Privacy Policy
PyaPya Tracker · Last updated 25 August 2026
PyaPya Tracker is a personal expense tracker. This policy explains exactly what
the app stores, where it goes, and how to get rid of it. It covers the Android app
published as com.tothemoon.expense_tracker.
What is stored on our servers
You need an account to use the app, because your records sync between the app and our server so they survive a lost phone. The server holds:
| What | Why |
|---|---|
| Your email address and password | To sign you in. The password is stored only as a cryptographic hash — it is never stored, transmitted, or visible to us in a readable form. |
| Your display name, if you set one | To greet you in the app. |
| Your transactions — amount, currency, income or expense, category, the optional note you type, and the date | This is the app. Without it there is nothing to show you. |
| Your categories — name, icon and colour | To label your transactions. |
| Your subscription status | To know whether ads should be hidden and premium themes unlocked. |
Each row is tied to your account and readable only by you. This is enforced by the database itself through row-level security, not only by the app.
What never leaves your phone
These are stored on the device and are not uploaded anywhere:
- Your profile photo. It is kept on the device only, which also means it does not follow you to a second phone or survive reinstalling the app.
- Your theme, language and currency choices.
- Your reminder setting and time. Reminders are generated on the device by the phone's own alarm clock; nothing about your spending is sent anywhere to produce them.
What the app does not collect at all
- No location.
- No contacts, call logs or messages.
- No analytics or behavioural tracking of how you use the app.
- No photos beyond the single image you deliberately pick as your profile photo, which stays on the device.
Who else is involved
- Supabase hosts the database and the sign-in system that store the data listed above, on our behalf.
- Google AdMob serves the ads shown to accounts without a subscription. Google receives device and advertising identifiers in order to do that, under Google's own privacy policy. Subscribers see no ads and no ad requests are made for them.
- Google Play handles subscription payments if you buy one. Your payment details go to Google; we never see or store a card number.
Your data is never sold, and it is never shared for advertising. The ad network is shown ad space, not your spending.
How long it is kept
Your records are kept for as long as your account exists. Delete the account and they are deleted with it — see below.
Accounts without a subscription can view the last three months of history in the app. Older entries are hidden, not deleted: they remain your data, they are still stored, and they reappear if you subscribe.
Deleting your account and data
In the app: Settings → Delete account.
Without the app: see Delete your account.
Either way, your account, your transactions and your categories are permanently deleted from the server. This cannot be undone, and we cannot recover them for you afterwards.
Your rights
You can see everything the app holds about you from inside the app, correct it by editing it, and delete it as described above. If you would rather have a copy or ask a question first, email the address below.
Children
The app is not directed at children under 13 and we do not knowingly create accounts for them.
Changes
If this policy changes, the date at the top changes with it, and any change that affects what is collected will be announced in the app before it takes effect.
Contact
Questions about this policy or about your data: pyapya@webtai.app