Privacy Policy

The summary above is a quick guide. The policy below is the full text.

Finance Universe respects your privacy. This policy explains how the Finance Universe mobile app accesses, uses, stores, and shares information, including Google user data.

1. Local financial data

Transactions, budgets, goals, recurring payments, categories, reminders and app preferences are stored locally on your device. Optional backups use your connected cloud account as described below. If you choose Shared Circles or connect a friend, the selected shared bills, payments, names and currency-rate discussions are also sent to the Finance Universe circle service as described in the Shared Circles section. Other local ledger records, receipt images and SMS contents are not automatically uploaded to that service.

2. Optional Google Drive backup

On Android, you may choose to connect your Google Account for encrypted backup and restore. Finance Universe requests only the Google Drive Application Data scope (https://www.googleapis.com/auth/drive.appdata). The app uses that access solely to create, list, read, replace, and delete Finance Universe backup files in Google Drive's private application-data area. It cannot browse or modify your ordinary Google Drive files.

Backups are encrypted on your device with AES-256-GCM before upload. Data is transferred directly between your device and Google Drive. Finance Universe does not receive your Google password, use Google Drive user data for advertising, or share Google Drive user data with advertisers. Google account information is used only to establish and display the account connection you requested.

You can disconnect Google Drive in the app at any time. You can remove Finance Universe's Google access from your Google Account permissions. You can delete cloud snapshots in the app or remove the app's hidden data through Google Drive's Manage Apps settings. Automatic backups, if enabled, maintain rolling snapshots according to the retention option shown in the app.

Finance Universe's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

3. Optional Apple iCloud backup

On supported iOS devices, you may choose to store encrypted snapshots in your private iCloud ubiquity container. Data is encrypted on-device and transferred directly to your iCloud account. Finance Universe does not operate an intermediary backup server.

4. Receipt scanning

Optional receipt recognition runs on your device. Receipt images and recognized text are not uploaded to Finance Universe servers. If you choose to watch a rewarded ad for additional scans, the ad request does not include the receipt image, recognized text, transaction amounts, or backup contents.

For free or ad-supported scanning, Google sign-in and an online allowance check are required. The service verifies your short-lived identity token and stores keyed account identifiers, UTC usage periods and scan counts, random scan-operation identifiers, reward-session identifiers and verified ad transaction identifiers. These records prevent duplicate rewards and allowance resets after reinstalling; they do not contain receipts, recognized text or financial records. The token is used for verification rather than stored in the quota ledger. A scan allowance is reserved before recognition, including if recognition subsequently fails. When rewarded ads are enabled, an opaque account identifier and random session identifier are included in Google's server-verification flow. Clearing device data does not delete the server ledger or reset its allowance.

The service runs daily cleanup at 00:05 UTC. It removes expired monthly free-scan counters, expired daily reward counters and reward-session records, and scan-operation records older than 35 days. Under normal scheduled operation these records remain in the live ledger for less than 36 days. Cleanup delays may extend retention. Service-provider recovery copies may retain deleted records for up to 30 additional days and are not used to reset allowances or restore deleted access.

In version 1.0.63 and later, open Settings > Delete Receipt Service Data and verify the relevant Google account. This immediately removes that account's scan-operation records and eligible reward records. Minimal current-month free-scan counters and current-day reward counters/verified reward records remain until their UTC period ends and the following daily cleanup, to prevent repeated deletion from resetting allowances or granting another reward. This does not delete local financial records, cancel a subscription or remove a lifetime invitation. For deletion without the app, contact archer.supportdesk@gmail.com; support verifies account ownership first.

5. Optional bank alert review

On Android, after prominent consent and Android SMS permission, optional bank-alert review checks the inbox on your device in pages of up to 200 messages, newest first, until it finds the latest three supported debit alerts for Free accounts or up to 200 supported alerts for Premium accounts, or reaches the end of the inbox. There is no 90-day cutoff: older messages may be examined locally when needed to find those alerts. Matching debit alerts are processed on your device and keep their detected currency; the app does not convert amounts. No transaction is saved until you confirm it. The parser may miss some banks or languages. Automatic scans can repeat when you reopen Bank Alerts until you turn them off.

Draft alerts, including dismissed alerts, can retain their original SMS text locally for viewing or restoring. Removing or clearing drafts deletes their stored text while keeping one-way suppression fingerprints to avoid repeat imports while app data remains. Raw SMS text and sender details are not transmitted to Finance Universe, RevenueCat or advertisers and are not included in ledger/cloud backups. Confirmed merchant, amount, currency, date, category and spending habit are stored like manually entered records and can be included in separately enabled encrypted backups. Revoke SMS permission in Android settings or turn off automatic scans in Bank Alerts. iOS supports manual paste rather than general inbox access.

