Privacy Policy

Does the app collect personal data?

No.

Does the app transmit your data anywhere?

No. It has no internet permission.

Analytics, crash reporting or advertising?

None, in the app or on our websites.

Do we share or sell data?

No.

Is there an account in the app?

No.

Where is your app data stored?

Only in the app's private storage on your device.

How do you delete it?

Uninstall the app, or clear its data in Android Settings.

What do the websites store?

An email address if you join the waitlist, and what you write if you file a support ticket.

All of the following is created and kept only on your device, in storage that Android makes private to the app:

• Transactions you add manually, or that the app records from bank messages: amount, date, category, account, merchant name and any note.
• Accounts, categories, budgets, savings goals, recurring rules and personal lending records (“udhaar”) that you create.
• Bank message text for messages the app identifies as financial. This is stored so that a low-confidence result can be shown to you for review, and for a few minutes after a message is recorded so that the same message is not recorded twice.
• Your corrections. When you confirm or dismiss an item in the review queue, the app remembers the shape of that message so it classifies similar ones better. This is stored as counts against a normalised message pattern, on your device.
• App preferences, such as your light or dark theme choice.

None of this is sent to us or to anyone else. There is no server component to the app.

The released app does not request the Android INTERNET permission. Without it, the operating system prevents the app from making any network connection at all. Anyone can verify this by inspecting the manifest of the published app.

There are no analytics SDKs, no crash-reporting SDKs, no advertising libraries and no third-party trackers in the app.

The only things that leave the app are two links. Tapping “report a problem” asks Android to open the support portal in your browser, and the link carries the app's version and your Android version so a report arrives with them filled in. It carries no device identifier and nothing from your ledger. Tapping “Read the full privacy policy” opens this page, and that link carries nothing at all. In both cases the request is made by your browser, not by the app.

SMS access (READ_SMS): optional, and the only way capture works

This is the app's one way of logging a transaction automatically: reading your bank's SMS alerts, on the device, to work out the amount, direction, merchant and account. There is no other capture channel.

Android does not allow an app to read only some SMS, so this permission technically exposes every message on your device to the app. Because of that, the app filters in native code, before anything reaches the rest of the application:

• A message must come from a sender ID shaped like a bank short code and contain a monetary amount, or it is discarded on the spot.
• Anything that fails that check is never stored and never written to disk.
• The app only reads messages. It never sends, edits or deletes SMS.
• The contents of your inbox are never transmitted anywhere.

Personal messages and anything else unrelated to money are discarded immediately and never retained.

One-time passcodes are handled more strictly than that. An OTP can pass the filter above, because a message like “Your OTP is 123456 for a payment of Rs.5,000” really does come from a bank sender and really does contain an amount. So the code is erased from the text at the moment the message enters the app, before the parser, before the on-device classifier, and before anything is written to disk. The app then discards OTP messages entirely, since they describe money that has not moved. Nothing in Skimp can read you an OTP, because nothing in Skimp is ever given one.

Once a message is used, its text is deleted from the database. For a message in the review queue that is the moment you confirm or dismiss it. For one recorded automatically it is the app's next check of your messages, once the few minutes in which it could still be a duplicate have passed. Only the transaction remains.

You can decline this permission and use the app normally. Every other feature works with manual entry.

Notifications (POST_NOTIFICATIONS) and vibration (VIBRATE)

Used to show you budget alerts on your own device, and how far an import of your messages has got.

Finishing an import in the background (FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC)

Reading a long inbox for the first time can take a while. If you leave the app while it is doing that, these let it finish, behind a notification that shows its progress and goes away when it is done.

That is all they are used for. The app never starts reading on its own: not when a message arrives, not when the phone starts, and not on a timer. It reads when you open it or press Sync, and the only thing that happens in the background is the end of a read you were there to begin. What is read, and what is kept, is exactly as described above.

• Encrypted backups. You can export a backup file, encrypted with AES-256-GCM using a passphrase that only you choose. We do not have that passphrase and cannot recover it. If you lose it, the backup cannot be opened by anyone, including us.
• CSV and PDF reports. You can export your transactions as a spreadsheet or a report.

Both are handed to Android's share sheet so you choose where they go: a file manager, a cloud drive, an email, a messaging app. Once a file leaves the app, it is governed by whatever service you sent it to, not by this policy. Please treat exported files as sensitive.

If you join the waitlist, we store your email address, when you joined, when you verified the address, and a short label for where the signup came from (today that is always “web”). We send you a six-digit code to confirm the address, and a message when there is a build worth installing. The address is not sold, shared, or added to any other list.

