Privacy Policy
Service: Simple Money Tracker ("Simple Money Tracker", "we", "us", "our")
Website: https://simplemoneytracker.com
Last Updated: 15/08/2026
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our website, web application, Telegram bots, and related services (collectively, the "Service").
Please read it together with our Terms of Use, Cookie Policy, Acceptable Use Policy, and DMCA Policy.
Plain-language summary: We operate a Zero-Knowledge vault for your financial records. We can see account and billing metadata (email, name, subscription status). We cannot read your encrypted expenses, notes, messages, or files. Some optional features you turn on — AI, Telegram logging, weather, analytics — send limited data to third-party processors. We do not sell your personal information and we do not connect to your bank.
By creating an account, accepting this policy in the app, or continuing to use the Service after an update, you acknowledge that you have read this Privacy Policy.
1. Who We Are (Data Controller)
Simple Money Tracker is a personal-finance record-keeping service operated by Simple Money Tracker.
For privacy purposes, Simple Money Tracker is the data controller of Administrative Data described below. For Vault Data, we store ciphertext on your behalf; we do not have the keys needed to interpret that content.
Contact for privacy requests: support@simplemoneytracker.com
We have not appointed a separate Data Protection Officer. Privacy requests go to the contact above.
This policy is written to meet the information duties in:
- the EU General Data Protection Regulation (GDPR)
- the UK GDPR
- Vietnam Decree 13/2023/ND-CP on personal data protection
- applicable US state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA)
2. Scope of This Policy
This policy covers personal data processed when you:
- visit public pages on simplemoneytracker.com
- create or sign in to an account (email/password, Google, or passkey)
- use the web app, including the Zero-Knowledge vault
- use optional features (AI, Telegram bot, weather, currency converter, notifications)
- purchase or manage a Pro subscription
- contact support, or submit a review, feedback, or suggestion
It does not cover independent third-party sites or apps that we link to (for example PayPal checkout, Google account settings, or Telegram). Those services have their own policies.
We do not offer bank linking, open-banking access, or payment initiation. The Service is a record-keeping and productivity tool, not a bank or financial advisor.
3. Zero-Knowledge Security Architecture
When the vault is enabled, sensitive content is encrypted on your device before it is uploaded. Encryption keys are derived from your Master Password (or unwrapped by a passkey PRF secret). We do not receive your Master Password, Recovery Mnemonic, or Data Encryption Key (DEK) in usable form.
3.1 What we cannot read
When Zero-Knowledge is enabled, we cannot access the plaintext of:
- expenses, budgets, debts, lending records, goals, recurring subscriptions, and investments
- contacts and notes
- private 1-1 messages (ECDH) and group expenses / board messages (per-group keys)
- files and thumbnails you encrypt before upload
We store ciphertext, initialization vectors, and related metadata. Ciphertext is unreadable without your keys.
3.2 Two data categories
| Category | What it is | Our access |
|---|---|---|
| Vault Data | User-generated financial and personal content encrypted on-device | No plaintext access |
| Administrative Data | Account, security, billing, usage, and preference data needed to run the Service | We can access |
Some profile fields (for example display name, currency, timezone, language, and UI preferences) are Administrative Data even if you also store encrypted content.
3.3 Cryptographic design
We use widely reviewed standard algorithms (not a proprietary cipher):
| Mechanism | Use |
|---|---|
| PBKDF2-HMAC-SHA-256 (600,000 iterations) | Derive a Key Encryption Key (KEK) from your Master Password |
| AES-256-GCM | Encrypt Vault Data, files, and thumbnails |
| ECDH P-256 + AES-256-GCM | End-to-end 1-1 messaging |
| RSA-OAEP 2048-bit (hybrid) | Group key distribution and the Telegram envelope |
Key hierarchy (simplified):
Master Password (never sent to our servers)
└── PBKDF2 (600k iterations)
└── KEK (may be cached locally on your device)
└── wrapped DEK (stored encrypted)
└── Vault Data, files, message keys
Recovery Mnemonic (12 words) can reconstruct the Master Password.
Passkey PRF can unwrap the DEK for unlock without typing the password.
These algorithms are public standards. This policy does not claim that our product implementation has been independently audited end-to-end.
3.4 Recovery and irreversible loss
- We cannot reset your Master Password.
- If you lose the Master Password, you must use the Recovery Mnemonic created when the vault was set up.
