Privacy Policy for OnlyBudget

Last Updated: September 13, 2026

Information I Collect

Personal Information

Authentication and Account Information (Required only for Google Drive Backup):

• Google Sign-In is required only if you want to use the Google Drive backup feature.
• The app works completely offline without any account for local usage.
• If you choose to sign in, authentication data is used solely for secure backup access and session validation.
• Authentication data is stored securely on your device and minimally in Cloud Firestore for session management.
• I do not have direct access to your Google account credentials.
• You can revoke access at any time through your Google Account settings.

Data stored in Cloud Firestore (for session management only):

• User ID (UID)
• Google Drive refresh token (encrypted)

Data stored locally on your device:

• User ID (UID)
• Email address
• Google Drive access token (encrypted)
• Google Drive refresh token (encrypted)

Financial Data

• All your financial data is stored locally on your device and never sent to any server.
• I do not have access to your financial data unless you explicitly choose to back it up to your Google Drive.

Analytics Data

The app uses Firebase Analytics to help me understand how the app is used and to improve it. This data does not include your financial values, transaction descriptions, or any other personally identifiable financial information. Analytics events may include:

• App usage information, such as which screens you visit.
• Non-financial metadata about your actions, such as the type of transaction created (income/expense), whether it is recurring, the recurrence interval, and whether an account was changed.
• Aggregate counts, such as the number of accounts or transactions you have, sent as numeric totals only.
• Settings changes, such as your selected theme, start of week, or auto-backup preference.
• Onboarding, backup, restore, and data export completion events (e.g. which export format was used), without the exported data itself.

This data is processed by Google in accordance with the Firebase Privacy and Security Policy.

Google Drive Backup (Optional)

If you choose to enable Google Drive cloud backup:

• Your financial data is backed up to your personal Google Drive account.
• Backups are stored in the hidden AppData folder of your Google Drive, which is accessible only to the app and cannot be viewed or modified manually.
• I do not have access to your Google Drive or the backed-up data.
• The backup is stored in your own Google Drive storage space.
• Google Drive access tokens are encrypted and stored securely on your device.
• You can revoke access to Google Drive at any time through your Google Account settings.

How I Use Your Information

Authentication Data

• Your email address is used solely for authentication purposes.
• Your User ID (UID) and Google Drive refresh token are stored in Cloud Firestore to maintain your Google Drive session.
• Google Drive access and refresh tokens are encrypted and stored securely using Android’s DataStore.

Financial Data

• Your financial data is stored only on your device and is never sent to any external server.
• If you enable Google Drive backup, your data is backed up only to your personal Google Drive.
• I have no access to your financial information.

Analytics Data

• Analytics data is used to understand overall app usage patterns and to identify bugs or areas for improvement.
• Analytics data is not linked to your financial data and cannot be used to reconstruct your transactions or balances.

Data Storage and Security

Local Storage

• All your financial data is stored locally on your device using Android's secure Room database within the app's private storage area, inaccessible to other apps.
• Google Drive access and refresh tokens are encrypted and stored securely using Android’s DataStore.
• Data on your device is further protected by your device’s security features (such as screen lock and encryption).

Cloud Firestore

• Only your User ID (UID) and Google Drive refresh token are stored in Cloud Firestore for authentication purposes.
• Before being stored, your Google Drive refresh token is encrypted on your device using a key derived from your account (PBKDF2), so the token is encrypted before it ever reaches Firestore.
• Data in Firestore is additionally encrypted both in transit (HTTPS/TLS) and at rest by Google.
• Cloud Firestore is managed by Google Cloud and protected by Google's enterprise-grade security infrastructure.

Google Drive Backup

• When you enable cloud backup, your financial data is securely transmitted over an encrypted connection (HTTPS/TLS) and uploaded only to your personal Google Drive account.
• Google Drive access and refresh tokens are encrypted and stored securely on your device.
• Your backup data remains under your full control within your Google Drive account, protected by Google’s security infrastructure.

Security Measures

I implement industry-standard security practices to protect your data:

• Secure local storage using Room database within app’s private storage.
• Encrypted storage of Google Drive authentication tokens using DataStore.
• Encrypted transmission of data to Google Drive (HTTPS/TLS).
• No financial data is transmitted to any third-party or external servers.