6. Subscriptions and purchases

When subscriptions are available, Google Play processes Android subscription payments. Finance Universe uses RevenueCat to verify purchase history, subscription status, trial and renewal dates, and access to paid features. RevenueCat receives a purchase identifier and an app user identifier for this purpose. Finance Universe does not receive your full card number. You can manage or cancel a Google Play subscription through Google Play. Contact the support address below to request deletion of subscription records held by Finance Universe's service provider, subject to recordkeeping obligations.

6a. Optional complimentary lifetime access

Invited users may sign in with Google to check the app owner’s private email list. This sign-in does not grant Google Drive access or create a paid subscription. A short-lived Google identity token containing the verified email address and account identifier is sent over HTTPS to Finance Universe’s service hosted on Cloudflare. These token claims are used in memory to verify identity. The service stores keyed hashes of invited email addresses and binds a redeemed invitation to a keyed hash of its Google account identifier. It does not receive financial records, receipt images, SMS text or backup contents. The private source list is retained by the app owner for access administration.

Complimentary access has no scheduled end date while the address remains invited. Removing an email affects that complimentary account only. The app checks while in use and on reopening. In version 1.0.81 and later, a device-protected verified invitation may restore access offline for up to 30 days from its original successful verification time; earlier versions use shorter cache windows. Online background checks refresh access. Sign-out, switching accounts or a successful revocation response clears the relevant access. Offline revocation can take up to the remaining 30-day window. The invitation cache is excluded from financial backups. Paid subscriptions remain separate and are not canceled or refunded automatically. You can sign out or choose Settings → Subscription & Billing → Delete complimentary account to remove the live eligibility and account-binding record. To request deletion without signing in, email archer.supportdesk@gmail.com from the invited address. Support may need to verify account ownership before processing deletion. Service-provider recovery backups may retain deleted records for up to 30 days; records are not used to restore access after deletion. Google Play and RevenueCat may retain purchase records required by law.

6b. Subscription time verification

The app also makes an HTTPS request to the same service to verify current time before accepting cached purchase status. It sends a random, temporary verification value; it does not send financial records or Google credentials in that request. The request is processed by Cloudflare, which receives normal network information such as the IP address. The app does not persist the time anchor across restarts. Online verification is required after reopening to restore protected access.

6c. Optional First Flight 300 programme

Eligible verified accounts may join while enrollment is open and receive their original 90-day Premium grant. Enrollment has no participant cap and joining does not consume an award. Lifetime Premium accounts, including perpetual complimentary grants, are not eligible. Completing 60 distinct campaign days with at least 120 seconds of active, unlocked foreground use within the original 90-day window qualifies for completion. Days need not be consecutive; each campaign day is a 24-hour interval from enrollment.

The first 300 successful completions, plus every completion on the same UTC calendar day as the 300th completion, receive three calendar years of Premium from qualification. New enrollment and offers close automatically after that shared UTC cutoff. Existing participants keep their progress and original challenge window. Later completions do not receive a free extension; eligible late completers may receive 50% off their first two annual Google Play payments, then normal annual pricing. Cancellation cannot restart the discount. No rating, review, referral, purchase, payment card or automatic renewal is required to join.

To administer the programme and prevent duplicate trials, the Cloudflare service verifies a short-lived Google identity token and stores keyed account/email identifiers, enrollment/completion/qualification/expiry times, qualifying usage by campaign day and the latest random session/timestamp. Tokens are used for verification and are not stored in the device offer cache. Offline usage is not backfilled. Financial records, receipt images, SMS and backups are not uploaded for this programme. Usage records are used for programme functionality and abuse prevention, not advertising.

Delete participation in Settings > Subscription & Billing > First Flight 300 to remove daily usage/session records and end programme access. A minimal keyed eligibility/completion record remains to prevent repeat trials and preserve cutoff/award history. Existing grants and original dates are preserved. Recovery copies may remain up to 30 days. This does not delete local financial records, lifetime invitations or paid subscriptions. Contact archer.supportdesk@gmail.com for an ownership-verified request without the app.

