BumuStudios·Türkçe sürüm·ImageToPdf policy·PdfPages policy

Who this policy is from

This policy covers the Android application PennyLeaf: Budget & Expenses (PennyLeaf), distributed through Google Play under the package name com.bumustudios.pennyleaf. It is written by the app's independent developer, BumuStudios. Questions can be sent to the address in Contact.

What the app does

PennyLeaf is an offline expense and budget tracker. You record expenses and income with an amount, a category, an optional note and a date; set monthly budgets per expense category; add recurring entries (daily, weekly, monthly or yearly); and see your month or year in an overview, reports with charts, and a searchable history. One currency of your choice is used for the whole ledger, with no exchange-rate lookups. You can export your entries to a spreadsheet (CSV) and save or restore a complete backup file. There is no subscription, and no feature is locked behind a payment.

Your financial data stays on your device

This is the most important section, so it is stated plainly:

• Your entries are never uploaded by the app. The app has no backend of its own. It does not transmit your amounts, categories, notes, budgets, recurring entries or currency to the developer, to the ad networks or to Google Firebase, and the usage statistics and crash reports described below never contain them: a crash report shows where in the code a crash happened, not your entries.
• No bank connection. The app never asks for bank, card or online-banking credentials, does not connect to any bank or financial service and does not read SMS or notifications. Everything in the ledger is what you typed in yourself.
• Export and backup go only where you choose. "Export to spreadsheet (CSV)" and "Back up" open Android's system file picker, and the file is written only to the location you pick there — your phone's storage or a cloud folder that you choose in the picker. "Restore from backup" likewise reads only the one file you pick. Through the picker, Android gives the app access to that single file and nothing else.
• No storage permission is requested on any Android version. The system file picker makes one unnecessary.

What the app stores locally

The app keeps the following in its own private storage on the device. None of it is sent to the developer or to any ad or analytics service:

• your ledger, in a database on the phone: entries (type, amount, category, note, date), categories (name, icon, colour), monthly budgets, recurring rules and the ledger's currency;
• your settings: theme, text size, language, currency choice and whether sounds are on;
• whether the one-time "remove ads" purchase is active, when a rewarded 24-hour ad-free period ends, and a counter of how many interstitial ads have been shown, used to keep ad frequency low.

Google's advertising and consent components also keep their own settings on the device, under Google's control, and the Google Firebase components described below keep three random identifiers in the app's private storage: a Firebase installation ID, the Analytics app-instance ID and a Crashlytics installation ID. Unlike the list above, these identifiers travel with the usage statistics and crash reports. Uninstalling the app or clearing its data removes everything the app has stored on the device, these identifiers included — apart from any copy in your own Android backup, described next, and any export or backup file you saved yourself.

Android backup

Because losing years of entries when changing phones is a real risk, the app takes part in Android's own backup — but only for the ledger and your settings. Its backup rules are an allow-list: they include exactly the ledger database and the settings file, for both Google cloud backup and device-to-device transfer. Everything else is left out on purpose: the purchase and ad-frequency state, the ad SDKs' data and your consent choices (which are gathered again on each device; the purchase is restored from Google Play).

• This copy is made by Android, not by the app, and only if backup is turned on in your phone's settings. It is stored in your own Google account under Google's backup service; the developer has no access to it.
• On Android 12 and later, if your phone has no screen lock, the ledger and settings are left out of cloud backup entirely, so they are never uploaded without the end-to-end encryption that a screen lock enables. Device-to-device transfer is not affected by this.
• You can turn Android backup off, or manage and delete backups, in your phone's settings and your Google account. When a backup exists, Android may restore your ledger when you reinstall the app or set up a new phone.

Your export and backup files

A CSV export contains, for every entry, its date, type, category, amount, currency and note. A backup file (JSON) contains the whole ledger: categories, entries, budgets, recurring rules and the currency. These files are not encrypted, and once saved they are yours: they are kept wherever you put them, under the rules of that location, and the developer never receives them. Restoring a backup replaces the data on the phone only after the file has been fully checked and you have confirmed.

