What data TidyWallet stores and sends.

The short version

• Your ledger — accounts, transactions, budgets, categories and holdings — is stored on your device.
• There is no account to create and no credentials of any kind are collected.
• TidyWallet never asks for your bank login and uses no aggregator service.
• By default the app's own network requests are for public exchange rates and asset prices, plus a check of one small file on this website that says whether any of those price services has been paused. Your balances, transactions and account names are not part of them — only the symbols of the currencies and assets you track, and, to fill in a price chart, the dates it covers.
• The Google Play Billing library inside the app also sends Google diagnostics about its own operation, on every launch. It is given nothing from your ledger. Details are under Installing through Google Play.
• Scanning a receipt is read on your phone, and the photo is never sent. Google's ML Kit, which does the reading, sends Google diagnostics about its own operation when you scan. Details are under Scanning a receipt.
• Backup is the exception, and it is off unless you turn it on: on the paid plan it places a sealed copy of your ledger in your own Google Drive, once when you ask, or daily and unattended if you switch that on. Restoring a copy from your Drive is the other time the app contacts Drive, and only when you ask it to.
• Backups and exports are otherwise files you control, saved where you choose.
• The app adds no analytics, crash-reporting or advertising code of its own. The Play Billing diagnostics above, and ML Kit's when you scan a receipt, are the only reporting it contains, and they are Google's.

What TidyWallet stores, and where

Everything you enter stays in the app's own storage on your device: accounts and balances, transactions, transfers, categories, budgets, recurring rules, templates, and any crypto or metal holdings with their cost basis.

It is kept in storage private to the app, which Android does not let other apps read. It is not separately encrypted on the device: anyone who can unlock your phone and open the app can read it. The app lock, if you turn it on, keeps your figures off the screen and out of the app switcher until you unlock it; it does not encrypt the stored data.

This data is not transmitted to the developer and there is no server of ours for it to go to. It is also excluded from Android's own automatic cloud backup and from device-to-device transfer, so it does not leave by that route either. If you uninstall the app, that data is removed with it — which is why an export or backup is worth keeping before you do.

What leaves your phone

To convert between currencies and to value holdings, the app requests public market data from third-party providers:

• Frankfurter — foreign exchange rates.
• CoinGecko — cryptocurrency prices.
• gold-api.com — metal prices. If you have supplied a metals.dev key, that is used instead.

None of these needs an account or an API key; the app works with all three out of the box. You may add a CoinGecko or metals.dev key of your own, which buys a private rate limit instead of one shared by address — it is an option, not a requirement.

These requests ask for public reference data, such as a currency pair or an asset symbol. They do not carry your transactions, balances, account names or any identifier belonging to you.

To draw an asset's price chart, the app also asks for that asset's past prices, once, over a range of dates. The range starts on the day you added the asset to the app (at most a year back) and ends today, so the provider receiving it — CoinGecko, or metals.dev if you have supplied its key — could tell roughly when you started tracking that asset. It still carries no quantity, amount or identifier.

The symbols asked for are the ones you track, though, so a provider could tell which currencies and assets are being followed from a given network address — never how much of any of them. When you search for an asset to add, the text you type is sent to CoinGecko to find matches.

As with any internet request, the provider receiving it can see the network address it came from and the time it was made. That is a property of making the request at all, not something the app attaches. If the app cannot reach a provider, it continues to work and reports the affected figure as unvalued rather than guessing.

So that a provider that stops working can be switched off without waiting for an app update, the app also reads one small file from this website, tidywalletapp.com/app/sources.json, which lists any of the services above that have been paused. It does this only just before it would look up a price anyway, and at most twice a day, so if you track no assets or foreign currencies it never does. The request carries nothing about you: no symbols, no key, no identifier. The site's host can see the network address it comes from, as described below. The file can only pause a service; it cannot send your requests anywhere else.