- If you lose both the Master Password and the Recovery Mnemonic, encrypted Vault Data is permanently unrecoverable. We cannot restore it.
- Store the Recovery Mnemonic offline (paper or another method you control). Do not send it to us.
3.5 When Zero-Knowledge does not apply
Zero-Knowledge does not hide:
- Administrative Data listed in Section 4
- profile photos / avatars (stored as ordinary files, not vault-encrypted)
- content you voluntarily send in plaintext to AI, Dialogflow, support, reviews, or Telegram (see Sections 6 and 7)
- data on your own device (browser storage, screenshots, unlocked session)
Legacy (non-ZK) accounts or files uploaded without client-side encryption may be readable by the Service. Enable and use the vault for content you want protected.
4. Information We Collect
We collect only what we need to operate, secure, and improve the Service. You are not legally required to provide personal data, but we cannot create an account or provide the Service without basic account information.
4.1 Information you provide
| Type | Examples | Notes |
|---|---|---|
| Account | Email, display name, profile photo | From sign-up, Google sign-in, or profile edits |
| Authentication | Email/password (handled by Firebase Authentication), Google OAuth, passkeys (WebAuthn), TOTP 2FA status, trusted-device records | We do not see your Google password. Firebase Authentication stores a password hash if you use email/password. We do not store your TOTP secret in plaintext for ordinary use. |
| Preferences | Currency, timezone, language, theme, date format, sidebar and UI settings | Needed to render the app |
| Birthday | Optional date of birth | Encrypted by default. If you opt into the birthday program, we may store a server-readable next-gift date so we can send a yearly greeting. |
| Telegram link | Telegram user ID after you complete linking | Pro feature; optional |
| Support and community | Emails, reviews, feedback, suggestions | We can read what you send |
| Privacy acceptance | Acceptance flag, policy version, acceptance time | Stored so we can show the current policy and prove consent |
4.2 Information collected automatically
| Type | Examples | Why |
|---|---|---|
| Security and abuse prevention | IP address, device/browser signals, Firebase App Check / reCAPTCHA Enterprise tokens, rate-limit counters | Keep the Service safe |
| Session and device | Current session ID, recent login history, FCM web-push token and user-agent | Single-session policy, sign-in security, notifications |
| Usage counters | AI, currency-converter, review/feedback quotas and last-used dates | Enforce free/Pro limits |
| Storage usage | Total bytes used | Enforce quotas |
| Cookies / local storage | Consent cookie, theme, vault cache, IndexedDB sync cache | See Cookie Policy and Section 4.6 |
| Analytics (optional) | Pages viewed, events, approximate location from IP, device/browser type via Google Analytics | Only after you allow analytics cookies, where required |
Server and infrastructure logs may include IP address, request path, and error diagnostics for a limited time.
4.3 Information from third parties
| Source | What we receive |
|---|---|
| Google (if you sign in with Google) | Name, email, profile photo, and authentication tokens Google provides |
| PayPal | Subscription/payment status, order and transaction reference IDs, amount/currency/status needed to activate Pro. We do not receive your full card number or bank password. |
| Telegram | Message content and Telegram user/chat identifiers when you message our bot (see Section 7) |
4.4 Vault Data (ciphertext we cannot read)
If Zero-Knowledge is enabled, the following is encrypted on your device before upload:
- financial records and related notes/categories you store in the vault
- contacts, notes, encrypted files and receipts
- private and group messages
We store the ciphertext. We cannot decrypt it for support, export, or legal requests.
4.5 Location data (optional, not always collected)
We do not continuously track your location and we do not use location for marketing.
If you tap Detect location on Weather, the browser may share coordinates with:
- OpenStreetMap Nominatim (reverse geocoding to a city name)
- Open-Meteo (forecast for those coordinates)
You can deny or later revoke location permission in the browser. Searching for a city by name sends only the search text to Open-Meteo geocoding.
4.6 Data stored on your device
The Service uses cookies, local storage, and IndexedDB to:
- remember cookie choices (
sm_consent_status) - keep you signed in via the Firebase Auth SDK in IndexedDB (not a session cookie)
- cache decrypted records for speed after you unlock the vault
- cache a KEK/unlock helper locally (up to about 30 days, under your control)
- keep a DEK only in memory during an unlocked session
Anyone with unlocked access to your device can see local data. Lock the vault and protect the device.