Advertising — Google AdMob and its mediation partners

The app is free and is supported by ads served by Google AdMob (Google Ireland Limited / Google LLC, depending on your region). AdMob is embedded in the app as a software development kit, and it does collect data, independently of the developer. When ads are served, AdMob and Google's advertising partners may collect and process:

Mediation partners

The app also contains the software of six other ad networks, through AdMob mediation. For any ad request, AdMob may pass the request to one of these networks, which then serves the ad and receives the same categories of data listed in the table above (advertising ID, approximate location derived from the IP address, device information and ad interaction events). Each network handles that data under its own privacy policy:

• AppLovin — AppLovin Privacy Policy
• Unity Ads — Unity Game Player and App User Privacy Policy
• Liftoff Monetize (formerly Vungle) — Liftoff Privacy Policy
• Meta Audience Network — Meta Privacy Policy
• Mintegral — Mintegral Privacy Policy
• Pangle — Pangle Privacy Policy

The consent choices you make in the form described under "Your advertising choices" are passed on to these partners in the industry-standard format that they read.

What ad networks never receive

The app does not request GPS or precise location permission, and it does not add your entries, amounts, categories, notes or any other ledger content to an ad request: every ad request is made without keywords or content information from the app. The developer receives no personal data from AdMob or its partners — only aggregated, anonymous reporting such as impression and revenue totals.

Because ads require an advertising identifier, the app declares the com.google.android.gms.permission.AD_ID permission. Ad SDKs are started only after the consent step described below has finished.

Where ads appear

• Banner — one adaptive banner below the bottom navigation bar on the four main tabs (Overview, History, Budgets, Settings). There is no banner in the entry form, Reports, Categories, Recurring or About, and never inside a list.
• Interstitial — a full-screen ad that may occasionally appear when you leave the Reports screen after actually reading a report (the report had data and you stayed at least 12 seconds or worked with it). The first two such moments never show an ad, and two interstitials are always at least two minutes apart.
• Rewarded — optional: Settings → "24 hours without ads". If you choose to watch a rewarded ad, banners, interstitials and app-open ads stop for the next 24 hours.
• App-open — an ad that may appear when you return to the app, at most once every four hours, and never when you come back from something the app opened itself (the file picker, a purchase, the browser, the Play Store, your email app or a Play update).

No feature of the app is behind an ad.

How Google handles this data is governed by Google's own policies, not by this one:

• Google Privacy Policy
• How Google uses information from sites or apps that use our services
• AdMob and third-party advertising

Usage statistics and crash reports — Google Firebase

To see how the app is used and to find and fix crashes, the developer has built two Google Firebase services into it: Google Analytics for Firebase and Firebase Crashlytics. Google provides them as the developer's data processor, and they are active only in the version of the app distributed through Google Play. The app adds nothing of its own to what they collect — no custom events, no user ID or user properties, no custom keys or log messages — so only their automatic collection applies, and your entries are never part of it:

Analytics records that a screen was shown and for how long, not what you do on it, and a crash report shows where in the code the crash happened, not your content. Neither service receives your name, your email address, any account details or anything from your ledger.

In the EEA, the UK and Switzerland, the consent form described below under "Your advertising choices" also covers Analytics: your choices there decide whether Analytics may store its identifiers on your device and whether the data may be used for advertising. Use of the data for advertising ("ad user data") and for ad personalisation stays off there until you consent. You can change your choice at any time from Settings → Privacy options; the entry appears where it is required. The app has no separate switch for the usage statistics or the crash reports; uninstalling it stops both.

Analytics keeps data linked to an installation's identifiers for no longer than 14 months; aggregated reports that contain no identifiers may be kept longer. Crashlytics keeps crash reports for 90 days.

Google processes this data on the developer's behalf, as its data processor, under the Firebase and Google Analytics data processing terms. It may be processed on Google's servers outside your country, including in the United States, and it is encrypted in transit (TLS).

Google describes these services here:

• Privacy and security in Firebase
• Google Privacy Policy

Purchases and updates — Google Play

The app offers one optional, one-time, non-consumable purchase that permanently removes ads. There is no subscription and nothing recurring.

The transaction is handled entirely by Google Play Billing. The developer never sees or receives your card number, bank details, billing address or full name. Google Play reports only aggregated sales figures, and Google Analytics for Firebase records that a purchase was made — product, name and price, with no payment details (see above). Inside the app, the purchase is recorded as a single true/false flag on your device, restored from your Google Play account when you reinstall or move to a new device. Your handling of payment data by Google is covered by the Google Privacy Policy and Google Play's terms.

The app also uses Google Play's in-app update service to check whether a newer version is available and, if you accept, to download it. This check is made by Google Play and involves no data from your ledger.

Your advertising choices

If you are in the EEA, the UK or Switzerland

Before ads are requested, the app shows a consent form built with Google's User Messaging Platform, where you choose what you allow. Your choice is stored on your device by Google's component, is passed on to the mediation partners listed above, and is respected on later launches.