Scanning a receipt

When you add a transaction, you can scan a receipt instead of typing it. The camera screen is Google's document scanner, part of Google Play services on your phone; you can also pick a photo from your gallery there. The receipt is then read on your phone by Google's ML Kit, and the app fills in the total, the date, the shop's name and, if you have filed that shop before, its category. Nothing is saved until you save it.

The photo never leaves your phone, and the app does not keep it: its copy is deleted as soon as the receipt has been read. A photo you picked from your gallery is left where it is, untouched.

ML Kit's diagnostics. ML Kit reports on its own operation to Google at firebaselogging.googleapis.com, the same address the Play Billing library reports to, when a scan runs. Google lists what it sends as information about the device (such as its make, model and Android version, and the machine-learning hardware it has) and performance figures (such as how long a scan took). The photo and the text read from it are not among them, and nothing from your ledger is given to it. If you never scan a receipt, no scan is reported. Google handles these reports under Google's privacy policy and describes them in its ML Kit data disclosure; the developer does not receive them.

Cloud backup, if you turn it on

Cloud backup is a paid feature and is off until you enable it. Restoring from a copy already in your Drive is free on every plan, and it works the same way: you link your Google account for it, and the app then lists and downloads that copy. Until you do one or the other, no account is linked and Google Drive is never contacted; the rest of the app's network activity is described on this page, including the Play Billing library's diagnostics.

When you do enable it, the app places one copy of your ledger in your own Google Drive. Two things about that are worth being precise on:

• It is your Drive, not a server of ours. There is still no backend, and no account with anyone but Google.
• The app asks for a single permission — access to its own hidden application folder in your Drive. It cannot see, read or touch any other file in your Drive.

The app asks for authorisation, not sign-in: it wants one permission on one Google account and is not told who you are. You can withdraw that access at any time from your Google account settings.

Every copy in your Drive is protected by a passphrase, and there is no option to send one without. You choose the passphrase the first time you back up, whether by hand or by switching on automatic backup, and every copy after that is sealed with it. A sealed copy cannot be opened by anyone who does not have the passphrase — including the developer, Google, and you if you forget it.

Each copy is labelled with your phone's name — the one set in Android's settings, or its make and model if none is set — so that a restore can say which phone a copy came from. The label sits beside the copy rather than inside it, so it can be read even when the copy is protected by a passphrase. Phone names often include their owner's name; you can change yours in Android's settings.

A copy already in your Drive can also be restored from, onto this phone or a new one.

Deleting the copy. Withdrawing the app's access stops it reaching your Drive, but does not delete a copy already there, and erasing everything inside the app clears the phone, not your Drive. To delete the Drive copy, open drive.google.com in a browser, go to Settings → Manage apps, find TidyWallet, and choose Options → Delete hidden app data.

Automatic backup

Backing up by hand is something you do; automatic backup is something the app does while you are not there. It is off until you switch it on, and switching it on is the moment to understand what changes.

It is part of the paid plan and is set in the same Drive backup menu as a copy sent by hand. Once on, the app makes one sealed copy a day and puts it in your Google Drive, replacing the one there. It writes no copy anywhere on the device; saving a file on the phone is what exporting is for.

It uses the same backup passphrase as a copy sent by hand, and there is no option to skip it. That is deliberate rather than an oversight: an unattended copy is sealed with a key this phone holds, and a copy only that key can open would be openable on exactly the phone you no longer have. The passphrase is what lets a new phone open it.

The passphrase is asked once, for every backup. The app keeps the sealed key, not the passphrase itself, so it can go on producing openable backups without ever holding what you typed. Turning automatic backup off stops the daily copy but keeps that key, so a copy you send by hand is still sealed; you can choose a new passphrase in Settings at any time, and a copy made before still needs the old one until the next backup replaces it.

A day where nothing in your ledger changed sends nothing, so an idle phone is not uploading the same file nightly.

