Privacy Policy
is made by Forstra Digital. The short version: we run no server, and we receive none of your data. There is no account to create. Everything the app records lives in a database on your phone. This page explains the few exceptions, all of which you set up yourself. If anything is unclear, email consult@forstradigital.com.
What the app collects, and why
| Data | Where it lives | Why |
|---|---|---|
| Wallets, categories, budgets, transactions | Your phone only. A local database inside the app's private storage. It is never uploaded anywhere, and we have no way to read it. | The core function of the app — tracking your spending |
| Your name, if you set one | Your phone only. | Greeting you on the Home screen. That's all it's used for. |
| Your Google Gemini API key (only if you set up receipt scanning) | Your phone's secure keystore. Never transmitted anywhere except to Google, as the credential for your own scan requests. There is no backup copy and nowhere for one to go. | Authorising receipt scans against your own Google account and quota |
| Receipt photos (only when you tap Scan Receipt) | Sent from your phone directly to Google under your own API key, and not stored by us — we are not in the path at all. Google's handling of that request is governed by your own agreement with Google. | Reading the receipt's line items and suggesting categories |
| GnuCash PostgREST URL & access token (only if you enable GnuCash Sync) | Your phone's secure keystore only. No backup copy exists, so reinstalling the app means entering them again. | Letting your phone talk to the GnuCash server you run. We never see your GnuCash database password, and never connect to your database. |
| Crash reports | Off by default. Only if you switch them on in Settings, an anonymous error report and stack trace go to Sentry. No transactions, receipts, names, or API keys are ever included. Builds compiled from source send nothing at all. | Diagnosing crashes. With no server, a stack trace is the only way we can see what went wrong. |
| Anonymous pageviews and clicks on this website | PostHog, an EU-hosted analytics service. Nothing is tied to any identity — this site never calls identify(), and session recording is off. | Understanding which pages and links are actually useful |
That table is exhaustive. There are no advertising identifiers, no product analytics inside the app, no account, and no telemetry of any other kind.
Who else sees this data
- Google — receives a receipt image at the moment you scan one, under your own API key. Nothing else, and only when you scan.
- Sentry — receives a crash report only if you have switched crash reporting on. Off by default.
- PostHog — anonymous pageviews and clicks on this website only. Nothing from inside the app.
- Forstra Digital — receives nothing. We run no server for this app.
- We do not sell your data to anyone, for any reason. There is nothing to sell.
If you used version 1.x
Earlier versions did work differently: they required an account, stored your data in a Forstra-hosted database, showed ads, and sent receipt photos through our own backend using our API key. Version 2.0.0 removed all of that. Data from a 1.x account does not carry over — export it from the older version before upgrading if you want to keep it. To have data from a 1.x account deleted from our records, email consult@forstradigital.com.
Your GnuCash ledger specifically
If you turn on GnuCash Sync, connects to a PostgREST service that you run, in front of a GnuCash database that you control. We never connect to your database directly, never see your real database password, and the narrow role your phone uses can only insert new expense transactions through one specific function — it cannot read balances, read transaction history, or change anything else in your ledger. Full technical detail is in the setup guide.
How long things are kept, and how to delete them
Your data stays on your phone until you delete it. Settings → Erase All Data removes everything the app stores, and uninstalling the app does the same. Neither requires asking us, because we hold nothing to release. Note there is no backup and no undo — export to CSV first if you might want the data later.
Anything you already synced to GnuCash stays in your own GnuCash ledger, which the app never deletes from.
Changes to this policy
We'll update the "last updated" date above whenever this page changes. Because the app is open source, you can also see exactly what changed and when in the public repository.
Contact
Questions, deletion requests, or anything else: consult@forstradigital.com. You can also use the feedback form for general comments.