• Individual records: delete a transaction, budget, subscription, goal or category from its screen.
• Everything at once, from inside the app: Settings → Data → Delete all data wipes every table, re-seeds the default categories and forgets the position of the SMS scan, so a fresh scan can pick your inbox up again. It asks for confirmation first.
• Everything at once, from outside the app: uninstall AuraSpend. Android removes its local data with the app. Clearing the app's storage in Android's Settings does the same without uninstalling. The encrypted database and its write-ahead log go with it.
• Bank-message queue: processed messages remain in the local queue. Uninstalling the app removes them.
• Unrecognised messages: deleted automatically after 30 days, by the same background pass that classifies new messages.
• Smart-categories model: delete it from Settings.
• Drive backups: uninstalling does not delete backups in your Google Drive. Delete the auraspend_backup.json file in Drive to remove it.

7. Security

• The database is encrypted at rest. AuraSpend uses SQLCipher, and the passphrase is derived from a non-exportable key held in the Android Keystore. The passphrase is never written to disk, to a log, or into a backup. There is no fallback to plain text: if the key cannot be obtained, the app refuses to open the database rather than opening it unencrypted.
• Identifiers are masked before storage, as described in section 2.
• An optional app lock — a four-digit PIN stored only as a salted PBKDF2 hash, with a biometric shortcut where the hardware supports it. It locks on a cold start and again after a minute in the background. There is deliberately no back door: “forgot PIN” wipes the data through the same path as “Delete all data”.
• Your data is kept in an on-device database that other apps cannot read.
• The app's release builds are signed, and the release process verifies the signatures before publishing. Each release publishes a SHA-256 checksum file alongside the artifacts.
• Android's Auto Backup and device-to-device transfer exclude the database, the SMS queue, the preferences and the model directory.

No software is perfectly secure. Your phone's lock screen and device encryption are the main protection for data on a lost or shared device. Drive backups are not encrypted by AuraSpend; treat them as you would any file in your Drive. CSV exports are likewise plain files that you choose where to put them.

8. The three builds

AuraSpend ships in three forms. They contain the same application code; the differences are the packaging and the optional Google services.

The update check asks the Play Store app already on your device whether a newer version exists. Nothing about the question — or the answer — is sent to AuraSpend, which has no server to send it to; the record of which version you run stays between Android and Google Play, exactly as it does for every Play-installed app.

There is no analytics, advertising or telemetry in any of them, and no feature is held back behind a purchase. The differences above are recorded in the project's decision records, ADR 0012 and ADR 0013.