ExpenseMath Privacy Policy

Introduction

This Privacy Policy explains what information the ExpenseMath app collects, how it is used and stored, and the choices you have. ExpenseMath is built around a simple principle: your financial data belongs to you, and only you should be able to read it. To that end, the sensitive financial information you enter is encrypted on your device before it is saved to the cloud, using a key that only you hold through your PIN.

By using ExpenseMath, you agree to the practices described in this policy.

The Short Version

• We use Google Sign-In to let you securely access your account and sync across devices.
• The financial data you enter (amounts, categories, notes, budgets, and zakat figures) is end-to-end encrypted with a key derived from a 4-digit PIN that you choose. It is stored in the cloud as unreadable ciphertext.
• Because the encryption key is derived from your PIN and never leaves your device, IdeaMaths cannot read your financial data, and neither can anyone who might access our database.
• We cannot recover your data if you lose both your PIN and your recovery code.
• We show ads via Google AdMob and use standard analytics to keep the app running. These do not have access to your encrypted financial data.

Information We Collect

1. Account information (via Google Sign-In). When you sign in with Google, we receive your email address, display name, and profile photo URL, and a Google account identifier. This is used to authenticate you and associate your data with your account. This basic profile information is not part of the encrypted vault.

2. Financial data you create (encrypted). Expenses, income, categories, recurring payments, budgets, zakat assets/liabilities and calculations, notes, and app settings. This data is encrypted on your device before being written to the cloud and is stored only as ciphertext. We cannot decrypt or read it.

3. Receipt images. If you attach a photo of a receipt or bill, the image is uploaded to secured cloud storage that is restricted to your account by access-control rules. (Receipt images are not yet end-to-end encrypted; encryption of images is planned in a future update.)

4. Device and usage data. Standard technical data such as IP address, device type, app version, and in-app usage/diagnostic information used to operate, secure, and improve the App.

5. Advertising data. Google AdMob may collect a device advertising identifier and related data to serve and measure ads, in accordance with Google's policies.

How Your Data Is Encrypted

• When you set up ExpenseMath, you create a 4-digit PIN. The App generates a random data encryption key that encrypts all of your financial records (AES-256). That key is itself protected ("wrapped") using a key derived from your PIN combined with a secret stored securely on your device.
• Your PIN is never transmitted or stored on our servers. The encryption and decryption happen entirely on your device.
• What is stored in the cloud is only: your encrypted records, and the PIN-protected wrapped key. None of this is readable without your PIN.
• Recovery code: at setup you are shown a one-time recovery code. It provides a second way to unlock your data (for example, on a new phone or if you forget your PIN). Store it safely — it is the only way to recover access if you forget your PIN.
• Important: Because we designed the App so that we never hold your key, if you lose both your PIN and your recovery code, your encrypted data cannot be recovered by anyone, including us.

How We Use Information

• To authenticate you and sync your data across your devices.
• To provide app functionality (tracking, budgets, analytics you see in-app, recurring reminders, zakat calculation).
• To operate, secure, debug, and improve the App.
• To display advertisements through Google AdMob.

We do not sell your personal information.

Data Storage and Cloud Sync

Your data is stored using Google Firebase (Firebase Authentication, Cloud Firestore, and Cloud Storage), which may process and store data on Google's infrastructure. Your financial records are stored there in encrypted form as described above. Data is also cached on your device to allow offline use.

Third-Party Services

ExpenseMath relies on the following third-party services, each governed by its own privacy policy:

• Google Sign-In — authentication
• Google Firebase (Authentication, Cloud Firestore, Cloud Storage) — account and data storage/sync
• Google AdMob — advertising
• Google Play Services

We encourage you to review Google's Privacy Policy: https://policies.google.com/privacy

Camera and Photos Permission

The App may request camera/photo access solely to let you capture or select images of receipts, invoices, or a profile picture. Images are used only for the features you invoke.

Data Sharing

We do not share the contents of your financial vault with third parties — and because it is encrypted with your key, we could not share readable copies even if compelled. Limited technical, account, and advertising data is processed by the service providers listed above to operate the App.

Data Retention and Deletion

We retain your account and data while your account is active. You can:

• Delete all your data from within the App ("Clear All Data" in Settings), which permanently removes your records from the cloud, or
• Request account/data deletion by emailing us (below).

Your Rights

Depending on your region, you may have rights to access, correct, or delete your personal information, or to object to certain processing. Contact us to exercise these rights. Note that we are technically unable to produce a readable copy of your encrypted financial data without your PIN.

Children's Privacy

ExpenseMath is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn we have done so, we will delete it.

Security

We use industry-standard measures to protect your information, including end-to-end encryption of your financial data, encrypted transport (TLS), and account-scoped access controls. No method of transmission or storage is 100% secure, but the design ensures that the most sensitive data is unreadable outside your device.

Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated "Effective Date." Continued use of the App after changes constitutes acceptance.

Contact

For privacy questions or data-deletion requests, contact IdeaMaths at: discuss@ideamaths.com