Skip to content

Security & Privacy

App lock settings under Privacy & lock

Your data stays on your phone

  • No internet use. AutoBudget never uploads, transmits, or syncs anything: no ads, no analytics, no trackers. The bundled offline map renderer declares network permissions, but no app code uses them.
  • Encrypted at rest. Transactions live in a SQLCipher-encrypted database. The encryption key is held in your device's hardware-backed Android Keystore and never leaves the device.
  • Masked before storage. Account/card numbers in notification text are masked to their last 4 digits (****7890) before anything is stored.
  • No backups. Cloud backup and device-to-device transfer of app data are disabled, so your history can't leak through a backup channel.

What AutoBudget reads

Only notifications from apps you explicitly enable (Settings → Banks & capture → Tracked apps, or onboarding). It reads the notification text: amount, merchant, account reference, status. It never reads SMS, contacts, or other apps' data.

  • Location (optional) — if you opt in (onboarding or Settings → Banks & capture → Record transaction locations), AutoBudget stores a device fix (a live one-shot request, or the last known fix when unavailable) with the transaction. It is stored encrypted on this device only, is never transmitted, and is only read when a payment notification is parsed. Capturing while the app is closed requires Android's "Allow all the time" location setting, requested only after you opt in.
  • Attachments — files you attach to a transaction stay on this device: images, PDFs, text/CSV/Excel/Word documents up to 10 MB each. They are never uploaded and are excluded from backups. Open is read-only: images use the in-app viewer, and other supported files go to a viewer app with temporary read access to that one file only (no write access and no copy retained by AutoBudget). Delete stays a separate action.

App lock

Settings → Privacy & lock:

  • App lock — require a PIN to open the app. Turning it on starts PIN setup; afterwards use Change PIN, and pick a length of 6 or 8 digits via the PIN length row (an older 4-digit PIN keeps working until you change it). The row is a single on/off control (a screen reader announces "App lock" with its on or off state); cancelling PIN setup or the "Disable app lock?" confirmation leaves it unchanged.
  • Biometric unlock — optional fingerprint/face when available. Strength: Standard (faster, less strict) or Strong only (hardware-backed). Device credential fallback additionally allows your device PIN/pattern as a backup. Each of these is one switch row (tap the title or the switch); when biometrics are unavailable the biometric row is announced as disabled. When the lock screen appears, the biometric prompt opens automatically.
  • Auto-lock — 1 / 5 / 15 / 30 minutes (5 minutes by default), or Never (locks only when the app leaves the foreground). With a timeout set, the app relocks after that many minutes of inactivity while it stays in the foreground — any navigation restarts the countdown.
  • Screenshot protection — off by default. When you turn it on, AutoBudget blocks screenshots, screen recordings and casting of its own screen on most devices, and the Recents preview shows nothing; the setting survives a restart. It cannot stop a photo of the screen taken with another device. Turning it off restores normal screenshots immediately.

How the PIN is protected

  • Stored as a salted, iterated PBKDF2-HMAC-SHA256 hash (salt regenerates on every change — identical PINs never share a digest).
  • PIN entry is masked: the dots are the only visible value and the field provides password semantics to screen readers. The field also provides digit-count progress (for example, “3 of 6 entered”); whether spoken input is announced follows your accessibility/password settings. Its text cannot be copied or cut. Hardware keyboards and the on-screen keypad both work.
  • 5 wrong attempts → 30-second lockout with a visible countdown — the lock screen also shows how many attempts remain, counting down 4, 3, 2, 1 for the first four failures. A wrong PIN clears the dots and states the remaining attempts in text (the error styling never carries the failure on its own); during the lockout, PIN entry and Unlock are replaced by the countdown panel, which is also announced as text.
  • The app relocks automatically when it leaves the foreground.
  • The lock screen is a full warm-paper surface with a tonal brand mark, the title in the display face, PIN dots, a 3×4 keypad and at least 48 dp Unlock / biometric actions. A wrong PIN shakes the dots and states the remaining attempts in text; the error styling never carries the failure on its own.
  • The lock screen overlays the entire UI — nothing is visible underneath.

Deleting your data

  • Settings → Backup & data → Delete all data — wipes transactions + review queue.
  • Uninstalling removes everything.
  • Because the database is encrypted with a non-recoverable key, clearing app data or uninstalling permanently destroys history — it cannot be restored. Export (Settings → Backup & data → Export) first if you want a copy.

Play Store policy notes

See docs/PLAY_POLICY.md for the Play Console workbook (Data Safety form, permission declarations). The public, user-facing Privacy Policy is hosted at https://autobudget.zharif.my/privacy/ and linked from the app's Settings → About.