Privacy Policy

Last updated: October 6, 2026

The short version

Off Finance works on your phone without an account, and what you enter stays there. Apart from a check for app updates, nothing leaves your phone unless you choose it: creating an account to sync or share, or turning on analytics. On Android, if you turn on Expense automation, the app reads payment notifications from the wallet apps you pick, on your phone. We don't sell your data or use it for ads.

Who's responsible

Leonardo Guimarães Urci, the developer of Off Finance, is responsible for your data (the "controller", as Brazil's data protection law, the LGPD, calls it). Questions or requests about your data: [email protected].

What we collect and why

The app, no account
- What: nothing. What you enter stays in a database on your phone. The update check sends nothing about you. Like any server, our hosting provider (Railway) keeps a standard request log with your IP address for 7 days; we only look at it to fix problems or stop abuse.
- Why: to tell you about updates.
- Basis for the request log: our legitimate interest in security and fixing problems.
Account and Sync (only if you create one)
- What: email, name, avatar, app language, password (hashed) or Google sign-in, the vaults you sync, and whether your subscription is active. No IP address or device details are saved with your account.
- Why: to run sync, shared vaults, sign-in, payments, and account emails.
- Basis: your consent and our contract with you. Billing records: legal obligation.
Analytics in the app (off unless you turn it on)
- What: how you use the app, basic device details, a rough location, and random IDs, without your amounts, names, notes, or email. Payment notifications are not part of analytics.
- Why: to see which features people use and where they get stuck.
- Basis: your consent.
Expense automation (Android, off unless you turn it on)
- What: the notifications from the wallet apps you turn on. They're read on your phone. Expenses you add can sync, and original notifications can be shared within a vault, as explained below. Neither depends on analytics.
- Why: to turn your payments into expenses.
- Basis: your consent.
This website
- What: the page, where you came from, your browser, device, screen, language, and time zone, how fast it loaded, and which Ask your AI option you pick, if you use it. No cookies. PostHog combines your IP address and browser details into a one-day anonymous code so a visit counts once, then drops the IP. It isn't stored or used to find your location.
- Why: to know how many people visit, what they read, and whether they ask an AI about the app.
- Basis: our legitimate interest.
The waitlist
- What: your email and how you heard about us (both required), the page's language, which platforms you'd use, and when you joined and confirmed.
- Why: to tell you when the app launches and give you the offer below.
- Basis: your consent.

Besides us, only the companies listed further down handle your data. They run parts of the service for us. Apart from them and the people in a vault you share, nobody gets your data unless the law requires it.

Accounts and shared vaults

You only need an account to sync or to join a shared vault. People you invite don't have to buy a plan.
Payments go through Google Play. RevenueCat tracks whether your subscription is active, by account ID. We never see your card.
Everyone in a shared vault sees all of it, plus your name, your avatar, who added or edited each transaction, and the owner's email.
To invite someone, you give us their email and we send the invite. If someone leaves or is removed, the copy on their phone stays with them.

Analytics in the app

It's off until you turn it on, with the checkbox during setup or "Share analytics" in Settings > Privacy. Leaving it off changes nothing in the app. The choice is per device: signing in or out doesn't change it, and a new device asks again.
Sent: what you do, like opening the app, signing in, using quick add, creating a budget, or buying a plan; the app version; your device model, system, screen size, language, region, and time zone; the country and city PostHog works out from your IP address (the IP isn't stored); the ad campaign, if you installed from one of our ads; a random ID and a session ID, neither linked to your account or email.
Never sent to PostHog: amounts, names, notes, what you called your categories, budgets, vaults, or payment methods, your email, or anything from your account.
Turning it off stops new events right away. Anything already recorded may go out in one last send, the rest is cleared, and the random ID resets. This does not change your expenses or shared original notifications.
Deleting it: tap "Delete analytics data" in Settings > Privacy. It opens an email to support with your IDs, old ones included. Send it and we delete everything sent under them. Uninstalling or clearing the app's data loses those IDs, so send it first. Analytics aren't tied to your account, so deleting the account doesn't delete them.

Expense automation

It's for Android, and it's off until you turn it on in the app. Once it's on, the app reads notifications from the wallet apps you turn on (today, Google Wallet), and nothing from other apps. You can take back notification access in Android's settings at any time.
What it reads: each notification's title, text, and when it was posted. The app reads the amount, merchant, card label and last four digits, when present. It prepares an expense for your review or adds it automatically. The waiting list and its notification text stay on your phone. Our notifications about these expenses are also made on your phone.
Expenses and rules: an added expense records its source app, merchant, card label and last four digits. If you use Sync, these fields and the vault's place and card rules sync with your other financial data to our server at Railway in the United States. Members of a shared vault can read them. We use them to run Expense automation, not for analytics.
Request an app: sends only the name you type, linked to your account. We use it to support more apps and email you when yours is supported. The basis is your consent. Requests are kept while your account exists.