6d. Optional friend invitations

When enabled, both people sign in with Google. An eligible account new to Finance Universe Premium can redeem an invite code for 30 days of Premium; its inviter can earn up to 12 rewards in a rolling 365-day period. Existing paid, trial, First Flight and invitation history can make an account ineligible. Self-invites and repeat redemptions are refused. Google account creation age cannot be verified by this service. Play installation checks apply when configured.

The Cloudflare service uses the verified Google token in memory and stores keyed account/email identifiers, the invite code, redemption timestamps and reward/delivery status. RevenueCat receives the opaque billing identifier and promotional expiry needed to grant access. We do not upload contacts or financial records. Rewards preserve existing grants, do not change paid renewals and do not consume a Google Play trial. Lifetime inviters receive no extra Premium time. Google Play install-referrer information can prefill an invite code; codes can also be entered manually.

Settings > Delete Receipt Service Data also deletes that account's shareable invite code. Minimal keyed redemption, email binding and reward-expiry history remains to prevent repeated rewards and preserve grants and annual limits; no automatic deletion period is promised for that history. Contact archer.supportdesk@gmail.com for an ownership-verified deletion request. Recovery copies may remain up to 30 days.

Optional 15-minute passes and monthly snapshot

A completed, server-verified rewarded video grants 15 minutes of Money Map (including its tools) or Habits. Each feature has three passes per local calendar day, counted separately. Editors opened before expiry can finish saving for ten additional minutes; the grace period does not admit a new editor. Google sign-in and an online verification check are required to earn or restore a pass. Server time and Android time since boot, including sleep, prevent device-clock changes from extending access.

The service stores keyed account identifiers, the account's local IANA calendar/time zone, per-feature grant times and day counts, random reward sessions and Google-verified ad transaction identifiers. A calendar is bound to the account while recent usage exists so changing the device date or reinstalling does not reset allowances. Financial records are not sent. An opaque identifier and random session accompany the ad verification flow. The daily 00:05 UTC cleanup removes pass history older than three days and unused calendar bindings; recovery copies may remain for up to 30 additional days. Contact support for an ownership-verified deletion request; minimal current allowance records may remain until expiry to prevent resets.

Free accounts may create a fixed Money Map snapshot once per month and currency. The snapshot contains the calculated headroom, upcoming-bill total, buffer, summary and capture time, stored only on the device. It does not grant access to live planning tools. Local financial data and separately enabled encrypted backups remain governed by the sections above.

Optional seven-day starter trial and prepaid passes

Eligible verified accounts may request seven days of Premium without a payment method or automatic renewal. Eligibility is verified against purchase, invitation and introductory-programme history. One introductory programme is allowed per account/email across the starter trial, First Flight and referral new-user rewards. Existing grants are preserved. The service stores minimal keyed account/email bindings, programme, original expiry and delivery status to prevent repeat trials, including after deletion or cancellation. These minimal eligibility records have no promised automatic deletion period; support can process ownership-verified privacy requests subject to fraud-prevention and grant-preservation needs. Identity tokens are used for verification rather than stored in this ledger.

Where available from Google Play, one-day and seven-day Premium passes are prepaid and do not automatically renew. Monthly and Annual subscriptions renew according to the terms shown by Google Play. Any First Flight completion discount applies only to Annual.

Free receipt scanning provides three scans per UTC calendar month. One optional verified ad per UTC calendar day grants three additional scans for that UTC day. This is separate from each feature's three hourly passes per local day.

6e. Optional Shared Circles

You may enter a friend's email address to share a circle or connect individual splits. The address remains on your device and can be included in your separately enabled encrypted financial backup. The service receives it over HTTPS, normalizes it (including Gmail dot and plus-tag variants), and stores a keyed fingerprint with your connection record to match the friend's verified Google sign-in. It does not retain the plain address in the circle database or include it in Firebase change markers. Sharing by email does not send an email message; the shared records appear when the matching account next opens Circles with access. Only enter an address you are entitled to use for the intended sharing.

The keyed email fingerprint and account connection have no automatic inactivity expiry. Deleting or leaving a circle does not delete a separate connection or its email fingerprint. There is currently no in-app control to unshare an email connection; contact archer.supportdesk@gmail.com for an ownership-verified request to remove or correct retained connection information. Removing a connection does not remotely erase records already received by members. A linked connection cannot be reassigned to another account merely by editing its email address.

Members can choose their own display name in Settings. Bills can include multiple payers and an optional bill-specific exchange rate, visible to the permitted members along with the other shared bill details. Optional circle cover photos are kept on the device and are not uploaded to the circle service or included in the current financial cloud snapshots.

