Español · English
Last updated: 2 October 2026
This is a translation of the Spanish original for convenience. If the two versions differ, the Spanish version is the one that applies.
This policy describes how the PyFinanzas mobile app ("the app") handles user information. PyFinanzas is a personal finance app designed to work on the device itself; everything that leaves it is set out in this document.
The financial information recorded in the app stays on the device. It leaves the device only in the cases listed below, all of them optional and triggered by the user, except the last three, which are automatic and contain no personal data.
| Feature | What leaves the device | Destination |
|---|---|---|
| Normal use of the app | Nothing | — |
| Backup (optional) | A complete copy of the database | The user's own Google Drive |
| Account and purchases (optional) | Email address or Google identity, purchase and credit-spending receipts | Firebase and Google Play |
| AI features (optional) | Depending on the feature and the authorisation level chosen: from category names only, to transaction amounts, balances and dates, or the complete content of the file, photograph or messages the user chooses to send. Detailed in the corresponding section | The app's server and Anthropic |
| Transaction detection (optional) | Nothing. Notifications are read and analyzed on the device itself | — |
| Errors and suggestions (optional) | The text written by the user and technical data about the device | The app's server |
| Exchange rates (automatic) | A currency code, for example "USD" | open.er-api.com |
| Crash reports (automatic) | Technical data about the error and the device | Firebase Crashlytics |
| App verification (automatic) | A check that the installed copy is genuine. No user data | Google Play and Firebase |
The app contains no advertising, uses no tracking analytics, and does not sell or share data with third parties for commercial purposes.
The app is developed by Antser Rodríguez Viñas. Privacy enquiries and requests regarding personal data can be sent to Antser.rv.dev@gmail.com.
Transactions, wallets, categories, debts, budgets, goals, contacts and configuration options are stored locally, in the app's private database. No process in the app transmits that information on its own initiative.
The app has Android's automatic backup disabled, so the financial database is not included in system backups or in device-to-device transfers.
If the user turns on the backup, the app stores a copy of the database in the
app's private folder inside their own Google Drive (the
appDataFolder area).
drive.appdata permission, which grants exclusive access
to that private folder and does not allow access to the rest of the Drive.The app works without an account. One can be created to use the services that require it (credits and purchases). It is managed by Firebase Authentication, from Google.
Credits are the balance used to pay for the AI features. They are stored in Firestore, from Google, associated with the uid.
The app offers artificial intelligence in two places:
None of this runs automatically: everything requires an explicit action by the user and consumes credits. In the assistant the cost depends on how many times it needs to look up data to answer, and it is shown when it finishes.
The first time any AI feature is used, the app shows a single consent. It warns that some features send data from the transactions or from a file (amounts, dates, descriptions or balances) and that reading a file, a photograph or a shared message with AI sends that content complete. What each feature sends specifically is what this section sets out, and it is never more than that.
After that consent:
The result is always a proposal: a transaction ready to review, items for the shopping list, suggested budgets, recurring items or templates, or a button that opens the right screen. The AI saves nothing on its own: it is the user who reviews, corrects and confirms.
With each message the assistant receives only the text written (or dictated), the current date, the configured number format and the name of the screen it was opened from. It does not receive the earlier messages of the conversation.
If it needs any data to answer, it asks for it: the phone reads it from its own database and sends only what was requested. No server keeps a copy of the user's financial information. The data it can ask for falls into three levels:
| Kind of data | What it includes | When it is sent |
|---|---|---|
| Names | Names of categories, wallets, contacts, currencies and tags | Whenever it asks for them, without asking the user: they are covered by the single consent |
| Amounts and balances | The balance of a wallet; the transactions in a date range (up to 40, with date, type, amount and currency, plus the totals by currency; the wallet, category, contact, tags and comment only if the answer needs them and asks for them); the pending debts (person, amount and note); spending totals by category and month; and the past year's expenses grouped by category and contact or tag, with their amounts and dates | According to the authorisation level |
| Complete file | The file, photograph or document the user attaches or shares, as it is (see 7.4) | According to the authorisation level |
Together with the requested data travel internal identifiers of the records, so that the answer can refer to them. They have no meaning outside the app.
The four authorisation levels:
Even when nothing is asked, what was sent with each message can be checked afterwards in that message's detail, through the information icon.
