Security

Short version: your transaction data stays on the device, third-party analytics are off by default, and the app can be locked with a PIN. Here's the honest, unabridged version.

What we protect

• Confidentiality of transaction data. Your amounts, recipients, categories, budgets, and notes live in a private Room database inside the app's sandbox. Other apps on your phone can't read it, and none of it is ever transmitted.
• Analytics are opt-in and anonymous. The app does hold INTERNET for opt-in Firebase Analytics. Off by default. When on, we never send SMS content, transaction amounts, recipient names, category names, or note text. See Privacy § Analytics.
• Casual access. The optional PIN lock plus biometric unlock stops someone who picks up your unlocked phone from browsing your finances.

What we cannot protect against

Permissions we ask for

• READ_SMS / RECEIVE_SMS — to auto-detect M-PESA and NCBA transactions. See the FAQ for what we do and don't read.
• POST_NOTIFICATIONS — for transaction, uncategorised and optional recurring-payment reminders. Recurring reminders are estimated from payment history, checked by WorkManager about once a day, and may arrive late; they do not use exact alarms.
• USE_BIOMETRIC — only if you enable biometric unlock.
• INTERNET / ACCESS_NETWORK_STATE — exclusively for opt-in Firebase Analytics. Off by default; no transaction data or PII is ever transmitted.

What we deliberately don't ask for

• READ_CONTACTS. We resolve recipients from the SMS itself, not from your address book.
• Location. We do not want it.
• Ad SDKs, cross-app IDs, third-party trackers. None.

Individual reminder choices — pending release

An upcoming app update adds Settings → Notifications → Recurring payment reminders → Choose payments. Rent, Electricity, Water Bill, Home WiFi and Gas start on only with at least 70% category support; other detected payments start off. The master switch pauses delivery without deleting choices. Individual selections do not bypass inference confidence, Android permissions or cooldowns. A missing payment is not proof that a bill is unpaid.

Choice identifiers include sensitive recipient/account metadata; masking in the screen is not anonymization. They are stored locally, never sent to analytics or a backend, and included in new user-created backups. Those raw database backups are not encrypted by PesaTrack. Old backups reset individual choices to category defaults; unreadable reminder metadata pauses delivery. Restores wait one cooldown cycle to prevent a catch-up burst. No new permission or data transmission is introduced. See the guide.

Reporting a security issue

Email joelmumo.jm@gmail.com with "SECURITY" in the subject line. Please do not open a public GitHub issue for a vulnerability that could be exploited before a fix ships.