5. How We Use Information and Legal Bases
We use personal data only for the purposes below.
| Purpose | Typical data | Legal basis (GDPR / UK GDPR / Decree 13 analogue) |
|---|---|---|
| Create and maintain your account | Email, name, auth identifiers | Contract |
| Provide the app, sync, and vault storage | Administrative Data; Vault ciphertext | Contract |
| Billing, trials, gifts, and Pro entitlements | PayPal references, subscription fields | Contract; legal obligation (tax/accounting where applicable) |
| Security, fraud prevention, rate limits, App Check | IP, device signals, session IDs | Legitimate interests (secure the Service); legal obligation where required |
| Transactional email (security, billing, account) | Email address | Contract; legitimate interests |
| Push and in-app notifications you enable | FCM token, notification preferences, due-reminder job metadata | Contract; consent where required for browser push |
| Birthday greeting (only if you opt in) | Server-readable next-birthday date | Consent |
| Optional analytics | Analytics cookies / events | Consent where required; otherwise legitimate interests |
| Optional weather / city search | Coordinates or city name | Consent (you initiate the request) |
| Optional currency conversion | Currency pair and amount | Contract / legitimate interests |
| Optional AI features you invoke | Text, receipt image, or structured fields you send | Contract; consent for any extra disclosure to the model provider |
| Optional Telegram logging | Telegram IDs and message text | Contract; you initiate the message |
| Handle support, reviews, feedback | Content you send | Legitimate interests; contract |
| Enforce Terms, AUP, and DMCA | Account metadata; reports | Legitimate interests; legal obligation |
| Show and record privacy acceptance | Policy version and timestamp | Legal obligation; contract |
| Comply with law and defend legal claims | Administrative Data | Legal obligation; legitimate interests |
Legitimate interests we rely on include: keeping the Service secure, preventing abuse, debugging outages, understanding aggregate product use from Administrative Data, and communicating service-critical messages.
Vault Data: we do not process plaintext Vault Data on our servers. Client-side encryption and decryption happen on your device.
Sensitive data (Vietnam Decree 13 / special-category analogues): financial records can be sensitive. We store them as ciphertext you control. We only process plaintext financial-like content when you send it to an optional feature (AI, Telegram, support).
You may withdraw consent at any time (cookie settings, browser permissions, in-app toggles, unlinking Telegram, or contacting us). Withdrawal does not affect processing already completed.
6. Artificial Intelligence
Optional AI features are powered by Google models via Firebase Genkit, Google AI / Gemini, and Vertex AI. A separate Dialogflow CX agent may answer product FAQ questions.
6.1 What is sent
AI does not crawl your vault. Encrypted data is decrypted on your device. Only the payload you submit for that feature is sent, for example:
- natural-language expense text
- a receipt image you upload for scanning
- note text you ask to format
- financial-coach inputs (we aim to send minimized / de-identified fields, not your full identity)
- Telegram message text (see Section 7)
- Dialogflow chat text
Requests are sent over HTTPS and processed by Google to return a result. We use the output to provide the feature you asked for (for example, a draft expense).
6.2 What we do not do
- We do not use your prompts or financial content to train our own public models.
- We do not sell AI inputs.
- AI suggestions are informational. They are not solely automated decisions with legal or similarly significant effects (see Section 17).
Google processes data under its own terms and privacy policy. Do not paste card numbers, PINs, government IDs, or passwords into AI or chat fields.
7. Telegram Bot
Linking Telegram is optional and intended for Pro users.
- You start linking in the app. We store a short-lived verification and, after success, your Telegram user ID.
- When you message our bot, Telegram delivers the plaintext message to our webhook.
- We may send that text to AI to parse an expense.
- We then encrypt a structured envelope with your public key and store it temporarily. The client later decrypts it and re-encrypts it into your vault.
Important: for the short period between Telegram delivery and envelope encryption, our servers (and Telegram) can see the message text. Do not send secrets through the bot.
Unlinking removes the Telegram mapping we control. Telegram keeps its own copies according to Telegram's policy.
8. Cookies and Similar Technologies
We set few first-party cookies: a consent record (sm_consent_status), an in-app sidebar preference, and — only if you allow it — Google Analytics. We do not use cookies to keep you signed in. Sign-in uses IndexedDB / local storage (Firebase Auth and a device session id).
Details, a cookie inventory, and similar technologies are in the Cookie Policy. You can reopen analytics preferences from Cookie Settings in the website footer.
Where required, analytics cookies are set only after consent. The consent record is stored in the sm_consent_status cookie (choice, timestamp, version) for about 12 months.