What TidyWallet does not collect

• No bank credentials, card numbers or account numbers.
• No name, email address, phone number or postal address.
• No contacts, location or device identifiers for advertising, and no photos: a receipt you scan is read on your phone and the app's copy is deleted.
• No analytics, telemetry or crash-reporting of the app's own. The only diagnostics it sends are the Google Play Billing library's, described under Installing through Google Play, and ML Kit's when you scan a receipt, described under Scanning a receipt.
• No advertising and no third-party ad networks.
• No sale or sharing of personal information — there is none held to sell.

Backups and exports

The app can produce a backup file, and can export your records as CSV or PDF. A backup can be restored onto this phone or a new one; there is no import from other formats.

These files are written to a location you pick, and they are yours. Once a file leaves the app — into your downloads folder, a cloud drive, an email, or another device — it is governed by whatever handles it next, not by this policy.

A backup can be protected with a passphrase, and the app asks each time. This is a real choice, not a formality: saved without one, the file is readable by anything that opens it; saved with one, it cannot be recovered by anyone who does not have the passphrase, including the developer.

Installing through Google Play

TidyWallet is distributed through the Google Play Store. Google collects its own data about installations, devices and any interaction you have with the store listing, under Google's privacy policy. That collection happens between you and Google; the app itself receives none of it.

The paid plan is bought and managed through Google Play in the same way. Google handles the payment; the app learns only whether a subscription is active, and never sees your payment details.

The Play Billing library's diagnostics. To sell and check the subscription, the app includes Google's Play Billing library, and that library reports on its own operation to Google at firebaselogging.googleapis.com. It does so on every launch, on the free plan as well as the paid one, and the app has no setting that turns it off. As far as is publicly known, a report covers the library's own calls (which call was made, its result, the library's version), together with details about the app and device: the app's name and version, the Android version, the device's make and model, its language, its country and mobile network codes, its network type and its time-zone offset. The library is given nothing from your ledger, only the name of the subscription it is asked about. Google handles these reports under Google's privacy policy; the developer does not receive them.

Permissions

The app asks you for one permission: notifications, used for two things and neither is marketing — a standing order waiting to be confirmed, and a budget that has crossed its line. Refuse it and nothing is posted; the rest of the app is unaffected.

Android also grants a few permissions at install without asking, and they are listed on the Play Store page. Each one is used for what is described here and nothing else:

• Internet and network state — the rate and price lookups and the Drive backup described above, made only when a connection is available.
• Run at startup and keep the device awake — the background work Android schedules on the app's behalf: refreshing prices, the daily automatic backup, and the daily check behind the notifications above. It lets that work resume after a restart and finish once begun.
• Biometric hardware — the app lock, if you turn it on. The app is told only whether you unlocked; your fingerprint or face never reaches it.
• Google Play billing — buying and checking the subscription.

It asks for no camera permission: the receipt scanner is Google Play services' own screen, which holds that permission itself, and the app receives only the finished photo.

It asks for no storage permission: when you export or restore, you pick the file through Android's own file picker, which grants access to that one file and nothing else on your device.

This website

This site is a set of static pages. It sets no cookies, runs no analytics, and has no login, comment form or newsletter signup.

It is hosted on Cloudflare, which processes the requests needed to serve the pages and can see request metadata such as network address and user agent as part of delivering and protecting the site.

Everything the pages need is served from this domain, including the typeface. Opening a page here makes no request to any third party — no font CDN, no tag manager, no embedded media.

Children

TidyWallet is a general-purpose personal finance tool and is not directed at children. Because the app collects no personal information at all, it holds none belonging to a child.

Changes to this policy

If the app's behaviour changes in a way that affects what data leaves your device, this page will be updated and the date at the top will change with it. Material changes will also be noted in the app's release notes.

Contact

Questions about this policy, or about what the app does with data, go to info@craftedpxl.com.

The app's Send feedback opens your own email app with a message to that address, pre-filled with the app's version, your Android version and your phone's model — nothing else. You can read and change it before sending, and nothing is sent unless you send it.