Shared Circles is an optional Premium feature. When you share a local circle, its existing bills, settle-ups and chosen member names are uploaded to the Finance Universe service hosted on Cloudflare. Shared records include the circle name/icon and home currency; member display names, keyed account identifiers and membership status; bill titles, dates, categories, amounts, currencies, payer and each person's share; payment amounts and parties; proposed exchange rates, approvals, counter-rates and notes; and event identifiers and timestamps needed to synchronize devices. Names you enter for friends can be stored before they accept an invitation. Google identity tokens verify sign-in; they are not shared with circle members.

Circle members can see the circle's records and member names. In a direct-splits space, a connected friend receives the bills/payments involving them and the people needed to describe those records. Direct-space rate discussions are scoped to specific records with the same parties. Connecting a named friend can share existing local circles containing that person and move individual splits into a hosted direct space; later circles containing the connected person can attach automatically. Review the in-app sharing explanation before connecting someone. Share only information you intend the relevant members to see, and avoid sensitive details in titles, display names and notes. Invitation links authorize an account to claim a named slot; send them only to the intended person. A claimed person-connection link remains bound to its first accepting account so interrupted joining can safely resume.

Cloudflare processes these records to store and synchronize the shared feature. Hosted circle records are readable by the service and permitted members; they are not end-to-end encrypted like a private backup. Requests use HTTPS. Your device also keeps a local cache and offline queue. Refused changes are kept as local review drafts until you retry/edit or discard them; they are not added to the accepted shared log. The app records your own share of accepted shared bills in your personal expense ledger. It does not initiate a bank payment or move money when you record a settle-up.

For live updates, Finance Universe also uses Google Firebase Authentication and Realtime Database. After the circle service verifies your existing Google sign-in and Premium access, it issues a temporary custom sign-in token bound to a keyed account identifier. Firebase receives that opaque identifier, authentication/session information and one replaceable random change marker per account. This marker can indicate shared activity, but contains no circle IDs, member lists, bill titles, amounts, notes, receipt images, SMS contents or private backup contents. Firebase and Cloudflare also receive the network information needed to handle requests, such as IP addresses and client information. Firebase stores these markers in Singapore for the current production project; the app does not request device location permission for this purpose. Clients may read only their own marker and cannot write markers. Shared financial records continue through the circle service, which checks membership and access.

Live synchronization operates while the app is open and catches up after reconnecting or reopening; it is not a promise of background push delivery. It is part of the optional Shared Circles feature and works independently of the optional Share usage events choice. Refusing analytics does not disable circle synchronization, and using circles does not opt you into analytics or personalized advertising. The app disconnects its live listener and signs out of its separate Firebase session when backgrounded or when the account session is cleared.

The circle owner can delete the hosted circle, including its active event/member records. A member can leave even after Premium expires; leaving removes their active account membership but retains historical names and shared financial records so the remaining members' balances remain meaningful. Previously synchronized copies and personal expense entries on other devices are not remotely erased. Circle deletion and leaving do not automatically remove separate person-connection directory records. Current circle and connection storage has no automatic inactivity expiry. For questions about retained connection/account data or a deletion request beyond these in-app controls, contact archer.supportdesk@gmail.com. A full account-data request beyond these in-app controls is handled through support.

Firebase retains the latest change marker and its Authentication account until they are explicitly deleted; no automatic inactivity expiry is implemented. Leaving or deleting one circle does not erase the separate Firebase account or markers associated with other circles. Signing out ends the local live session but is not a hosted deletion request. The temporary custom token is valid for ten minutes to establish sign-in; Firebase may issue a renewable session with a different lifetime. For full account-data requests, contact the support address above so the keyed Firebase marker/account and applicable connection data can be reviewed and deleted. Token expiry does not delete stored data.

6f. Optional payment details and payment requests

You may save how friends can pay you: a UPI ID or UPI number, a PayPal.me, Venmo, Cash App, Revolut, Wise or Monzo username, a Zelle email address or phone number, or an IBAN with the account holder's name. You may also save the payment details you use for a friend. These details are stored on your device and are included in your encrypted cloud backup when you enable one. Your chosen display name and UPI ID are also shared with the members of your Shared Circles so they can pay you, as described in section 6e. Your other payment details are not uploaded to Shared Circles or to Finance Universe; they appear only in the payment requests, links and QR codes that you choose to send through your device's share options. Opening a payment link or QR code hands you over to the payment app or bank you select, whose own terms and privacy policy apply. Finance Universe does not process payments, move money, receive payment confirmations or access your payment accounts.

