← Back to Oceanus Tech

Privacy Policy

TrackMySpend  ·  Oceanus Tech  ·  Effective May 2025

App Name: TrackMySpend

Developer: Oceanus Tech

Effective Date: May 2025

Contact: trackmyspend@oceanustech.in

Address: Peshwai Road, Dhamote, Neral — 410101, Maharashtra, India

1. Introduction

Oceanus Tech ("we", "us", or "our") built TrackMySpend as a freemium mobile application. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By creating an account or using TrackMySpend, you explicitly acknowledge that you have read, understood, and agreed to this Privacy Policy, including the transfer of your data to servers located outside your country of residence. If you do not agree, please do not use the app.

2. Information We Collect

2.1 Information You Provide

• Account information — your name, email address, and profile photo (optional) when you register or sign in via Google
• Expense data — expense titles, amounts, categories, dates, notes, and payment methods you enter into the app
• Workspace names — labels you create to organise your expenses
• Budget settings — monthly budget limits and category budgets you configure
• Receipt photos — optional photos of receipts captured using your device camera. Camera access is only used when you choose to attach a receipt photo to an expense. Receipt photos are stored locally on your device. We do not use your camera for any other purpose.
• Voice input — spoken text captured when you use the Voice Add feature. See Section 2.6 for full details.
• Bank statement data — transaction data extracted from CSV, Excel, or PDF files you choose to import. See Section 2.7 for full details.
• Monthly reflections — optional personal notes you write about your monthly spending, stored securely in your Firebase account and restored automatically if you reinstall the app.
• Referral data — your referral code and the number of successful referrals if you participate in the Refer & Earn program.

2.2 Information Collected Automatically

• Device information — device model, operating system version, and unique device identifiers
• Usage data — app features used, screens visited, and session duration, collected via Firebase Analytics
• Crash reports — error logs and stack traces collected via Firebase Crashlytics to help us fix bugs
• Performance data — app startup time, screen load times, and network response times collected via Firebase Performance Monitoring
• Remote configuration — app settings such as feature flags and ad frequency adjusted via Firebase Remote Config. No personal data is collected through this service.
• Advertising ID — a resettable device identifier used by Google AdMob to show personalised ads to free users only

2.3 Camera Permission

TrackMySpend requests access to your device camera solely to allow you to photograph receipts and attach them to expense entries. This is an entirely optional feature. We do not access your camera at any other time, do not record video, and do not transmit camera data to any server without your explicit action. You may deny camera permission and still use all other features of the app.

2.4 Biometric Data

TrackMySpend offers optional biometric login (fingerprint or Face ID). Oceanus Tech does not collect, receive, transmit, or store any biometric data whatsoever. Biometric authentication is handled entirely and exclusively by your device's operating system (Android BiometricManager API). Your fingerprint or facial data never leaves your device and never reaches our servers.

2.5 Local Data Storage

TrackMySpend stores expense data locally on your device using an encrypted Room database. This ensures your data is accessible even without an internet connection. Local data is synced to Firebase when connectivity is available.

• Local database is stored in your device's private app storage, inaccessible to other apps
• You can create a local backup file from Settings → Local Backup
• Deleting the app removes all locally stored data from your device. Your data remains safely stored in Firebase and is fully restored when you log back in after reinstalling.

2.6 Microphone & Voice Data NEW

The Voice Add feature uses your device microphone to capture spoken input when you tap the voice button.

• Audio is processed entirely by your device's built-in speech recognition (Google Speech Recognition)
• We do not record, store, or transmit your audio to our servers
• We only receive the converted text result (e.g. "500 food") to create your expense entry
• Microphone permission is only requested when you use the Voice Add feature
• You may deny microphone permission — Voice Add will not work, but all other features remain fully functional

Your voice audio never leaves your device. Only the converted text is used by the app.

2.7 Bank Statement Import UPDATED

The Import Bank Statement feature allows you to select a CSV, Excel (.xlsx), or PDF file exported from your bank to automatically import your transactions.

• Files are read and processed locally on your device only
• We do not upload, store, or transmit your raw bank statement files to our servers
• PDF files are processed using PdfBox-Android, entirely on your device. Password-protected PDFs are decrypted locally — your PDF password never leaves your device and is never stored anywhere
• Excel (.xlsx) files are parsed directly on your device using a built-in XML reader — no external library or server is involved
• CSV files are read and parsed locally on your device
• Only the extracted transaction data (date, amount, description) is saved to your TrackMySpend account
• Bank account numbers, card numbers, IFSC codes, and any sensitive banking credentials are never read or stored by the app
• Imported transactions appear in your expense history exactly as if you had entered them manually

2.8 Home Screen Widget NEW

The Quick Add Widget (Premium feature) displays on your device's home screen.

• The widget reads only your premium subscription status from your device's local storage
• No personal or financial data is displayed on the widget
• No widget data is transmitted to our servers

2.9 Feedback Feature

When you submit feedback through the App (Profile → Send Feedback):

• If you give a rating of 4 or 5 stars, you are redirected to the Google Play Store to leave a review. No data is sent to us.
• If you give a rating of 1-3 stars, a draft email is opened in your email app containing your rating, optional comment, app version, and your display name. This email is sent directly from your own email app to trackmyspend@oceanustech.in.
• We do not automatically collect or transmit any feedback data — it is sent only if you choose to send the email.

2.10 Shared Workspaces

If you use the Shared Workspace feature:

• Expenses you add in a shared workspace are visible to all members of that workspace
• Your display name is shown alongside expenses you add
• Workspace data is stored securely in Firebase Firestore
• Only users with your invite code can join your shared workspace

2.11 Information We Do NOT Collect

• We do not collect bank account numbers, credit card numbers, or any financial credentials
• We do not access your contacts, SMS messages, or call logs
• We do not collect your precise or approximate location
• We do not collect biometric data (see Section 2.4)
• We do not use the camera for any purpose other than optional receipt photos (see Section 2.3)
• We do not record or store your voice audio (see Section 2.6)
• We do not automatically collect feedback — it is sent only when you explicitly send an email from your own email app (see Section 2.9)
• We do not store your raw bank statement files (see Section 2.7)

3. How We Use Your Information

Purpose	Data Used	Legal Basis
Providing the app and syncing your data	Account info, expense data	Contract performance
Restoring your data after reinstall	Account info, expense data, settings, reflections	Contract performance
Improving performance and fixing bugs	Crash reports, usage data, performance metrics	Legitimate interest
Showing ads to free users	Advertising ID (via AdMob)	Consent
Authenticating your identity	Email, Google Sign-In token	Contract performance
Sending optional reminders and budget alerts	Device push token	Consent
Attaching receipt photos to expenses	Camera (optional, user-initiated only)	Consent
Voice Add expense entry	Microphone (on-device only, not stored)	Consent
Bank statement import	CSV, Excel, or PDF file (read locally, not stored)	Consent
Adjusting app configuration remotely	Firebase Remote Config (no personal data)	Legitimate interest
Referral reward tracking	Referral code, referral count	Contract performance

We do not use your expense data for advertising, profiling, or any purpose other than providing the app to you.

4. Device Permissions

The following Android permissions are used by TrackMySpend and the reason for each:

Permission	Purpose	Required?
INTERNET	Cloud sync, authentication, ads	Yes
CAMERA	Optional receipt photo capture	No — optional
READ_MEDIA_IMAGES / READ_EXTERNAL_STORAGE	Select receipt from gallery	No — optional
USE_BIOMETRIC / USE_FINGERPRINT	Optional biometric login	No — optional
POST_NOTIFICATIONS	Budget alerts and reminders	No — optional
RECEIVE_BOOT_COMPLETED	Reschedule reminders after device restart	No — only if reminders enabled
SCHEDULE_EXACT_ALARM / USE_EXACT_ALARM	Deliver reminders at precise times	No — only if reminders enabled
VIBRATE	Vibrate on notification	No — optional
WRITE_EXTERNAL_STORAGE	Save local backup file (Android 9 and below)	No — optional

Note: The app does not request RECORD_AUDIO permission. Voice Add uses Android's built-in RecognizerIntent which handles audio capture entirely within the system speech recognition service.

5. Cross-Border Data Transfer and Storage

Your data is stored using Google Firebase (Firestore and related services), with data centres located primarily in the United States. By creating an account and using TrackMySpend, you explicitly and actively consent to your personal data being transferred to, stored in, and processed in the United States and other countries where Google operates infrastructure.

