Security

Short version: your transaction data stays on the device, third-party analytics are off by default, and the app can be locked with a PIN. Here's the honest, unabridged version.

What we protect

• Confidentiality of transaction data. Your amounts, recipients, categories, budgets, and notes live in a private Room database inside the app's sandbox. Other apps on your phone can't read it, and none of it is ever transmitted.
• Analytics are opt-in and anonymous. The app does hold INTERNET for opt-in Firebase Analytics. Off by default. When on, we never send SMS content, transaction amounts, recipient names, category names, or note text. See Privacy § Analytics.
• Casual access. The optional PIN lock plus biometric unlock stops someone who picks up your unlocked phone from browsing your finances.

What we cannot protect against

Permissions we ask for

• READ_SMS / RECEIVE_SMS — to auto-detect M-PESA and NCBA transactions. See the FAQ for what we do and don't read.
• POST_NOTIFICATIONS — for the "new transaction" and "uncategorised" notifications. Optional.
• USE_BIOMETRIC — only if you enable biometric unlock.
• SCHEDULE_EXACT_ALARM — for recurring reminders you set.
• INTERNET / ACCESS_NETWORK_STATE — exclusively for opt-in Firebase Analytics. Off by default; no transaction data or PII is ever transmitted.

What we deliberately don't ask for

• READ_CONTACTS. We resolve recipients from the SMS itself, not from your address book.
• Location. We do not want it.
• Ad SDKs, cross-app IDs, third-party trackers. None.

Reporting a security issue

Email joelmumo.jm@gmail.com with "SECURITY" in the subject line. Please do not open a public GitHub issue for a vulnerability that could be exploited before a fix ships.