Private by design

Privacy Policy

This Privacy Policy explains how ePurse ("ePurse", "we", "us" or "our") handles personal data when you use the ePurse mobile application, website and related support services. ePurse is a personal finance record-keeping tool. It is designed to keep your financial ledger on your device unless you choose a feature that sends data to another service, such as sharing a group or making a backup.

ePurse is operated by Praveen Verma, an individual based in Kanpur, Uttar Pradesh, India, who decides how personal data is handled under this policy (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023). Questions, requests and grievances go to [email protected] (section 17).

This policy should be read together with our Terms & Conditions, Security & backup information and deletion guide.

At a glance

1. What ePurse is—and is not

ePurse helps you record and understand transactions, accounts, budgets, goals, reminders, Groups, and Lent & Borrow entries. ePurse is not a bank, lender, payment system, investment adviser or credit bureau. It does not connect directly to your bank account or move money.

2. Data kept on your device

Depending on the features you use, the app may keep the following data locally:

• profile details you enter, including your name and phone numbers;
• accounts, masked account identifiers, transactions, merchants, categories, notes and refunds;
• budgets, goals, reminders, monthly summaries, reward progress and app preferences;
• Groups, split details, and Lent & Borrow records, including names, contact references and phone numbers you choose to attach;
• coarse transaction location labels, such as city, district, region and country, if you grant location permission; and
• technical bookkeeping used to prevent duplicate SMS imports, keep shared groups in step and restore app state.

These records are kept in an encrypted database on your device. Its key is held in your device's secure key storage, and the app opts out of Android's automatic cloud backup. Your personal ledger is not uploaded to an ePurse server. The only financial records that leave your device are a group you choose to share (section 6) and a backup you choose to make (section 5).

3. SMS transaction detection

On supported Android devices, ePurse can read financial SMS messages after you grant SMS permission. It uses message content and sender information on your device to identify possible transactions. You should review detected entries in the Review Queue because bank message formats vary and automated parsing can be wrong.

ePurse saves the details it reads from a message—such as amount, date, merchant, masked account and reference number—and does not keep the original message text or sender. It also remembers which messages it has already handled so they are not imported twice. SMS messages are never sent to an ePurse server or included in backups, and ePurse does not alter or delete messages in your SMS inbox.

Categories, transfers between your own accounts and similar labels are suggested automatically on your device. They have no legal or financial effect, and you can change any of them.

4. Contacts, location and notifications

• Contacts: if allowed, ePurse reads contact names and phone numbers so you can choose people for splits, groups and lending records. Selected contact details may be saved in the local record you create. To recognise people in a shared group, your phone compares a one-way fingerprint of their number with your contacts on the device; your contact list is never uploaded.
• Location: if allowed, ePurse may obtain a low-accuracy foreground location when a transaction is created, reverse-geocode it using the device platform, and keep only a coarse place label. Coordinates, street address and postal code are discarded. Location labels are not shared with group members.
• Notifications and alarms: if allowed, ePurse schedules reminders and financial nudges on your device. If you share a group, ePurse can also receive a push notification when another member changes it (section 6). Notification identifiers are device-specific and are not included in backup.
• Biometrics: App Lock uses the device operating system’s biometric authentication. ePurse does not receive or store your fingerprint or face template.

You can deny or withdraw optional permissions in your device settings. The related feature may then stop working.

5. Google sign-in and optional Drive backup

Google sign-in provides your app session and optional backup access. With your authorization, Google provides your email address, name and profile picture. A refresh credential is stored in secure device storage; short-lived access tokens are kept in memory. Signing in does not upload your ledger.

If you start a backup, ePurse encrypts the supported payload on your device before uploading it to your own Google Drive. The limited Google Drive permission allows the app to access files it created, rather than the rest of your Drive. Backup may include parsed financial records, selected contact details, coarse location labels, reminders, settings, reward progress and the keys of groups you share, so a restored phone can rejoin them. Original SMS text and sender fields are never included.