Third-Party Services

Google Sign-In API

• The app uses Google Sign-In for authentication.
• Your Google account information is handled in accordance with Google's Privacy Policy.
• Only the minimum necessary permissions (email and basic profile) are requested to enable sign-in.

Cloud Firestore

• The app uses Cloud Firestore (a Google Cloud service) to store authentication tokens for login session management.
• Cloud Firestore stores only your User ID (UID) and Google Drive refresh token.
• Data is encrypted in transit (HTTPS/TLS) and at rest.
• Cloud Firestore is governed by Google Cloud’s Privacy Policy and Terms of Service.

Firebase Analytics

• The app uses Firebase Analytics (a Google service) to collect anonymized, non-financial usage data such as screen views, feature usage, and settings changes.
• No financial data, transaction amounts, descriptions, or account balances are ever sent to Firebase Analytics.
• Firebase Analytics data is governed by Google's Firebase Privacy and Security Policy.
• This data helps me understand how the app is used so I can fix issues and improve features.

Google Drive API

• The app uses Google Drive API for optional cloud backup functionality.
• Google’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Only the minimum necessary permissions are requested to back up and restore your data.
• Your Google account information is handled in accordance with Google's Privacy Policy.

Third-Party Links

• The app may include links to third-party websites or services for additional functionality or resources.
• These third-party sites have their own privacy policies, which are not controlled by me.
• I encourage you to review the privacy policies of any third-party sites or services before providing any information.

Your Rights and Choices

Data Access and Control

• Local Data: You have complete control over your data stored on your device. You can view, edit, or delete any transaction at any time.
• Google Drive Backup: You can enable or disable cloud backup at any time in the app settings.
• Data Deletion: You can delete all your locally stored financial data using the "Reset All Data" option in the app settings.
• Google Drive Access: You can revoke the app's access to your Google Drive at any time through your Google Account permissions.
• Cloud Firestore Data: When you sign out from the app, your authentication session remains stored in Cloud Firestore until the refresh token expires or is revoked by Google.

Data Portability

• All your financial data is stored in a standard SQLite database format on your device.
• If you enable Google Drive backup, your backup file is also available in your Google Drive account.
• You can export your transactions as an Excel, CSV, or PDF file for a selected account and date range at any time from the app's Settings. The exported file is generated on your device and is only shared with the destination you choose (e.g. saving it or sharing it through another app).

Data Retention

• Local Data: Your data remains on your device until you delete it or uninstall the app.
• Google Drive Backup: Your backup remains in your Google Drive until you delete it manually.
• Cloud Firestore: Your UID and Google Drive refresh token remain stored in Cloud Firestore until the refresh token expires or you revoke access.
• Analytics Data: Firebase Analytics data is retained according to Google's default Firebase Analytics retention settings, as described in the Firebase Privacy and Security Policy.
• Uninstalling the App: When you uninstall the app, all local data is automatically deleted from your device. Google Drive backups remain until you manually delete them from your Google Drive. Cloud Firestore data (UID and Google Drive refresh token) remains stored indefinitely but becomes unusable when revoked or expired.

Children's Privacy

The app is not intended for use by children under the age of 13. I do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information, please contact me immediately.

International Data Transfers

Since all your financial data is stored locally on your device or in your personal Google Drive account, there are no international transfers of your financial data by me. However:

• Cloud Firestore may store authentication data in various Google Cloud data center locations.
• Google Drive may store data in different regions according to Google’s infrastructure.

Changes to This Privacy Policy

I may update this Privacy Policy periodically to reflect:

• Changes in data practices
• New features or functionality
• Changes in legal requirements
• User feedback and concerns

I will notify you of any material changes by:

• Posting the updated policy on the Play Store
• Updating the "Last Updated" date at the top of this policy
• Providing an in-app notification for significant updates (when applicable)

Your continued use of the app after any changes constitutes your acceptance of the updated Privacy Policy.

Compliance

This Privacy Policy complies with:

• Google Play Developer Program Policies
• Google API Services User Data Policy
• General Data Protection Regulation (GDPR) principles
• California Consumer Privacy Act (CCPA) principles
• Other applicable privacy laws and regulations

Consent

By using OnlyBudget, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. If you do not agree, please do not use the app.

Note: This Privacy Policy applies only to the OnlyBudget mobile application and does not apply to any third-party applications, websites, or services that may be linked from the app.