Short version: Your financial data never leaves your device unless you choose to share a trip. We read SMS only to extract transaction data — no SMS content is stored on our servers.
1. Who we are
Paisabook is a personal finance tracking application developed and operated by Zrise ("we", "our", or "us"), reachable at contact@zrise.in. This policy describes how the Paisabook Android application ("App") collects, uses, and protects your information.
2. Information we collect
2.1 SMS messages (on-device only)
Paisabook requests the READ_SMS and RECEIVE_SMS Android permissions to detect and parse financial transaction SMSes from your bank and wallet providers.
- SMS reading happens entirely on your device.
- We only process messages that match known bank/wallet sender patterns (e.g., HDFCBK, SBIINB, GPay).
- Raw SMS message text is never uploaded to our servers or any third-party service.
- Only the structured data extracted from an SMS (amount, merchant, date, transaction type) is stored — in a local SQLite database on your device.
2.2 Account information (if you sign in)
Paisabook offers optional Google Sign-In for features like trip sharing. When you sign in:
- We receive your email address and display name from Google.
- This information is stored in Firebase Authentication (a Google service) and used only to identify you within the app and shared trips.
- We do not receive or store your Google password.
2.3 Trip expense data (only when you share a trip)
When you create a shared trip and invite other users:
- Trip name, member emails, and expense records (amount, description, date, payer, split) are synced to Firebase Firestore.
- This is opt-in — personal (non-trip) transaction data is never synced to the cloud.
- You can delete a shared trip at any time, which removes the data from Firestore.
2.4 Anonymous rule sharing (opt-in)
Paisabook can improve its SMS parsing for everyone by sharing anonymised, user-learnt rules with our servers — but only if you explicitly opt in from the app settings.
When you opt in, the app periodically uploads the following to Firebase Firestore (at most once every 24 hours):
- Category keywords — words or merchant names you have associated with a spending category (e.g., "Zomato → Food"). Category names and keywords only; no transaction amounts or dates.
- Merchant name corrections — normalised merchant name pairs you have corrected (e.g., "ZOMATO INTERNET → Zomato").
- Merchant extraction rules — pattern rules you have created to extract merchant names from specific SMS formats.
- Learnt invalid patterns — SMS structural templates (sender ID + anonymised message skeleton) that you have marked as non-transaction. Raw SMS text is never included; only a normalised skeleton with amounts and names stripped.
- Discovered SMS patterns — regex templates auto-generated from clusters of similar bank SMSes on your device. These contain sender prefixes and structural patterns, not message content or financial values.
- Unrecognised sender IDs — SMS sender IDs (e.g., "VM-NEWBNK") that the app has not yet classified, along with how many times they were seen. No message content is included.
What is never included: transaction amounts, account numbers, card numbers, merchant names from your actual transactions, raw SMS text, your name, email, or any device identifier.
This data is stored anonymously in the rule_submissions Firestore collection and is used only to improve Paisabook's SMS parsing rules for all users.
You can opt out at any time from Settings → Rule sharing in the app. Opting out stops future uploads; data already uploaded cannot be individually deleted (it is anonymous and not linked to your account).
2.5 Crash and diagnostic reports
We use Firebase Crashlytics (a Google service) to collect anonymous crash reports. These reports include device model, OS version, app version, and a stack trace of the crash. They do not include any financial data or SMS content.
2.6 Diagnostic data upload (development builds only)
During development and internal testing, the app includes a "Report a Problem" option that allows uploading diagnostic data to Firebase Firestore to help diagnose bugs. This feature is present only in debug builds and is not included in the version distributed on Google Play.
2.7 Information we do NOT collect
- We do not collect your bank account numbers, card numbers, PINs, or OTPs.
- We do not sell, rent, or share your data with advertisers or data brokers.
- We do not run analytics that track individual user behaviour beyond crash reporting.
3. How we use your information
We use the information described above for the following purposes:
- Transaction tracking — parsing SMS to extract and display your financial transactions.
- Categorisation & budgeting — grouping transactions into categories, computing budgets and summaries.
- Trip splitting — syncing shared trip data between invited members when you opt into the feature.
- Authentication — verifying your identity when you sign in.
- Crash diagnosis — identifying and fixing bugs to improve app stability.
4. Data storage and security
4.1 On-device storage
All transaction data is stored in an encrypted SQLite database on your device, managed by the Room persistence library. Access is restricted to the Paisabook app via standard Android app sandboxing.
4.2 Cloud storage (trips and rule sharing)
Trip data and anonymised rule submissions synced to Firebase Firestore are protected by:
- Firebase Security Rules that limit read/write access to authenticated trip members only.
- Google's encryption at rest and in transit (HTTPS/TLS).
4.3 Retention
On-device data is retained until you uninstall the app or delete it manually. Cloud trip data is retained until you delete the trip. If you delete your account, we will remove your Firebase Authentication record and any trip data where you are the sole owner within 30 days.
5. Third-party services
Paisabook uses the following third-party services. Each has its own privacy policy:
- Firebase Authentication — firebase.google.com/support/privacy
- Firebase Firestore — firebase.google.com/support/privacy
- Firebase Crashlytics — firebase.google.com/support/privacy
- Google Play Services — policies.google.com/privacy
6. Your rights and choices
- Revoke SMS permission — You can revoke the SMS permission at any time in Android Settings. The app will continue to work but will not automatically detect new transactions.
- Sign out / delete account — You can sign out or delete your account from within the app. On account deletion, we remove your authentication record and owned trip data.
- Export data — You can export your transaction data as a CSV from the app settings.
- Delete transactions — You can delete individual transactions or bulk-clear data from within the app.
- Access request — To request a copy of any personal data we hold, email us at contact@zrise.in.
7. Children's privacy
Paisabook is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
8. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via an in-app notification or by updating the "Last updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.
9. Contact us
If you have questions or concerns about this Privacy Policy or your data, please contact us at:
contact@zrise.in