Your ledger is not our data.

Applies to both the Play and Expert editions. Last updated 17 October 2026.

What the developer collects

Nothing. The app has no user accounts and no developer-operated service that receives your ledger, receipts, balances, search history, or credentials.

There are no analytics, telemetry, crash-reporting, advertising, attribution, or tracking SDKs in either edition. Nothing is sold, so there is no billing library, licence server or phone-home check.

Data on the device

Ledger files, financial information, documents and receipt photos, in-app searches, and remote credentials remain local unless you start a transfer described below.

Camera originals wait in the app's cache while you put a document together and are deleted once it is filed. Pages you abandon stay there until you discard them or Android clears the cache.

Project data lives in app-private storage protected by Android's device encryption and device lock. Widgets can be set to show a label and a time but no figures, and Android hides widget contents on the lock screen regardless.

Remote credentials and tokens are stored through Android Keystore, and are excluded from logs, backups, widget previews, and diagnostics.

When data leaves the device

There are two outbound code paths: the address entered for remote mode and, in the Expert edition only, downloading a plugin or an optional package when you ask for it. User-initiated sharing can also send a selected document to an app the user chooses.

Your Fava server

If you enter a remote Fava address, the app connects to that server. The configured origin is allowlisted exactly. External navigation requires confirmation and opens in the browser.

If the address uses https://, certificate errors are fatal and cannot be bypassed. The app never downgrades a failed HTTPS connection. If you explicitly type http://, the connection is unencrypted and can be read or modified on a hostile network, including credentials and entries. The app warns about this while the address is being entered.

Plugins and optional packages in Expert

The Expert edition can make network requests to download a plugin you choose to install from its list, from GitHub or the Python package index, and optional Python packages, from the Python package index or Chaquopy's index of Android builds (chaquo.com). Each download is checked against a recorded hash before it is unpacked. Nothing is downloaded unless you ask.

Updates

Neither edition checks for updates, and neither can install a package: no build requests the Android permission that would take. Play delivers updates for the Play edition. The Expert edition is installed from a file, so a new version arrives the way the first one did — you download it and open it, and Android refuses any file not signed with the key that signed the app you have.

Share on Wi-Fi

Incoming connections, off by default. If you turn this on in More → Share on Wi-Fi, other devices on the same private Wi-Fi network can open your Reports in a browser. It does not start until you start it. It listens only on the phone’s private network address, never a public one. It shows nothing until someone signs in with the username and password you set, it locks out repeated wrong passwords, and a notification is shown for as long as it is on. It stops when you tap Stop sharing, or from the notification. The connection is plain http://, which is not encrypted: anyone watching that network could read the pages while it is on, so use it only on a network you trust. Your password is kept only as a salted hash. Nothing about sharing is sent to the developer or to anyone else, and sharing makes no outgoing request.

Sharing a document

A document is shared only after the user chooses Share and selects another app. Android grants that app read access to the selected file rather than the project as a whole.

Diagnostics

Diagnostics remain on the device until the user chooses to share them. The report is a log of what the app did. Credentials, tokens and cookies are redacted, and it is shown on screen before you can share it. It can still contain file names and messages from the engine, so read it before you send it.

Permissions

• Camera: requested at the point of use for receipt capture.
• Internet: required even to open the local loopback socket used by on-device Fava, and used for the user-initiated network cases above.
• Notifications, foreground service and wake lock: used to show that a save, an install or sharing is still going after you leave the app. The wake lock has a timeout.
• Network state: used to find the Wi-Fi address when you share Reports.
• Run at start-up: added by the scheduler library so scheduled backups survive a restart. Nothing else uses it.

The app requests no broad storage permission, location, contacts, or account access. Files and folders you choose are reached through Android's folder picker (the Storage Access Framework).

No account deletion process

There is no account to delete. The developer cannot delete local data that the developer never receives.