Español · English
Last updated: 11 August 2026
This is a translation of the Spanish original for convenience. If the two versions differ, the Spanish version is the one that applies.
This policy describes how the PyFinanzas mobile app ("the app") handles user information. PyFinanzas is a personal finance app designed to work on the device itself; everything that leaves it is set out in this document.
The financial information recorded in the app stays on the device. It leaves the device only in the cases listed below, all of them optional and triggered by the user, except the last three, which are automatic and contain no personal data.
| Feature | What leaves the device | Destination |
|---|---|---|
| Normal use of the app | Nothing | — |
| Backup (optional) | A complete copy of the database | The user's own Google Drive |
| Account and purchases (optional) | Email address or Google identity, purchase and credit-spending receipts | Firebase and Google Play |
| AI features (optional) | Depending on the feature: from category names only, to transaction amounts and dates, or the complete content of the file, photograph or messages the user chooses to send. Detailed in the corresponding section | The app's server and Anthropic |
| Errors and suggestions (optional) | The text written by the user and technical data about the device | The app's server |
| Exchange rates (automatic) | A currency code, for example "USD" | open.er-api.com |
| Crash reports (automatic) | Technical data about the error and the device | Firebase Crashlytics |
| App verification (automatic) | A check that the installed copy is genuine. No user data | Google Play and Firebase |
The app contains no advertising, uses no tracking analytics, and does not sell or share data with third parties for commercial purposes.
The app is developed by Antser Rodríguez Viñas. Privacy enquiries and requests regarding personal data can be sent to Antser.rv.dev@gmail.com.
Transactions, wallets, categories, debts, budgets, goals, contacts and configuration options are stored locally, in the app's private database. No process in the app transmits that information on its own initiative.
The app has Android's automatic backup disabled, so the financial database is not included in system backups or in device-to-device transfers.
If the user turns on the backup, the app stores a copy of the database in the
app's private folder inside their own Google Drive (the
appDataFolder area).
drive.appdata permission, which grants exclusive access
to that private folder and does not allow access to the rest of the Drive.The app works without an account. One can be created to use the services that require it (credits and purchases). It is managed by Firebase Authentication, from Google.
Credits are the balance used to pay for the AI features. They are stored in Firestore, from Google, associated with the uid.
The app includes six features assisted by artificial intelligence. None of them runs automatically: they all require an explicit action by the user and they consume credits.
The six features go through two successive authorisations:
The result of any of these features is always a proposal: it fills in or marks the corresponding screen, and it is the user who reviews, corrects and confirms before anything is saved or imported.
The data is sent through the app's server to the AI provider Anthropic. In every case the names of the user's categories or wallets are included when the feature has to choose between them.
| Feature | Sent | Not sent |
|---|---|---|
| Transaction interpreter Writing a transaction in natural language |
The text written by the user; the names of their categories, wallets, contacts and currencies; the current date and the configured number format | Amounts, balances or transaction history, including those of the very transaction the feature is composing |
| History analysis Suggestions for recurring transactions, templates and budgets |
For each transaction of the last year: date, amount, category and wallet name, and the contact or tag that distinguishes it | Balances or notes. Transactions excluded from reports, debts and their payments, and transfers are left out |
| CSV template Mapping the fields of the bank's file |
Only the structure of the file: the name of each column, the detected type, the number of distinct values, whether any is negative, and the masked shape of a sample value | No real value: no amounts, no balances, no dates, no merchant names, not a single row of the file |
| Match descriptions Assigning a category to each transaction in the file |
The description the bank uses for each transaction that is still unmatched, and whether it is an expense or income | No other column of the file: no amount, no balance, no date, no complete rows. Nor the descriptions already resolved on the device |
| Reconcile transactions Deciding whether a transaction in the file is already recorded |
For each doubtful transaction in the file: its text, amount, date and whether it is an expense or income. For the user's own transactions that might match (five at most for each one): amount, date and their text, that is, category, contact and note | Balances, the complete history, rows the app resolved on its own, or transactions from dates or wallets the file does not cover. Nor the internal identifiers: the candidates travel by their position in the list that is sent |
| File reading Converting a PDF, a photo, a file the app does not understand, or the emails and messages shared to the app |
The complete content the user picks, photographs or shares to the app, as it is: everything it contains, including dates, amounts, descriptions, senders and any other data that document or message may carry | No data already stored in the app: none of its transactions, none of its balances, none of the names of its categories or wallets |
The initial comparison between the imported file and the transactions already recorded is performed entirely on the device and transmits nothing. The reconciliation feature only steps in for the cases that comparison leaves in doubt.
File reading. This is the feature that transmits the most information and the only one that sends a complete document without the app being able to examine it first: there is no way to read a bank statement without seeing all of it. It must be noted that a bank statement usually contains, besides the transactions, balances, account or card numbers and the account holder's name and address; all of that is transmitted too, because it is part of the same document. The user decides which file to send and sees the corresponding notice before every send.