9. Sharing and Subprocessors
We do not sell personal information. We share data only with processors who help us run the Service, or when the law requires it.
| Recipient | Role | Data typically involved |
|---|---|---|
| Google LLC (Firebase Auth, Firestore, Storage, App Hosting, Cloud Functions, FCM, App Check / reCAPTCHA Enterprise, Analytics, Vertex AI / Gemini, Dialogflow CX) | Hosting, auth, database, files, push, abuse prevention, optional analytics and AI | Administrative Data; Vault ciphertext; optional analytics/AI payloads |
| PayPal | Subscription payments | Payment and subscription references |
| Telegram FZ-LLC | Bot message delivery | Telegram IDs and messages you send the bot |
| Zoho / ZeptoMail | Transactional email | Email address and email content |
| Upstash (Redis) | Rate limiting and short-lived cache (OTP/passkey/Telegram helpers) | Identifiers and short-lived security tokens — not Vault plaintext |
| Open-Meteo | Weather and city search | City name or coordinates you request |
| OpenStreetMap Nominatim | Reverse geocoding | Coordinates if you detect location |
| ExchangeRate-API | Currency conversion | Currency pair and amount |
Google Firebase stores Vault ciphertext but does not receive your DEK.
We may also disclose Administrative Data:
- to professional advisers under confidentiality
- if we transfer the Service (merger or asset sale), with notice where required
- when required by a binding legal request (see Section 12)
Other users see only what you choose to share (for example a group you join, or a 1-1 message). Group members can decrypt shared group content with group keys.
10. International Transfers
We are operated from Vietnam and use infrastructure that may process data in the United States, the EU/EEA, and other countries (especially Google and PayPal).
Where a transfer leaves your country, we rely on appropriate safeguards available from our providers, which may include Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful transfer tools, together with Decree 13 requirements that apply to us.
Vault ciphertext remains encrypted during transfer. That does not replace the need for transfer safeguards for Administrative Data.
11. Retention
We keep data only as long as needed for the purposes above, then delete or irreversibly anonymize it.
| Data | Typical retention |
|---|---|
| Active account Administrative Data | For the life of the account |
| Vault ciphertext | Until you delete the item or the account is purged |
| Soft-deleted account | 7-day grace period. You can cancel deletion by signing in and restoring. After 7 days, a scheduled job permanently deletes account data we control (profile, subcollections, storage prefixes, Telegram link, notification jobs, related content). |
| FCM tokens, sessions, trusted devices | Until replaced, expired, or you remove them / we clean invalid tokens |
| Redis / rate-limit / verification caches | Hours to days |
| Cookie consent | About 12 months, then you will be asked again |
| Analytics | Per Google Analytics retention settings |
| Support / review / feedback you sent | As long as needed to handle the request and keep a limited service record |
| Billing / subscription references | As long as needed for the subscription and for tax or accounting law (in some places up to about 7 years). These records do not contain plaintext Vault Data. |
| Security logs | A short operational period unless needed for an incident or claim |
Backup copies may linger for a short additional period after deletion until they rotate.
If you lose vault keys, we still delete ciphertext on the schedule above; we cannot turn it back into readable data.
12. Legal Requests and What We Can Disclose
We cannot decrypt Vault Data. We cannot produce plaintext expenses, messages, or encrypted files for courts, police, or support.
If we receive a binding request from a competent authority, we will:
- review it and challenge it where we reasonably can
- disclose only what we lawfully must — typically Administrative Data and/or unreadable ciphertext
- explain that we do not hold vault keys
We may share Administrative Data to prevent fraud, protect rights, or handle an emergency involving imminent harm, where the law allows.
13. Your Rights
Depending on where you live, you may have some or all of the following rights.
13.1 GDPR, UK GDPR, and Vietnam Decree 13
| Right | How it works here |
|---|---|
| Access | Administrative Data we hold; Vault Data as ciphertext only (we cannot provide a decrypted copy) |
| Rectification | Correct Administrative Data in Settings, or ask us. Edit Vault Data in the app. |
| Erasure | Use in-app account deletion (7-day grace, then purge) or email us |
| Restriction / objection | Object to processing based on legitimate interests, or to optional analytics/marketing |
| Withdraw consent | Cookie Settings, browser permissions, in-app opt-outs, unlink Telegram, or email us |
| Portability | Export decrypted Vault Data from the app on your device. We cannot export plaintext from the server. |
| Complain | See Section 20 |
Some rights do not apply to ciphertext we cannot interpret. We will say so clearly if that limits a request.