Backup file metadata—creation time, app and store version, and a coarse label such as “Android device”—is not inside the encrypted payload. ePurse keeps up to five backup files and attempts to remove older copies after a successful upload. Google processes the files, account data and OAuth activity under its own terms and privacy policy.

6. Shared groups

Sharing is optional and entirely your choice. A group stays only on your device unless you invite someone to it or join a group from an invite. Once shared, every member sees the group's people, expenses, settlements and balances, any member can add, edit or delete them, and each change keeps a visible edit history.

• End-to-end encrypted: the group's name, people's names, amounts, shares, payers, titles, categories and dates are encrypted on a member's phone with a key only the group's members hold. Our sharing service stores them but cannot read them.
• What the service can see: a group identifier, the account identifiers of its members, when each change was made and in what order, and when invites were created, expire and are used.
• Your sharing account: the first time you share or join a group, ePurse signs you in to the sharing service with your Google account. The service stores your Google email address and an account identifier. If you never share a group, no sharing account is created.
• Invite links: the group key travels inside the invite link, in a part that browsers do not send to our website. Anyone holding a valid invite link can join, so share it only with the person it is meant for.
• Phone numbers: so members' phones can match people with their own contacts, a one-way fingerprint of a member's phone number—including yours—may be stored inside the encrypted group data. The number itself is not shared.
• What stays on your phone: transaction notes, location labels, which of your accounts paid, and the rest of your ledger are not shared.
• Push notifications: when another member changes a shared group, ePurse can notify your phone with the generic text “Someone updated a group you share.” The push services receive your device's push token and that text, never group details. You can turn this off in Settings → Notifications → Shared Group Activity.

If you leave a group or delete your account, your membership ends. The group's own encrypted record, which its other members also hold, keeps the expenses you were part of so their balances still add up. After you delete your account, that record is no longer linked to any account of yours, and we keep nothing else about you.

7. Data sent to service providers

ePurse currently uses the following limited network services:

• Google: authentication and user-initiated Drive backup and restore;
• Supabase: hosts the shared-group service in India (Mumbai region). It stores the sharing data described in section 6 and receives ordinary request data such as IP address and request time;
• Expo and Google Firebase Cloud Messaging: deliver shared-group push notifications, using a device push token and generic notification text;
• Sentry: crash and error reporting in distributed builds. Reports may contain a stack trace, app version, operating-system and device information, environment, timestamps and technical error context. Reports about group syncing contain event names and counts only—never group names, people or amounts. Default personal-information collection, performance tracing and session replay are disabled; and
• ePurse remote configuration: a public configuration file used for version checks and limited feature availability. The request contains no app-provided account or ledger data, although ordinary web infrastructure may receive an IP address, user agent and request time.

We do not sell personal data or share your financial ledger for third-party advertising. Service providers may process data in India or other countries under their own infrastructure and contractual safeguards. We may also disclose information when required by applicable law, legal process, or to protect users and the service.

8. User-initiated sharing and exports

When you export a statement, create a monthly report, share a group invite or share a repayment reminder, you choose the destination and recipient. A WhatsApp reminder opens WhatsApp with content you selected; WhatsApp then handles that content under its own privacy terms. Once you export or share information, the recipient or destination service controls its further use. Check the contents before sharing.

9. Website data

The ePurse marketing website does not currently use advertising cookies or behavioral analytics. Its hosting and security providers may process ordinary request data such as IP address, browser type, requested page, timestamps and security events to deliver and protect the site. The group invite page reads the invite in your browser and hands it to the app; the invite's key is not sent to the website. If website analytics or optional cookies are added, this policy and any required consent controls will be updated first.

10. Why we process data

We process data only for the feature or purpose presented to you, including to:

• provide the local financial tracking features you request;
• detect and organize transactions with permissions you grant;
• keep groups you share in step between their members and notify you of changes;
• authenticate you and perform a backup or restore you initiate;
• schedule reminders, create exports and enable sharing you request;
• maintain app security, diagnose crashes and deliver essential configuration; and
• respond to support, privacy and security requests.