You can change your decision at any time: open the app, go to Settings → Privacy options, and the same form reappears. You may withdraw consent there. Withdrawing consent does not disable the app; you will still be able to use every feature, and ads may still be shown in a non-personalised form. The same choices also apply to Google Analytics for Firebase, as described above.

If you are in a US state with a privacy law

Where a US state privacy law gives you the right to opt out of the sale or sharing of personal information or of targeted advertising, the same Google consent tooling is used to offer that choice where applicable, and the Settings → Privacy options entry appears where it is required.

Everywhere else

The privacy options entry appears only where a consent choice is legally required, so you may not see it. You can still control advertising at the operating-system level: open Android Settings → Privacy → Ads (the exact path varies by manufacturer and Android version) to reset your advertising ID, or to delete it entirely, which stops apps from receiving a stable advertising identifier.

Removing ads completely

Buying the one-time ad removal stops ad requests from the app altogether. Watching the optional rewarded ad stops banners, interstitials and app-open ads for 24 hours.

Permissions the app requests

These are the permissions the app declares itself. The Google and ad-network components built into it may add a few more that Android grants at installation without asking you, such as Google Play's billing permission and Android's advertising-services permissions; but the app requests no storage, camera, contacts, SMS, microphone, location or account permissions on any Android version, and it shows no permission prompt at all.

Children

This app is a general-purpose utility. It is not directed at children under 13 (under 16 in the EEA, or the equivalent minimum age in your country), it is not listed in a children's category, and it is not designed for or marketed to children. The developer does not knowingly collect any personal information from children. If you believe a child has provided personal information through the ad, analytics or crash-reporting services in this app, contact the address below and contact Google, whose services would hold it.

Data retention

The developer runs no server and keeps no user data of its own, and never holds a copy of your ledger. The usage statistics and crash reports are held by Google on the developer's behalf: Analytics data linked to an installation's identifiers for no longer than 14 months (aggregated reports without identifiers may be kept longer), and crash reports for 90 days. Data held on your device stays there until you delete it in the app, clear the app's data or uninstall the app. A copy in your Android backup is kept under your Google account's backup settings, and export or backup files stay wherever you saved them until you delete them. Data collected by Google through AdMob and Google Play, and by the mediation partners, is retained according to their own retention schedules, described in their privacy policies linked above.

Security

Your ledger lives in the app's private storage, which Android keeps inside the app's sandbox, out of reach of other apps. Data sent to Google and to the ad networks is encrypted in transit. Export and backup files are plain, unencrypted files, so keep them somewhere you trust; anyone who can open such a file can read your entries. No method of storage or transmission is perfectly secure, but the app is designed so that your financial data has no route off your phone other than the ones you choose.

Legal bases and your rights

Where the GDPR (EU/UK) applies, the legal basis for personalised advertising is your consent, collected through the form described above and withdrawable at any time. Non-personalised advertising, fraud prevention and the security of the ad services rely on legitimate interests. Processing your purchase is necessary to perform the contract you enter when you buy ad removal. The usage statistics and crash reports rely on the developer's legitimate interest in keeping the app working and understanding, in aggregate, how it is used; storing Analytics identifiers on your device and any advertising use of the data follow your choices in the consent form. Your ledger is not processed by the developer at all.

Under the GDPR, and under Turkey's KVKK (Law No. 6698) on equivalent terms, you have the right to ask whether your personal data is processed, to access it, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent. You may also lodge a complaint with your national data protection authority — in Turkey, the Kişisel Verileri Koruma Kurumu (KVKK). Your ledger is already in your hands: you can edit or delete any entry in the app, take it with you through CSV export or a backup file, and erase it by clearing the app's data or uninstalling the app.

The usage statistics and crash reports are pseudonymous: they carry random identifiers, never your name or email address, so the developer cannot tell which records are yours. Where the consent form is shown, you can withdraw consent at any time in Settings → Privacy options, and you can object to this processing, or ask about it, by writing to the address below. Uninstalling the app or clearing its data ends the link to the old identifiers, and data already sent then expires on the schedule above. You can also reset or delete your advertising ID in Android's settings at any time. Requests concerning advertising data must be directed to Google or to the mediation partner that holds it, using the tools in their privacy policies linked above. For anything else, or for help finding the right route, write to the address below.

Changes to this policy

If the app's data practices change — for example if a new third-party service is added — this page will be updated and the "last updated" date at the top will change. Material changes will also be reflected in the app's Google Play listing. Continuing to use the app after an update means you accept the revised policy.

This is the first version of this policy, published with the first release of PennyLeaf.

Contact

For any question about this policy or about privacy in this app, write to: