Private by design

Privacy Policy

This Privacy Policy explains how ePurse ("ePurse", "we", "us" or "our") handles personal data when you use the ePurse mobile application, website and related support services. ePurse is a personal finance record-keeping tool. It is designed to keep your financial ledger on your device unless you choose a feature that sends data to another service, such as sharing a group or making a backup.

This policy should be read together with our Terms of Service, Security & backup information and deletion guide.

1. What ePurse is—and is not

ePurse helps you record and understand transactions, accounts, budgets, goals, reminders, Groups, and Lent & Borrow entries. ePurse is not a bank, lender, payment system, investment adviser or credit bureau. It does not connect directly to your bank account or move money.

2. Data kept on your device

Depending on the features you use, the app may keep the following data locally:

• profile details you enter, including your name and phone numbers;
• accounts, masked account identifiers, transactions, merchants, categories, notes and refunds;
• budgets, goals, reminders, monthly summaries, reward progress and app preferences;
• Groups, split details, and Lent & Borrow records, including names, contact references and phone numbers you choose to attach;
• coarse transaction location labels, such as city, district, region and country, if you grant location permission; and
• technical bookkeeping used to prevent duplicate SMS imports, keep shared groups in step and restore app state.

These records are kept in an encrypted database on your device. Its key is held in your device's secure key storage, and the app opts out of Android's automatic cloud backup. Your personal ledger is not uploaded to an ePurse server. The only financial records that leave your device are a group you choose to share (section 6) and a backup you choose to make (section 5).

3. SMS transaction detection

On supported Android devices, ePurse can read financial SMS messages after you grant SMS permission. It uses message content and sender information on your device to identify possible transactions. You should review detected entries in the Review Queue because bank message formats vary and automated parsing can be wrong.

ePurse saves the details it reads from a message—such as amount, date, merchant, masked account and reference number—and does not keep the original message text or sender. It also remembers which messages it has already handled so they are not imported twice. SMS messages are never sent to an ePurse server or included in backups, and ePurse does not alter or delete messages in your SMS inbox.

4. Contacts, location and notifications

• Contacts: if allowed, ePurse reads contact names and phone numbers so you can choose people for splits, groups and lending records. Selected contact details may be saved in the local record you create. To recognise people in a shared group, your phone compares a one-way fingerprint of their number with your contacts on the device; your contact list is never uploaded.
• Location: if allowed, ePurse may obtain a low-accuracy foreground location when a transaction is created, reverse-geocode it using the device platform, and keep only a coarse place label. Coordinates, street address and postal code are discarded. Location labels are not shared with group members.
• Notifications and alarms: if allowed, ePurse schedules reminders and financial nudges on your device. If you share a group, ePurse can also receive a push notification when another member changes it (section 6). Notification identifiers are device-specific and are not included in backup.
• Biometrics: App Lock uses the device operating system’s biometric authentication. ePurse does not receive or store your fingerprint or face template.

You can deny or withdraw optional permissions in your device settings. The related feature may then stop working.

5. Google sign-in and optional Drive backup

Google sign-in provides your app session and optional backup access. With your authorization, Google provides your email address, name and profile picture. A refresh credential is stored in secure device storage; short-lived access tokens are kept in memory. Signing in does not upload your ledger.

If you start a backup, ePurse encrypts the supported payload on your device before uploading it to your own Google Drive. The limited Google Drive permission allows the app to access files it created, rather than the rest of your Drive. Backup may include parsed financial records, selected contact details, coarse location labels, reminders, settings, reward progress and the keys of groups you share, so a restored phone can rejoin them. Original SMS text and sender fields are never included.

Backup file metadata—creation time, app and store version, and a coarse label such as “Android device”—is not inside the encrypted payload. ePurse keeps up to five backup files and attempts to remove older copies after a successful upload. Google processes the files, account data and OAuth activity under its own terms and privacy policy.

6. Shared groups

Sharing is optional and entirely your choice. A group stays only on your device unless you invite someone to it or join a group from an invite. Once shared, every member sees the group's people, expenses, settlements and balances, any member can add, edit or delete them, and each change keeps a visible edit history.

• End-to-end encrypted: the group's name, people's names, amounts, shares, payers, titles, categories and dates are encrypted on a member's phone with a key only the group's members hold. Our sharing service stores them but cannot read them.
• What the service can see: a group identifier, the account identifiers of its members, when each change was made and in what order, and when invites were created, expire and are used.
• Your sharing account: the first time you share or join a group, ePurse signs you in to the sharing service with your Google account. The service stores your Google email address and an account identifier. If you never share a group, no sharing account is created.
• Invite links: the group key travels inside the invite link, in a part that browsers do not send to our website. Anyone holding a valid invite link can join, so share it only with the person it is meant for.
• Phone numbers: so members' phones can match people with their own contacts, a one-way fingerprint of a member's phone number—including yours—may be stored inside the encrypted group data. The number itself is not shared.
• What stays on your phone: transaction notes, location labels, which of your accounts paid, and the rest of your ledger are not shared.
• Push notifications: when another member changes a shared group, ePurse can notify your phone with the generic text “Someone updated a group you share.” The push services receive your device's push token and that text, never group details. You can turn this off in Settings → Notifications → Shared Group Activity.

If you leave a group or delete your account, your membership ends. The group's own encrypted record, which its other members also hold, keeps the expenses you were part of so their balances still add up. After you delete your account, that record is no longer linked to any account of yours, and we keep nothing else about you.

7. Data sent to service providers

ePurse currently uses the following limited network services:

• Google: authentication and user-initiated Drive backup and restore;
• Supabase: hosts the shared-group service in India (Mumbai region). It stores the sharing data described in section 6 and receives ordinary request data such as IP address and request time;
• Expo and Google Firebase Cloud Messaging: deliver shared-group push notifications, using a device push token and generic notification text;
• Sentry: crash and error reporting in distributed builds. Reports may contain a stack trace, app version, operating-system and device information, environment, timestamps and technical error context. Reports about group syncing contain event names and counts only—never group names, people or amounts. Default personal-information collection, performance tracing and session replay are disabled; and
• ePurse remote configuration: a public configuration file used for version checks and limited feature availability. The request contains no app-provided account or ledger data, although ordinary web infrastructure may receive an IP address, user agent and request time.

We do not sell personal data or share your financial ledger for third-party advertising. Service providers may process data in India or other countries under their own infrastructure and contractual safeguards. We may also disclose information when required by applicable law, legal process, or to protect users and the service.

8. User-initiated sharing and exports

When you export a statement, create a monthly report, share a group invite or share a repayment reminder, you choose the destination and recipient. A WhatsApp reminder opens WhatsApp with content you selected; WhatsApp then handles that content under its own privacy terms. Once you export or share information, the recipient or destination service controls its further use. Check the contents before sharing.

9. Website data

The ePurse marketing website does not currently use advertising cookies or behavioral analytics. Its hosting and security providers may process ordinary request data such as IP address, browser type, requested page, timestamps and security events to deliver and protect the site. The group invite page reads the invite in your browser and hands it to the app; the invite's key is not sent to the website. If website analytics or optional cookies are added, this policy and any required consent controls will be updated first.

10. Why we process data

We process data only for the feature or purpose presented to you, including to:

• provide the local financial tracking features you request;
• detect and organize transactions with permissions you grant;
• keep groups you share in step between their members and notify you of changes;
• authenticate you and perform a backup or restore you initiate;
• schedule reminders, create exports and enable sharing you request;
• maintain app security, diagnose crashes and deliver essential configuration; and
• respond to support, privacy and security requests.

11. Retention

• Your transactions and other records stay on your device until you delete them. Settings → Clean Up History lets you fold older months into monthly totals, which are kept for up to 10 years.
• Transactions you mark as ignored are removed after 90 days. ePurse remembers up to 2,500 handled SMS identifiers so ignored messages are not imported again.
• In-app notification history is kept for up to 30 days.
• A shared group's encrypted history stays on the sharing service while the group is in use. After 90 days without changes, the service keeps only the group, its members and the latest encrypted summary of who owes whom, and removes older entries; members' phones keep the full history. The group is removed when its last member leaves.
• Your sharing account, memberships and invites remain until you delete your account in the app or ask us to delete it. Push tokens are removed when you turn off shared-group notifications or sign out, and after 60 days without use.
• Google identity and OAuth credentials remain until you sign out, delete app data, revoke access, or the credential otherwise expires.
• Drive backups remain in your Google Drive until removed by backup rotation or deleted by you. Deleting your account does not delete existing Drive files.
• Support messages and diagnostic reports are retained only as needed for support, security and reliability, subject to the applicable provider settings and legal requirements.

12. Your choices and rights

Subject to applicable law, you may ask for information about personal data we process, request correction or erasure, withdraw consent, raise a grievance, and nominate another person to exercise applicable rights in the event of death or incapacity. Most financial data is only on your device, so we cannot inspect, retrieve or delete it remotely. You can edit records in the app, revoke permissions in device settings, leave shared groups, sign out of Google, delete your account, and separately delete Drive backups. Deleting your account removes your sharing account from our service.

Follow the account and data deletion guide. We may need enough information to verify and respond to a privacy request, but you should never email us financial records, SMS contents, passwords or recovery keys.

13. Security

We use measures designed to reduce unauthorized access, including operating-system app isolation, an encrypted on-device database, optional App Lock, secure storage for keys and long-lived Google credentials, limited OAuth scopes, end-to-end encryption of shared groups and encryption of backup contents before upload. No system is completely secure. You are responsible for protecting your device, Google account, invite links, backup password and recovery key. ePurse cannot recover a forgotten backup secret.

14. Children

ePurse is intended for people aged 18 or older. We do not knowingly offer the service to children or seek personal data from them. If you believe a child has provided data through a channel we control, contact us so we can review and take appropriate action.

15. Changes to this policy

We may update this policy as the app, vendors or law changes. We will post the revised version with a new date and provide any additional notice required for a material change. Where fresh consent is required, we will request it before the new processing begins.

16. Contact and grievance redressal

For privacy questions, rights requests or grievances, email support@epurse.co.in with “Privacy” in the subject. Please describe the request without including transaction records, SMS contents, passwords or recovery keys. The operator’s legal name, postal address and designated grievance contact will be added before this draft becomes effective.