Privacy Policy
Last updated September 26, 2026. App 2.0.0. Applies worldwide
Your money data stays yours. Income, expenses, transfers, accounts, budgets, goals, and debts live in a local SQLite database on your phone. Optional Google Drive backup is encrypted on the device before it leaves. We do not sell personal information. Support is through Settings in the app, or Contact.
Who this is for
Pesa Notes is a personal finance app for one person on Android. Firebase Authentication (email or Google) is required at setup. Email sign-in must be verified. Setup then asks for country (currency is set once) and accounts (or Cash at zero). Drive backup and Play purchases are opt-in. Crash reports go to Firebase Crashlytics when Firebase starts; they are not a copy of your ledger.
Information you provide
- Account. Email and/or Google sign-in (name, email, optional photo URL from the identity provider).
- Profile. Display name is taken from Google or email at sign-in. You can edit it later in Settings. By default we show the account photo from Firebase. If you pick a custom photo in Settings, a copy is stored only in app documents on the device. “Use account photo” clears that local override. We do not host the photo on our servers. There is no name-or-photo step during setup.
- Money you enter. Accounts, transactions, budgets, goals, debts, country/currency, and settings stay on the device unless you opt into backup. Insights (take-home, spent, remaining, category mix, daily totals) are calculated on the device from that ledger. We do not receive those figures.
- App lock. A 6-digit PIN or a password is hashed on the device (bcrypt). We never receive it. Fingerprint templates stay in the OS. Forgetting the PIN requires proving the same Google or email sign-in; that turns lock off on this phone only.
Automatically collected
- Device and app identifiers used by Firebase or Google Play for sign-in, billing, crash reports, and (on the free tier) ads. We do not send your transaction amounts or notes to those services.
- Firebase Crashlytics records crashes when Firebase is available. Firebase Analytics is initialized with the app. Neither is a copy of your ledger. There is no separate in-app toggle to turn them off.
What we do not collect
- GPS / precise location
- Contacts, call logs, SMS, or other apps' data
- Biometric templates (fingerprint stays on the device)
- Exact-alarm special access; reminders use inexact alarms
- App Tracking Transparency. The published app is Android.
How we use it
- Create and keep your signed-in profile
- Run the ledger and Insights on the device (take-home income is what arrived; PAYE and social fund you record as withheld never hit the account and are not spent)
- Restore an encrypted Drive backup when you ask
- When you sign out to use another email, save an encrypted Drive copy first (if backup is on), then clear the ledger and prefs on this phone so the next person starts fresh
- Process Premium through Google Play Billing
- Show a Google AdMob banner on Home, Activity, Plans, or Insights on the free tier
- On-device reminders you enable (not remote push): daytime check-ins every 4 hours from 08:00 to 20:00 local, weekly review Sunday 18:00, bills the morning before they are due, Premium expiry, and backup finished
- Reply to support requests sent from the app
Advertising (free tier)
The free plan may show a Google AdMob banner on Home, Activity, Plans, or Insights. Ads never show on save, over You have, or over +. They are not a full-screen video and are not styled as a bank offer. We do not send your ledger to AdMob. Android may use the advertising ID for this. Premium removes ads. You can also limit ad tracking in system settings.
Third-party services
- Firebase Authentication. Required sign-in (email or Google).
- Google Sign-In. Optional method. We receive name, email, and photo URL.
- Google Drive. Optional encrypted backup in your Drive. We cannot read the file. This is not live multi-device sync.
- Google Play Billing. Premium. We never store card numbers.
- Google AdMob. Banner on Home, Activity, Plans, or Insights on the free tier.
- Firebase Crashlytics & Analytics. Crash reports and app analytics when Firebase starts. Not a copy of the ledger.
Permissions
- Internet / network state. Sign-in, backup, Play Billing, ads, Crashlytics, and the in-app browser.
- Camera / photo picker. Optional profile picture only. Camera is requested when you take a photo. Gallery uses the system photo picker (not a photos permission; no full library access).
- Fingerprint. Optional app lock. Templates stay on the device.
- Notifications. The five kinds you turn on in the app (daily check-in, weekly review, upcoming money, Premium alerts, backup finished). Runtime prompt on Android 13+.
- Boot completed / wake lock. Reschedule reminders after reboot and show them if the device is asleep.
- Play Billing / advertising ID. Premium purchases and free-tier ads.
We do not request contacts, microphone, location, Bluetooth, calendar, or exact-alarm special access.
Storage and security
- Ledger in on-device SQLite; 6-digit PIN hashed; optional app lock
- Accounts with transactions, recurrences, or a linked goal cannot be deleted (that would wipe those records). Archive hides them from everyday use; history stays on the device
- Drive backups encrypted on the device with a key derived for your account
- HTTPS/TLS for network calls
- Privacy, terms, and store pages open in an in-app browser that clears cookies, cache, and history when you leave
Sharing
We do not sell your data. We share only with the Google services above as needed to run the app, if required by law, or with notice if the product is transferred.
Your choices
- See and edit money in the app
- Copy what you entered from the screens in the app
- Archive an account to hide it from You have and everyday picking. Delete only unused accounts with no transactions, recurrences, or linked goal
- Turn Drive backup off; delete files in Drive yourself
- Delete account in Settings, then Account. Local data is removed; Firebase account data is purged within 30 days
- Cancel Premium in Google Play
Retention
- Local data until you delete the account or uninstall
- Drive copies until you delete them
- Crash logs typically up to 90 days
Children
Pesa Notes is intended for adults managing their own money (18+). We do not knowingly collect data from children under 13. Contact us if you believe a child created an account.
Changes
We will update the date on this page and, for material changes, show an in-app notice. Continued use after an update means you accept the revised policy.
Contact
Privacy questions: use Settings in the app, or Contact. We aim to reply within 48 hours.