Privacy Policy

1. Records stored on your device

The app stores income, expenses, categories, dates, notes, receivable/payable debts, names, payment histories and preferences on your device. You do not need an account to use the local ledger. These records are not automatically uploaded to our server. Online backup is not automatic synchronization.

App Lock is an optional screen-access protection feature; it does not mean that the app separately encrypts all ledger files. Face ID and fingerprint checks are handled by the operating system. The app does not receive biometric images or templates. Debt reminders are optional local notifications that require your permission.

2. Accounts and online backup

When you create an account, your email address and password are sent to the NgweSayin API over HTTPS. The server stores a salted scrypt password hash, not your original password. Login session tokens are stored in your device's secure storage. Email verification and password-reset codes expire after ten minutes and have attempt limits.

Only when you choose to upload an online backup are your ledger records and preferences stored on the server under your account. Backup payloads are encrypted at rest. The server operator controls the encryption key, so an authorized administrator can decrypt them. This is not end-to-end encryption. Access to accounts and backups is restricted by account ownership.

3. Purposes and service providers

We use information to provide the ledger, optional backup and restore, account management, email verification, password recovery, support, security and abuse prevention. We do not sell your financial records for advertising targeting.

Online backups are stored in the isolated NgweSayin Ubuntu service managed by 630 LTD. Hostinger hosts the website, and Titan provides verification/reset email delivery. Providers may receive information needed to perform their services, such as a destination email address or a network request.

The app includes the Google Mobile Ads SDK. Ad placements in the current Release are disabled, and measurement initialization is delayed. Depending on SDK usage, Google may collect or share IP addresses, device identifiers, interaction data and diagnostic information. Before enabling live ads in a release, we will configure the applicable consent/privacy options and disclosures. See the Google Privacy Policy. We have not added analytics or tracking scripts to these website pages.

4. How long information is retained

• Local records: remain in local storage until you remove them. Check that you have a backup before uninstalling the app.

• Regular online backups: the latest ten backups are retained per account. Uploading more removes the oldest entries from the active backup list. These active backups do not automatically expire after 30 days while your account remains active.

• Server recovery copies: separate disaster-recovery copies are made daily and retained for 30 days. Expired copies are removed by an hourly cleanup job, so a copy may remain for approximately one additional hour after reaching the retention limit. These copies are restricted to administrator recovery use and are not publicly accessible.

• Deletion markers: to prevent a deleted account from reappearing during recovery, a separate marker contains only a random account ID and deletion time—not an email, password or ledger. Markers are cleaned up when their 30-day recovery window has expired.

• Technical and security records: API/network requests may generate operational data such as IP addresses and errors for service security. API nginx access logs are normally rotated daily and kept for approximately 14 days. Support emails you send us and messages in your own mailbox are not automatically deleted when you delete an app account. You may contact us to request deletion of support correspondence.

5. Account and data deletion

Confirming account deletion in the app under Settings → Online backup / Account deletes your account, sessions, verification codes and associated online backups from the active database. Older recovery copies may remain until the 30-day retention and cleanup period described above has elapsed. Recovery procedures reapply the current deletion markers and revoke restored sessions and email codes. The automated recovery tool refuses recovery if the current deletion ledger is unavailable.

Resetting local records and deleting an online account are separate actions. We cannot automatically remove JSON/CSV files you exported or shared, or copies held by their recipients. If you no longer have the app, use our account deletion instructions to submit a request. We may need to verify account ownership, but do not send your password or one-time codes to support.

6. Exports, security and your choices

Exported JSON/CSV files may contain your complete financial records and personal information. The app does not password-encrypt these export files; you choose where to store or share them. You may use the local ledger without an account and choose whether to use online backup, notification permissions and App Lock. We use HTTPS and server access controls, but no system can be guaranteed completely risk-free.

7. Children, changes and contact

This service is not intended for children under 13. Contact us if you are concerned about a child's information. If the service or our data practices change, we will update this policy and its effective date and provide appropriate notice of material changes. To ask about access, correction, export or deletion of your information, contact ngwesayin@630.email.