This same feature also reads the emails and messages the user shares to the app from their mail or messaging application. The app does not access the inbox or the message history and requests no permission to do so: it only receives what the user expressly sends it, message by message, from the other application. What is shared is kept in the app's private storage —outside backups— until it is read or the user discards it, and it is sent complete, including the sender, the signature and any quoted text the message carries along. As with a file, notice is given before every send.
If the file is a photograph taken with the camera, the app stores it in its temporary storage only until it is sent, and each new photo replaces the previous one; it is not copied to the device gallery and is not included in backups. Reading photographs also requires a paid account.
What this feature returns is only the transactions (date, amount, description and direction). The rest of the document's content is not kept anywhere: neither on the device, nor on the app's server.
CSV template. The shape of a value is that value with the data replaced: each digit by a 9 and each letter by an X, keeping slashes, dots and spaces. An "03/08" is sent as "99/99"; a "CAFE LA ESQUINA", as "XXXX XX XXXXXXX". The masking is done by the device before any transmission and cannot be turned off. It is necessary because a file without a header row provides no other information about its columns. It must be noted that the shape, although it contains no data, does reveal how many digits a number has and where its decimal separator is, which in an unpadded column allows the order of magnitude of an amount to be deduced, never its value.
Match descriptions. The description is written by the bank. If the bank includes within that text an amount, a date, digits of a card or another person's name, that information is transmitted too: the app cannot identify or remove it. The user can review it beforehand, since it is the same list the screen shows. The matches made are kept on the device, so that the same description is not sent again in later imports.
The interpreter's text can be dictated instead of typed. For that the app requests the microphone permission, which it uses only while listening is active on that screen: it starts when the microphone is tapped and ends when it is tapped again.
The app does not store the audio and does not send it to any server of its own: it hands it to the device's speech recogniser (on most Android phones, Google's), which returns the text. How that recogniser handles the audio is governed by its own privacy policy. The resulting text then follows the same route described above, and is only sent if the user taps Interpret.
Anthropic processes each request in order to return the result and does not use it to train its models; its processing is detailed in its privacy policy. The app's server does not keep the transactions or the file: it uses them for the call and responds.
For each use, the record described in Credits and purchases remains in Firestore (uid, feature, credits and date) together with the result returned, for the sole purpose of not charging twice for an operation whose connection was interrupted. The resulting suggestions, templates and matches are stored on the device; the suggestions are replaced when that screen's analysis is repeated and disappear when the app's data is cleared.
To convert amounts between currencies, the app queries a public exchange-rate API (open.er-api.com) once a day, on the first opening of the day, and when it is missing the rate for a specific currency.
The app uses Firebase Crashlytics, from Google. When the app closes unexpectedly, a report is transmitted that may include the device model, the Android version, the state of the app at that moment and the technical log of the error.
When the app needs to communicate with its server —for the AI features, credits or sending a report— it first checks that the installed copy is genuine and has not been tampered with, using Firebase App Check with Play Integrity, both from Google. Its purpose is to prevent automated programs from impersonating the app and consuming services that cost money at other people's expense.
The Errors and suggestions option on the Account screen transmits to the app's server the text written by the user, together with the app version, the device model, the Android version, the language and whether the message is an error or a suggestion. If a session is open, the uid is included so the case can be followed up.
Biometric lock. If lock by fingerprint or face is enabled, the verification is carried out by the Android system (BiometricPrompt). The app never accesses, receives or stores biometric data; that data does not leave the device.
Notifications. With the corresponding permission, the app shows reminders for planned transactions. They are generated on the device and no external servers are involved.
The only third parties involved are the following. The app contains no advertising, uses no tracking analytics and does not sell or share data with third parties for commercial purposes.
| Third party | What for | When |
|---|---|---|
| Google — Firebase Authentication and Firestore | Account, credit balance and receipts | Only with an account created |
| Google — Drive | Backup in the user's own account | Only if the backup is turned on |
| Google — Play | Processing purchases | Only when buying |
| Google — Firebase Crashlytics | Crash reports | On an unexpected close |
| Google — Firebase App Check and Play Integrity | Verifying that the installed copy is genuine | Automatic, with no user data |
| Anthropic | Processing the AI features | Only when one of them is used |
| open.er-api.com | Exchange rates | Automatic, with no user data |
| The device's speech recogniser | Turning dictation into text | Only when the microphone is used |
Uninstalling the app removes all local data from the device. In addition:
The user may request access to, rectification of, portability of or erasure of the data associated with their account by writing to Antser.rv.dev@gmail.com. Data that resides only on the device requires no request: it is under the user's direct control and is removed by uninstalling the app or clearing its data.
The app is not directed at minors and does not knowingly collect data from them.
If this policy changes, this page will be updated with a new last-updated date. The version published here is the same one shown inside the app.