Privacy Policy

Last Updated: July 9, 2026

At Expinzo, your privacy is our core foundation. We build with an offline-first architecture, ensuring that your financial logs are processed on-device and remain under your direct control.

1. Data Collection & Local Storage

Expinzo stores your account logs, categories, settings, and transaction ledger records locally on your device in an encrypted SQLite database using the Drift database framework. This means that if you choose not to sign up for cloud sync, your financial data never leaves your physical phone.

2. Android SMS Parsing Permission

On Android devices, you may grant permission for the app to read incoming SMS messages. This permission is used exclusively for financial transaction alerts:

Local Processing: SMS message payloads are parsed entirely on-device using local string patterns and regex structures.
No Leakage: Your SMS text data is never sent to our servers or third-party APIs. Only the structured transaction outputs (merchant, amount, currency) are written to your local database.
Scope: Personal messages, private chats, or non-financial alerts are strictly ignored.

3. WhatsApp Webhook Logging

If you connect your WhatsApp number to our Meta-verified WhatsApp Business Integration:

Incoming messages containing transaction logs (e.g., "Lunch 450 INR") are forwarded by Meta to our secure webhook handler.
Our backend verifies your registered phone number, parses the transaction details using an automated extractor, writes the structured row to your private partition, and triggers a background sync to your mobile device.
Original chat text contents are deleted from our webhook cache immediately after parsing. We do not store transcripts of your conversations.

4. Camera & Gallery Permissions

We request access to your device's Camera and Photo Gallery to support:

Receipt Scanning: To snap photos of paper receipts and parse transaction items using local or secure cloud OCR extractors.
Screenshot Importing: To parse payment confirmations shared to the app via our custom Share Extension.

These permissions are optional and only activated when you trigger these actions.

5. Cloud Sync & Security

If you enable Cloud Sync, your database is backed up to our cloud partner, Supabase. Transactions are protected using Row Level Security (RLS) policies based on your authenticated Supabase user ID, ensuring no other user can read or write to your private partition. Authentication is securely managed using OAuth and encrypted secure storage tokens locally.

6. Contact Information

If you have any questions about this Privacy Policy, your user rights, or data exports, please reach out to us at privacy@expinzo.com.