Original notification sharing

The vault owner can turn on original sharing in Vault settings. It starts off. It applies only to notifications captured while it is on and saved as expenses in that vault. It does not send older notifications. This setting is separate from analytics.
With an account and Sync available for the vault, the app sends the original title, text, source app and posting time to our server at Railway in the United States, linked to the expense and vault. Current vault members can read them alongside the expense, so they can check where the expense came from.
Once sharing is turned off and the change syncs, vault members no longer see the shared originals. Deleting an expense or the vault does the same for its originals. The private waiting list remains on the phone.

The website and the waitlist

PostHog counts visits for us, including which parts of the home page you reach and the Ask your AI options you pick, and stores nothing on your device. If you came from an ad, its click ID is masked before anything is sent.
Cloudflare hosts the site and sees your IP address to serve the pages. Your browser remembers your theme and language.
Waitlist codes go out through Resend, and entries sit on our server at Railway. Deleting your account deletes your entry. To leave the list, write to [email protected].
Waitlist offer: confirm your email on the waitlist and create an account with it by the end of January 31, 2027 (Brasília time) to get 12 months of Sync, counted from when the account's email is verified. New accounts only (an email that already has an account can't join), one per email, and it can't be transferred or swapped for money. Afterward the account goes back to the free plan, with no charge, and keeps a note that it came from the waitlist.

Who else handles your data

Railway: our server and database (accounts, synced data, shared original notifications, app requests and the waitlist) and its request log.
Cloudflare: delivers this website and protects our server, and sees your IP address to do that. Also stores our encrypted daily backups.
Google Play and RevenueCat: payments and whether your subscription is active.
Google: "Continue with Google".
Resend: account emails and waitlist codes.
PostHog: app analytics, if you turn them on, and website visit counts.

Railway, Resend, Google, and RevenueCat handle your data in the United States. PostHog keeps it in the European Union, which Brazil recognizes as protecting data as well as the LGPD does. Cloudflare works from data centers around the world. A second encrypted backup sits on the developer's own storage in Brazil. We take reasonable care of all of it, but no system is 100% secure.

How long we keep it

On your phone: until you clear the app's data or uninstall it.
Your account: while it exists. Billing records: as long as the law requires.
Request log: 7 days, at Railway.
App analytics: up to a year at PostHog, or sooner if you ask us to delete it.
App requests: while your account exists.
Website visits: up to a year at PostHog, with nothing that identifies you.
The waitlist: until it ends after January 31, 2027. Then entries that never became an account are deleted, and the rest lose their answers.

Deleting your data

On your phone: clear the app's data, or uninstall the app.
Your account: email [email protected] from your account's address and ask us to delete your data. We delete it within 30 days, and backup copies within 90. Vaults you own, their data and original notifications, and your app requests go with it. Expenses and originals you added to someone else's vault stay in that vault. We keep only what the law requires, like billing records. This doesn't cancel your Google Play subscription.
Analytics: see "Deleting it" above.
Step by step: Deleting Your Account.

App permissions

The app asks for permissions only if you turn on Expense automation, on Android: notification access, to read the wallet apps you pick, and permission to show notifications, to tell you about new expenses. It can't reach your contacts, location, camera, or microphone. Android grants a few at install, for internet access, billing, and syncing in the background.

Age

Off Finance is for ages 13 and up. If you're under 18, you need a parent's or guardian's OK to create an account, buy a plan, or turn on analytics. The app doesn't check your age. If a child under 13 gave us information, tell us and we'll delete it.

Your rights

Under the LGPD, you can ask us to:

confirm we have your data and show it to you
fix it if it's wrong, incomplete, or out of date
anonymize, block, or delete what's unnecessary, excessive, or unlawful
hand it over so you can take it elsewhere
delete what we hold because you consented
tell you who we share it with

You can withdraw consent at any time. Saying no only costs you that feature: no analytics changes nothing, and no account means no sync. For analytics, turn off "Share analytics". To stop the app reading notifications, turn off Expense automation or Android's notification access. For anything else, write to [email protected]. You can also complain to Brazil's data protection authority, the ANPD. Outside Brazil, laws like the GDPR or the CCPA may give you similar rights, and the same address works.

Changes to this policy

When it changes, so does the date at the top. For important changes, the app also shows "Review the updated terms" in Settings, never a pop-up.