ADR-0015: Offline-first, no network

• Status: Accepted
• Date: 2026-08-11
• Deciders: maintainers
• Related: security.md, docs/PLAY_POLICY.md

Context

The app reads sensitive bank notification text. Any network capability creates a data-leak surface and Play-review risk for a notification-listener app.

Decision

AutoBudget is fully offline-first:

• No INTERNET permission in the release app — nothing can transmit data.
• No analytics, no crash-reporting, no third-party SDKs that phone home.
• All state lives in the on-device SQLCipher DB.

Consequences

• The app cannot leak notification data off-device by construction (the permission simply isn't there).
• Simplifies Play Data Safety: "does not collect data", "not shared".
• Backup paths are also disabled (see ADR-0010), closing the last off-device copy path.

Alternatives considered

• Optional cloud sync/backup — rejected: scope, privacy risk, Play sensitive-permission scrutiny. The review queue + export/import cover portability.
• Crash reporting — rejected: would need network and would send notification-derived context.