The optional Circle home-screen widgets show circle names, members' initials and balances on your home screen. They are prepared on your device from data already stored in the app and are visible to anyone who can see your home screen.

7a. Optional usage measurement

In analytics-enabled versions, Google Analytics for Firebase starts only after you choose Share usage events. You may decline and continue using the app, or turn sharing off in Settings. We send a fixed set of feature events, such as first transaction saved, first budget created, onboarding completed, Money Map opened, trial started and subscription purchased. We also measure coarse screen visits, First Flight milestones, rewarded-ad requests, load failures, impressions, completed views, closures and server-confirmed reward outcomes. Optional ad measurement includes the SDK-estimated impression value, currency and precision; this is not your ledger or evidence of a publisher payout. We do not attach ledger amounts, notes, categories, merchant names, SMS, financial records, Google account identifiers or verification tokens to these events. Older analytics opt-ins are asked to accept this expanded disclosure again; previous refusals are preserved.

After opt-in, Google also processes a random app-instance identifier, device/app/OS information, automatic session/engagement events, installation/campaign attribution and, where supported, app purchase/subscription product identifiers and prices. Analytics collection remains disabled by default and starts only after your explicit opt-in in configured versions. Network information can be used to derive approximate location. Advertising-ID collection, advertising user-data consent and ad personalization are disabled for this measurement. Firebase app analytics is linked with our AdMob app for app and ad performance reporting and monetization measurement. Optional aggregate measurement may also be linked to our Google Ads account to evaluate acquisition; it is not used to create personalized advertising audiences. Google processes data under its applicable service terms and privacy policy: Google Privacy Policy and How Google uses information from apps that use its services.

Turning sharing off stops collection and clears locally held analytics data and its app-instance identifier. It does not automatically erase events already received by Google. For a deletion request, contact archer.supportdesk@gmail.com; we may need the relevant analytics identifier to locate records. Analytics retention follows the property's configured retention setting. Private financial records remain on your device or in separately enabled encrypted backups; selected Shared Circles records also use the hosted service described above.

7. Advertising and privacy choices

Version 1.0.104 and later remove banner ads and do not display interstitial ads. Older versions, such as 1.0.103, may still show a small banner to eligible free accounts until updated. In the new versions, advertising is limited to optional rewarded videos: eligible free accounts can choose an ad for extra receipt scans or one hour of Money Map or Habits access. Active Premium access, including paid subscriptions, starter trials, First Flight and complimentary grants, is ad-free. Each ad offer also shows the available Premium price. Watching ads is not required for manual tracking, Planner, budgets, goals, recurring payments/reminders, category spending charts or the latest three supported bank debit alerts.

Finance Universe uses the Google Mobile Ads SDK for these placements. The SDK may collect and share your IP address, approximate location inferred from it, app interactions such as ad views and taps, diagnostics, and device identifiers such as the Android advertising ID or app set ID. Google uses this information for ad delivery, measurement, and fraud prevention. The app requests non-personalized ads and presents the privacy choices required for your region before an ad request. Where required, you can revisit Ad Privacy Choices in Settings. Advertising privacy choices are separate from optional Firebase usage sharing.

Your financial records, receipt content, Google Drive backup contents, and Google Drive account data are not sent in ad requests. You can keep using manual transaction entry without watching ads. Google's privacy information is available at https://policies.google.com/privacy.

8. Device permissions

The app may request notifications for reminders, exact-alarm scheduling for user-created bill reminders, device boot access to restore those reminders, camera or photo access when you choose to scan a receipt or select a circle cover photo, and biometric authentication when you enable App Lock. Finance Universe does not request contacts, call logs, microphone, or precise device location. Optional Android SMS access is described in section 5.

9. Security and retention

Local data remains until you delete it, reset the app, or uninstall it, subject to operating-system backup behavior. Cloud snapshots remain until you remove them or an enabled retention policy removes them. Encryption protects backup contents in transit and at rest; you remain responsible for safeguarding your recovery passphrase or emergency key. Purchase history is retained by Google Play and RevenueCat according to their policies and applicable recordkeeping requirements.

10. Children

Finance Universe is intended for people aged 18 and over and does not knowingly solicit personal information from children.

11. Changes

This policy may be updated when features or legal requirements change. The effective date above will be revised when material changes are published.

12. Contact

Questions, privacy requests, and deletion requests: archer.supportdesk@gmail.com

Finance Universe homepage: https://financeuniverse.app/