These countries may have data protection laws that differ from those in your country of residence. Google Firebase maintains appropriate safeguards for such transfers including Standard Contractual Clauses (SCCs) approved by the European Commission.

Firebase provides industry-standard encryption in transit (TLS 1.2+) and at rest (AES-256).

6. Data Security

We implement the following security measures to protect your data:

• Authentication is required to access your account
• M-PIN protection and optional biometric authentication on every login
• Firestore security rules ensure each user can only access their own data
• Release builds are minified and obfuscated to deter reverse engineering
• We use Firebase App Check to prevent unauthorised access to our backend
• All data in transit is encrypted using TLS/HTTPS

No method of transmission or storage is 100% secure. In the event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law — within 72 hours for GDPR-regulated users and within the timeframes required by the Digital Personal Data Protection Act, 2023 (DPDPA) for Indian users.

7. Third-Party Services

Service	Purpose	Privacy Policy
Firebase Auth, Firestore, Analytics, Crashlytics	Authentication, data sync, analytics, crash reporting	firebase.google.com/support/privacy
Firebase Performance Monitoring	App performance metrics	firebase.google.com/support/privacy
Firebase Remote Config	Remote app configuration	firebase.google.com/support/privacy
Google AdMob	Displaying ads to free users only	policies.google.com/privacy
Google Sign-In	Social login	policies.google.com/privacy
Google Play Billing	Processing subscription payments	policies.google.com/privacy
Google Speech Recognition	On-device voice-to-text for Voice Add	policies.google.com/privacy
Google Play In-App Review	Prompts users to rate the app on Play Store	policies.google.com/privacy
Google Play App Update	In-app update notifications	policies.google.com/privacy
PdfBox-Android	On-device PDF text extraction for bank statement import	pdfbox.apache.org (Apache License 2.0)

8. Advertising

Free users of TrackMySpend may see advertisements served by Google AdMob. These include:

• Interstitial ads — shown after every few expense additions
• Rewarded ads — shown before exporting reports, in exchange for the download
• Banner ads — shown on certain screens

AdMob may use your Advertising ID to show personalised ads based on your interests.

Premium subscribers do not see any advertisements.

You can opt out of personalised ads at any time:

• Android 12+: Settings → Google → Ads → Delete advertising ID
• Android 11 and below: Settings → Google → Ads → Opt out of Ads Personalisation

9. Data Retention

• Your account and expense data is retained as long as your account is active
• If you delete your account (Profile → Delete Account), all your personal data is permanently deleted from our Firebase database within 30 days
• When your Premium subscription expires, your data in Premium workspaces is not deleted — it is retained and accessible again upon renewal
• Anonymised, aggregated analytics data may be retained longer for product improvement purposes
• Crash logs are automatically purged by Firebase after 90 days

10. Your Rights

All users:

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your account and all associated personal data
• Portability — export your expense data in CSV or Excel format from the Reports screen at any time

Users in the European Economic Area (EEA) and United Kingdom:

You have additional rights under the GDPR and UK GDPR, including the right to restrict processing, object to processing, and lodge a complaint with your local data protection supervisory authority.

Users in India:

Under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the right to access, correct, and erase your personal data, and to grievance redressal. Contact us at trackmyspend@oceanustech.in for any grievances.

To exercise any of these rights, contact us at trackmyspend@oceanustech.in. We will respond within 30 days.

11. Children's Privacy

TrackMySpend is not intended for children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at trackmyspend@oceanustech.in and we will delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective Date" at the top of this page and notify you via a prominent notice within the app at least 7 days before the change takes effect. For non-material changes, we will update the date and the revised policy will apply immediately.

Continued use of the app after changes take effect constitutes your acceptance of the revised Privacy Policy.

13. Contact and Grievance Officer

For any questions, concerns, or data requests related to this Privacy Policy:

Oceanus Tech

Email: trackmyspend@oceanustech.in

Address: Peshwai Road, Dhamote, Neral — 410101, Maharashtra, India

Response time: Within 30 days of receipt

This Privacy Policy was last updated on May 16, 2026. Previous version effective April 22, 2026.