11. Retention

• Your transactions and other records stay on your device until you delete them. Settings → Clean Up History lets you fold older months into monthly totals, which are kept for up to 10 years.
• Transactions you mark as ignored are removed after 90 days. ePurse remembers up to 2,500 handled SMS identifiers so ignored messages are not imported again.
• In-app notification history is kept for up to 30 days.
• A shared group's encrypted history stays on the sharing service while the group is in use. After 90 days without changes, the service keeps only the group, its members and the latest encrypted summary of who owes whom, and removes older entries; members' phones keep the full history. The group is removed when its last member leaves.
• Your sharing account, memberships and invites remain until you delete your account in the app or ask us to delete it. Push tokens are removed when you turn off shared-group notifications or sign out, and after 60 days without use.
• Google identity and OAuth credentials remain until you sign out, delete app data, revoke access, or the credential otherwise expires.
• Drive backups remain in your Google Drive until removed by backup rotation or deleted by you. Deleting your account does not delete existing Drive files.
• Support messages and diagnostic reports are retained only as needed for support, security and reliability, subject to the applicable provider settings and legal requirements.

12. Your rights

Most of your data is only on your device, so you exercise most rights directly in the app. For data our sharing service holds, or anything else, email us (section 17).

• Know what we hold: your records are visible in the app, and Activity → Export saves them as a file. For your sharing account (email, account identifier and group memberships), ask us.
• Correct it: edit any record in the app, or your details in your profile.
• Erase it: delete records in the app, or use Settings → Delete Account to remove your sharing account and everything on the device. Drive backups are deleted separately in your Google Drive. The deletion guide also covers asking us by email.
• Withdraw consent: see the list below.
• Raise a grievance: section 17.
• Nominate someone: to act for you in the event of death or incapacity, email us with their details.

Turning things off

• SMS, contacts, location, notifications: device settings → Apps → ePurse → Permissions. The related feature stops; your existing records stay.
• Reminders and nudges: Settings → Notifications, one switch for each kind.
• Shared groups: leave a group from its screen (Leave Group). Shared-group alerts: Settings → Notifications → Shared Group Activity.
• Drive backup: stop making backups, remove ePurse's access in your Google Account's third-party connections, and delete the backup files in Drive.
• Google sign-in: Settings → Logout. Sign-in is needed to use the app, so this ends your session.

Crash reports are part of running the app and contain no ledger data, so they have no separate switch.

We acknowledge a request within 7 days and aim to resolve it within 30 days. We may need enough information to verify a request, but never email us financial records, SMS contents, passwords or recovery keys.

13. Security

We use measures designed to reduce unauthorized access, including operating-system app isolation, an encrypted on-device database, optional App Lock, secure storage for keys and long-lived Google credentials, limited OAuth scopes, end-to-end encryption of shared groups and encryption of backup contents before upload. No system is completely secure. You are responsible for protecting your device, Google account, invite links, backup password and recovery key. ePurse cannot recover a forgotten backup secret.

If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires, with what happened, what it means for you and what we are doing about it.

14. Children

ePurse is intended for people aged 18 or older. We do not knowingly offer the service to children or seek personal data from them. If you believe a child has provided data through a channel we control, contact us so we can review and take appropriate action.

15. If ePurse changes hands

If ePurse is transferred to another operator, such as a company formed to run it, your data will be handled under this policy or one at least as protective, and we will tell you before anything about how it is handled changes.

16. Changes to this policy

We may update this policy as the app, vendors or law changes. We will post the revised version with a new date and provide any additional notice required for a material change. Where fresh consent is required, we will request it before the new processing begins.

17. Contact and grievance redressal

For privacy questions, rights requests or grievances, email [email protected] with “Privacy” in the subject. Please describe the request without including transaction records, SMS contents, passwords or recovery keys.

ePurse is operated by Praveen Verma, an individual based in Kanpur, Uttar Pradesh, India, who decides how personal data is handled under this policy. Grievance contact: Praveen Verma, [email protected].

If you are not satisfied with our response, you may complain to the Data Protection Board of India.