13.2 How to make a request
Email support@simplemoneytracker.com from the address on your account, or use in-app settings. We may need to verify it is you. We will respond within the time required by applicable law (generally one month under GDPR).
13.3 Right to object (please read this)
You have the right to object to processing based on legitimate interests, including optional analytics after you have consented or where consent is not required. Use Cookie Settings or email us. Essential security and account processing may continue where we have another lawful basis.
14. California and Other US State Rights
If you are a California resident (and where similar US state laws apply), you may have the right to know, access, correct, delete, and obtain a copy of personal information; to opt out of sale or sharing for cross-context behavioral advertising; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights.
We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics for advertising.
Categories we collect are described in Section 4 (identifiers, commercial/billing information, internet or device activity, approximate location if you use weather or analytics, and customer content). Sources are you, your device, Google, PayPal, and Telegram. Business purposes are listed in Section 5. Recipients are listed in Section 9.
To exercise these rights, email support@simplemoneytracker.com. You may use an authorized agent as the law allows.
15. Children's Privacy
The Service is for users 18 or older (or the higher age of majority where you live), as stated in the Terms of Use.
We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
16. Security
We use technical and organizational measures appropriate to a small SaaS handling encrypted financial records, including:
- HTTPS/TLS in transit
- client-side AES-256-GCM for Vault Data
- Firebase Authentication, optional 2FA, passkeys, trusted devices, and single-session controls
- Firebase security rules and owner checks
- App Check / reCAPTCHA Enterprise and rate limiting
- validation of server inputs
- least-privilege admin access
No method of transmission or storage is perfectly secure. A server breach should expose ciphertext for Vault Data, plus Administrative Data. Protect your Master Password, mnemonic, and device.
If a breach affecting Administrative Data is notifiable, we will inform you and the relevant authority within the time the law requires (including the GDPR 72-hour standard where it applies).
17. Automated Decision-Making
We do not make solely automated decisions that produce legal or similarly significant effects (for example, automated credit, employment, or insurance decisions).
AI categorization and insights are optional tools. You can ignore or edit the result. Subscription and abuse decisions may use automated signals (payment webhooks, rate limits) together with human review when needed.
18. Files, Avatars, and Your Responsibilities
- You keep ownership of content you upload.
- Vault files are encrypted on-device before upload. Avatars and any non-ZK uploads may be stored without vault encryption.
- Do not upload unlawful content or other people's data without a right to do so.
- We may remove content or suspend accounts that violate the Terms, AUP, or DMCA. For encrypted files we mainly rely on metadata, abuse patterns, and reports — we cannot inspect ciphertext.
19. Changes to This Policy
We may update this policy when the Service or the law changes.
The Last Updated date at the top is the version identifier. The app derives an acceptance version from that date. For material changes we will ask you to accept the new policy in the app before continuing, and we may also email you or show a notice.
Previous versions are listed on the Privacy Policy page under Policy History.
20. Complaints
If you are unhappy with how we handle your data, contact us first at support@simplemoneytracker.com so we can try to fix it.
You also have the right to lodge a complaint with a supervisory authority:
- Vietnam: the authority designated under Decree 13/2023/ND-CP and related guidance
- EEA: your local data-protection authority (where you live, work, or where you think the issue occurred)
- United Kingdom: the Information Commissioner's Office (ICO)
21. Contact
Email: support@simplemoneytracker.com
Website: https://simplemoneytracker.com
Summary
| Question | Answer |
|---|---|
| Can we read your expenses, notes, or vault files? | No, when Zero-Knowledge is on — we see ciphertext only |
| Can we read 1-1 / group messages in the app? | No — they are end-to-end encrypted |
| Can we read Telegram messages to the bot? | Yes, briefly, then we envelope-encrypt them |
| Does AI see the whole vault? | No — only what you send for that request |
| Do we sell personal information? | No |
| Do we link your bank? | No |
| What can we see? | Email, name, prefs, subscription, security/session data, optional analytics, and anything you send in plaintext |
| If I lose Master Password and mnemonic? | Vault Data is gone. We cannot recover it |
| How do I delete my account? | In-app deletion, 7-day restore window, then permanent purge |
Policy History
- 2026-08-15 — Current Policy
- 2026-04-27 — Previous Policy