If we invite you to closed testing and you open the invite link, we record that your address accepted: the address, when it first and most recently did, and how many times. That is how we know who has joined a test, and it is kept without your IP address or any detail of your device.

To stop signups being abused, requests are rate-limited. That check needs to recognise a repeat sender, so your IP address and email are salted and hashed before anything is written down. The stored value can identify a repeat and cannot be turned back into you. Those records are deleted once they are 24 hours old: a cleanup runs each time the form is used and again once a day, so none outlives that by more than a day.

There are no advertising trackers and no third-party analytics. The site sets no cookies; your theme choice is kept in your own browser's local storage.

The support portal at support.skimp.rabugotra.com is a separate website and is entirely optional. If you use it, we store:

• Your email address, proven either by an emailed one-time code or by Google sign-in.
• Your Google name and profile picture, only if you choose Google sign-in, so the portal can show who is signed in. They are kept inside your sign-in cookie and nowhere else: they are not written to our database and they are not attached to your tickets.
• What you write: your tickets, your replies, and any screenshots you attach.
• What you pick in the ticket form: the kind of problem or request, the screens of the app it concerns, your phone's brand and model, and your Android version. The phone and Android version are optional for a feature request.
• The app version and Android version that arrive with the link from the app. You can change either before sending.
• A sign-in cookie, which keeps you signed in for up to 30 days. If you use Google sign-in, a second cookie exists for up to ten minutes while you are at Google, so the portal can tell that the sign-in coming back is the one it started. The portal sets no other cookies; your theme choice is kept in your own browser's local storage.

Only you and the developers can see your tickets. So that the work can be tracked, a ticket, its screenshots and its replies are copied into a private issue tracker (the portal checks that it is private before every copy, and sends nothing if it is not), and when a ticket is filed its text, the answers picked in the form and any attached screenshots are sent to an AI model to draft a summary for the developers. If that step fails it may be run again. Please do not put bank details, account numbers or anything else you would not want stored in a ticket or a screenshot.

The same salted, hashed rate-limiting described above applies here.

The app uses open-source libraries that run entirely on your device (for the database, charts, PDF generation, encryption and file sharing). None of them collect or transmit your data.

The websites rely on a small number of providers, each handling only what its job needs:

• Vercel hosts both websites, and like any web host sees the requests your browser makes, including your IP address.
• Supabase hosts the database holding waitlist addresses and support tickets.
• Resend delivers our email, so it handles your address and the message we send.
• Cloudinary stores screenshots attached to support tickets.
• Google, only if you choose Google sign-in on the support portal. Your profile picture is then loaded from Google by your browser.
• GitHub holds the private issue tracker that support tickets are copied into.
• An AI model provider processes the text and screenshots of a support ticket when it is filed.

We do not sell personal data, and we do not share it for advertising.

READ_SMS is one of Android's restricted permissions, which means Google reviews any app that asks for it. Skimp is not your phone's SMS app and does not want to be. It qualifies under the exception Google publishes for SMS-based money management, in Google's words “apps that track and manage budget”.

The commitments in this policy (no network access, message text deleted once it has been used, one-time passcodes erased on arrival) are the same ones the app is reviewed against.

• Your app data lives in app-private storage, which Android isolates from other apps on a non-rooted device.
• Backups are encrypted with a key derived from your passphrase.
• The app cannot transmit data, because it has no network permission.
• The websites are served over HTTPS only.

No system is perfectly secure. In particular, a rooted or compromised device, or a device someone else can unlock, can expose data that Android would otherwise protect.

Skimp is not directed at children. The app collects no personal information from any user, of any age, and we do not knowingly collect any from children through the websites.

In the app, everything is local, so you are always in control:

• Export your data at any time as an encrypted backup, CSV or PDF.
• Delete individual records inside the app.
• Erase everything by clearing the app's data in Android Settings, or by uninstalling. Uninstalling permanently deletes the app's database from your device.
• Forget what the app learned from your review decisions, from the “What capture has learned” screen.

We cannot delete your app data on your behalf, because we never have it. For the waitlist and the support portal, ask and we will delete your email address and your tickets, without asking why.

If this policy changes, the updated version will be published at this address and the “Last updated” date will change. If a future version of the app ever introduces an optional feature that uses the network, this policy will be updated before that feature ships, and the feature will be opt-in.

Questions about this policy, or a request to delete your data: open a ticket at support.skimp.rabugotra.com.