Assistant functions. All of them receive up front the names of the categories, wallets, contacts and currencies. Beyond that, each one limits what it can ask for:
| Function | What it can ask for |
|---|---|
| Interpret transaction Turn a sentence or a photo into a transaction |
The balance of a wallet, only if the amount depends on it; and the file or photo, if one is attached |
| Shopping list Note down items written or photographed |
Nothing more: it works with the text or file it is given, including any notes unrelated to the shopping that it contains. It does not see the current list or any amount |
| Spending tips | Spending totals by category and month. It does not see individual transactions |
| Suggest recurring Suggest templates |
The past year's expenses grouped by category and contact or tag. It does not see individual transactions |
The suggested budgets, recurring items and templates are stored on the device, in the corresponding Suggestions screen, and replace those the AI had proposed before.
Data is sent through the app's server to the AI provider Anthropic.
| Feature | Sent | Not sent |
|---|---|---|
| CSV template Map the fields of the bank file |
Only the structure of the file: the name of each column, the type detected, the number of distinct values, whether any is negative, and the masked shape of a sample value | No real value: no amounts, balances, dates or merchant names, and not a single row of the file |
| Match descriptions Assign a category to each transaction in the file |
The description the bank gives each transaction not yet matched, and whether it is an expense or income | No other column of the file: no amount, balance, date or full rows. Nor the descriptions already resolved on the device |
| Reconcile transactions Decide whether a transaction in the file is already recorded |
For each doubtful transaction in the file: its text, amount, date and whether it is an expense or income. For the user's own transactions that might match (five at most for each): amount, date and their text, that is, category, contact and note | Balances, the full history, rows the app resolved by itself, or transactions from dates or wallets the file does not cover. Nor the internal identifiers: the candidates travel by their position in the list sent |
| File reading Convert a PDF, a photo, a file the app does not understand, or the messages collected with Add to import |
The complete content the user chooses, photographs or shares, as it is: everything it contains, including dates, amounts, descriptions, senders and any other data that document or message carries | No data already stored in the app: not its transactions, its balances, or the names of its categories or wallets |
The initial comparison between the imported file and the transactions already recorded is done entirely on the device and transmits nothing. Reconciliation only steps in on the cases that comparison leaves in doubt.
CSV template. The shape of a value is that value with its data replaced: each digit by a 9 and each letter by an X, keeping slashes, dots and spaces. A "03/08" is sent as "99/99"; a "CAFE LA ESQUINA", as "XXXX XX XXXXXXX". The masking is done by the device before any sending and cannot be turned off. It is needed because a file without a header gives no other information about its columns. It should be noted that the shape, although it contains no data, does reveal how many digits a number has and where it places the decimal separator, which in an unpadded column makes it possible to infer the order of magnitude of an amount, never its value.
Match descriptions. The description is written by the bank. If the bank includes in that text an amount, a date, card digits or another person's name, that information is sent as well: the app cannot identify it or remove it. The user can check it beforehand, since it is the same list the screen shows. The matches made are kept on the device, so the same description is not sent again in later imports.
Reading a file is what transmits the most information: there is no way to read a bank statement without sending it whole. A bank statement usually contains, besides the transactions, balances, account or card numbers and the holder's name and address; all of it is sent as well, because it is part of the same document. This applies both to the assistant and to File reading in Import.
From other applications, content can be shared to the app in two ways:
The app does not access the inbox or the message history and requests no permission for that: it only receives what the user expressly sends it from the other application. A message is sent complete, with the sender, the signature and any quoted text it carries.
A photograph taken with the camera is kept in the app's temporary storage only until it is sent, and each new photo replaces the previous one; it is not copied to the gallery or included in backups. In Import, reading a photograph also requires a paid account.
The assistant's text can be dictated instead of typed. For that the app requests the microphone permission, which it uses only while listening is open: it starts when choosing Dictate and ends when tapping the microphone again or when sending.
The app does not store the audio or send it to any server of its own: it hands it to the device's speech recogniser (on most Android phones, Google's), which returns the text. Whatever that recogniser does with the audio is governed by its own privacy policy. The resulting text stays in the field and is only sent if the user taps send.
