Skip to content

Security & Privacy

App lock settings

Your data stays on your phone

  • No internet. AutoBudget has no network permission — it cannot upload, transmit, or sync anything. No ads, no analytics, no trackers.
  • Encrypted at rest. Transactions live in a SQLCipher-encrypted database. The encryption key is held in your device's hardware-backed Android Keystore and never leaves the device.
  • Masked before storage. Account/card numbers in notification text are masked to their last 4 digits (****7890) before anything is stored.
  • No backups. Cloud backup and device-to-device transfer of app data are disabled, so your history can't leak through a backup channel.

What AutoBudget reads

Only notifications from apps you explicitly enable (Settings → General → Tracked apps, or onboarding). It reads the notification text: amount, merchant, account reference, status. It never reads SMS, contacts, or other apps' data.

  • Location (optional) — if you opt in (onboarding or Settings → Automation → Record transaction locations), AutoBudget stores a device fix (a live one-shot request, or the last known fix when unavailable) with the transaction. It is stored encrypted on this device only, is never transmitted, and is only read when a payment notification is parsed. Capturing while the app is closed requires Android's "Allow all the time" location setting, requested only after you opt in.
  • Attachments — files you attach to a transaction stay on this device: images, PDFs, text/CSV/Excel/Word documents up to 10 MB each. They are never uploaded and are excluded from backups.

App lock

Settings → Security:

  • App lock — require a PIN to open the app. Turning it on starts PIN setup; afterwards use Change PIN, and pick a length of 4, 6, or 8 digits via the PIN length row.
  • Biometric unlock — optional fingerprint/face when available. Strength: Standard (faster, less strict) or Strong only (hardware-backed). Device credential fallback additionally allows your device PIN/pattern as a backup. When the lock screen appears, the biometric prompt opens automatically.
  • Auto-lock — 1 / 5 / 15 / 30 minutes (5 minutes by default), or Never (locks only when the app leaves the foreground). With a timeout set, the app relocks after that many minutes of inactivity while it stays in the foreground — any navigation restarts the countdown.

How the PIN is protected

  • Stored as a salted SHA-256 hash (salt regenerates on every change — identical PINs never share a digest).
  • 5 wrong attempts → 30-second lockout with a visible countdown — the lock screen also shows how many attempts remain.
  • The app relocks automatically when it leaves the foreground.
  • The lock screen overlays the entire UI — nothing is visible underneath.

Deleting your data

  • Settings → Data → Delete all data — wipes transactions + review queue.
  • Uninstalling removes everything.
  • Because the database is encrypted with a non-recoverable key, clearing app data or uninstalling permanently destroys history — it cannot be restored. Export (Settings → Data → Export) first if you want a copy.

Play Store policy notes

See docs/PLAY_POLICY.md for the Play Console workbook (Data Safety form, permission declarations). The public, user-facing Privacy Policy is hosted at https://autobudget.zharif.my/privacy/ and linked from the app's Settings → About.