PocketBudget: AI Money Manager — Privacy Policy

A.  Introduction

This Privacy Policy is published by Truthy Systems Ltd, a software company incorporated in Uganda. It governs how we collect, use, store, and protect your personal data when you use PocketBudget, our personal finance management application for Android and iOS.

PocketBudget helps Ugandan users track income and expenses, set budgets, manage debts, and gain AI-powered financial insights. This policy explains every data practice we follow in delivering that service.

By downloading or using PocketBudget you accept this policy. If you do not accept it, please uninstall the app and contact us to delete your data.

B.  Data We Collect

B1 — Information you provide

• Full name and email address — collected when you create your PocketBudget account via Google Sign-In or email registration.

• Profile photo — collected if you sign in with Google and your Google account has a profile picture; you may remove it at any time in Settings.

• Financial account names and balances — entered manually when you add a bank account, mobile money wallet, or savings account to the app.

• Income records — entered manually or parsed from your SMS inbox when you grant SMS read permission.

• Expense records and categories — entered manually or detected from SMS transaction notifications.

• Budget limits per category — set by you in the Budgets screen.

• Debt and IOU entries — contact names and amounts you enter in the Personal Ledger feature.

• Scheduled bill entries — bill name, amount, recurrence, and due date you enter in the Runway Planner.

• Customer support messages — any information you send us by email or through in-app feedback.

B2 — Information collected automatically

• Device identifier and model — collected at app launch for crash reporting and to associate your session with your account.

• Operating system version — collected for compatibility diagnostics via Firebase Crashlytics.

• App usage events — screens visited, features used, and session duration, collected via Firebase Analytics to improve the product.

• Crash logs and stack traces — collected automatically when the app crashes, via Firebase Crashlytics.

• Advertising identifier (Android Ad ID / iOS IDFA) — collected by Google AdMob to serve contextually relevant advertisements. You can reset or disable this in your device settings.

• Firebase Cloud Messaging token — generated automatically to enable push notifications for bill due-date reminders and financial alerts.

• IP address — collected by Firebase when your device communicates with our backend; used for security monitoring only.

B3 — SMS data

PocketBudget requests permission to read your device SMS inbox to detect mobile money and bank transaction notifications. We read SMS messages locally on your device. We extract only the transaction amount, date, description, and sender code. We do not upload raw SMS message text to our servers. Extracted financial data is uploaded to your personal Firestore document, which is accessible only to you.

C.  How We Use Your Data

D.  Data Sharing

We share your data only with the service providers listed below. Each provider is bound by a data processing agreement. We share the minimum data necessary for each service to function.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

E.  Data Retention

We keep your data only as long as necessary for the stated purpose or as required by Ugandan law. The table below states exact retention periods.

When you delete your account, we initiate deletion of your Firestore data within 24 hours. Backups containing your data are purged within 30 days. Some anonymised, aggregated data derived from your usage may persist in analytics systems; it cannot be linked back to you.

F.  Your Rights

Under the Uganda Data Protection and Privacy Act 2019, and where applicable the EU General Data Protection Regulation (GDPR), you have the following rights. We respond to all requests within 30 days.

G.  Security

We implement the following technical and organisational measures to protect your data:

• Encryption in transit: All data transmitted between the app and our servers uses TLS 1.2 or higher.

• Encryption at rest: All data stored in Firebase Firestore and Firebase Storage is encrypted at rest using AES-256 by Google.

• Authentication: Firebase Authentication manages user sessions. We support Google Sign-In (OAuth 2.0) and email-password authentication with secure password hashing.

• Database access rules: Firestore Security Rules enforce that each user can only read and write their own data. No cross-user data access is possible at the database level.

• API security: All Firebase Cloud Functions require authenticated Firebase ID tokens. Unauthenticated requests are rejected.

• SMS data handling: SMS content is processed locally on your device. Only extracted financial figures — not raw message text — are uploaded.

• Least privilege: Our engineering team accesses production data only through audited Firebase console access with multi-factor authentication enabled.

• Dependency monitoring: We monitor our Flutter and npm dependencies for known vulnerabilities and apply security patches within 14 days of disclosure.

Breach notification

Despite these measures, no system is 100% secure. If we discover a data breach that is likely to result in a risk to your rights or freedoms, we will notify you and the relevant authorities within 72 hours of becoming aware of it. We will contact you at the email address registered to your account.

H.  Contact Information

For all privacy queries, data requests, or concerns, contact our Data Protection Officer:

I.  Cookies and Tracking (Web)

PocketBudget is primarily a mobile application and does not use cookies in the core app. If you access any Truthy Systems web interface (such as the admin panel or data deletion portal), the following cookies may be set:

You can disable non-essential cookies via your browser settings. Disabling analytics cookies does not affect your ability to use any Truthy Systems web interface.

J.  Children's Privacy

PocketBudget is not directed at children under 13 years of age. We do not knowingly collect personal data from users under 13.

If you are a parent or guardian and believe your child under 13 has created an account, contact us at privacy@truthysystems.com and we will delete the account and all associated data within 72 hours.

Users between 13 and 17 may use PocketBudget with parental knowledge. We recommend that parents review this policy with teenage users.

K.  Changes to This Policy

We review this policy at least annually and whenever we make significant changes to how we process data. When we make material changes, we will:

• Display a prominent in-app notification banner at least 30 days before the change takes effect.

• Send an email notification to your registered email address.

• Update the "Effective Date" at the top of this document and increment the version number.

Minor changes — such as correcting typographical errors or updating contact details — may be made without advance notice but will always be reflected in an updated version number.

Continued use of PocketBudget after the effective date of any updated policy constitutes your acceptance of the updated policy.

You may always request the previous version of this policy by emailing privacy@truthysystems.com.