Anthropic processes each request to return the result and does not use it to train its models; its processing is described in its privacy policy. The app's server does not keep the data sent: it uses it for the call and replies.
A file attached to the assistant is uploaded to Anthropic so it can read it during that answer, and it is deleted when it finishes; if the answer is interrupted, it is deleted one hour later at the most.
For each use, Firestore keeps the record described in Credits and purchases (uid, feature, credits and date) together with the result returned, that is, the text of the answer and the proposals, for the sole purpose of not charging twice for an operation whose connection was interrupted.
To convert amounts between currencies, the app queries a public exchange-rate API (open.er-api.com) once a day, on the first opening of the day, and when it is missing the rate for a specific currency.
The app uses Firebase Crashlytics, from Google. When the app closes unexpectedly, a report is transmitted that may include the device model, the Android version, the state of the app at that moment and the technical log of the error.
When the app needs to communicate with its server —for the AI features, credits or sending a report— it first checks that the installed copy is genuine and has not been tampered with, using Firebase App Check with Play Integrity, both from Google. Its purpose is to prevent automated programs from impersonating the app and consuming services that cost money at other people's expense.
The Errors and suggestions option on the Account screen transmits to the app's server the text written by the user, together with the app version, the device model, the Android version, the language and whether the message is an error or a suggestion. If a session is open, the uid is included so the case can be followed up.
Biometric lock. If lock by fingerprint or face is enabled, the verification is carried out by the Android system (BiometricPrompt). The app never accesses, receives or stores biometric data; that data does not leave the device.
Notifications the app shows. With the corresponding permission, the app shows reminders for planned transactions and alerts for the payments it detects. They are generated on the device and no external servers are involved.
This feature is off by default. If the user turns it on, the app reads the notifications posted by the applications the user checks — their bank or wallet app, for example — in order to recognize a charge and offer to record it as a transaction.
Before sending the user to grant this permission, the app shows this same information on screen and asks for explicit confirmation.
The only third parties involved are the following. The app contains no advertising, uses no tracking analytics and does not sell or share data with third parties for commercial purposes.
| Third party | What for | When |
|---|---|---|
| Google — Firebase Authentication and Firestore | Account, credit balance and receipts | Only with an account created |
| Google — Drive | Backup in the user's own account | Only if the backup is turned on |
| Google — Play | Processing purchases | Only when buying |
| Google — Firebase Crashlytics | Crash reports | On an unexpected close |
| Google — Firebase App Check and Play Integrity | Verifying that the installed copy is genuine | Automatic, with no user data |
| Anthropic | Processing the AI features | Only when one of them is used |
| open.er-api.com | Exchange rates | Automatic, with no user data |
| The device's speech recogniser | Turning dictation into text | Only when the microphone is used |
International transfers. Google and Anthropic process data on servers located outside the Dominican Republic, mainly in the United States. This includes the account, the credit balance and receipts (Firebase), the backup (Google Drive) and what is sent to the AI features (the app's server and Anthropic). By using these features, all of which are optional, the user consents to that transfer. Both providers apply their own safeguards, described in their privacy policies.
The app applies, among others, these measures to protect data:
No system is completely invulnerable. If an incident affecting personal data were detected, the affected users will be informed.
Uninstalling the app removes all local data from the device. In addition:
Regarding the data associated with their account, the user may at any time exercise the rights of access, rectification, updating, erasure, portability and objection, and withdraw the consent given. To withdraw it, it is enough to stop using the feature concerned, turn off the backup, choose the Names only authorisation level in the assistant or delete the account; withdrawal does not affect what was processed before it.
Requests are sent to Antser.rv.dev@gmail.com from the account's email address and are answered within 30 days at the most. If the user considers that their request was not addressed, they may go to court through the habeas data action recognised by the Dominican Constitution and Law 172-13.
Data that resides only on the device requires no request: it is under the user's direct control and is removed by uninstalling the app or clearing its data.
The app is not directed at minors and does not knowingly collect data from them.
If this policy changes, this page will be updated with a new last-updated date. The version published here is the same one shown inside the app.
This policy is governed by Law 172-13 on the Protection of Personal Data of the Dominican Republic, without prejudice to the rights granted to the user by the law of their country of residence. The conditions of use and purchase are set out in the Terms of use.