PayCheck Privacy Policy

PayCheck is a personal-finance app for Android and iOS. Your transactions, balances, accounts, categories, goals and notes are kept in an encrypted database on your device. We, the developer, do not receive, store or have access to your financial history. Data reaches us only when you use an optional feature that needs it: a PayCheck account, Premium bought on Google Play, Support, App News polls, account deletion or the optional technical reports. Shared Finance moves the accounts you choose to share, end-to-end encrypted, through your own Google Drive and never through our servers. The free version shows Google AdMob ads; Premium removes them. The Android app sends crash reports and basic usage statistics to Google Firebase. We do not sell personal data and never use financial data for advertising.

The data controller for PayCheck is Vadym Rusnak, an individual developer based in Ukraine ("we", "us"). Contact for all privacy questions and requests: [email protected].

This policy covers the PayCheck apps for Android (Google Play) and iPhone/iPad (App Store), the PayCheck APIs on vados.dev that the apps call, the PayCheck pages on vados.dev (including the beta program and the account deletion page) and support communication. The rest of the vados.dev website is covered by the general site policy at /en/privacy-policy. Google, Apple and the other providers named below also process data under their own privacy policies, for example https://policies.google.com/privacy and https://www.apple.com/legal/privacy/.

PayCheck stores your financial records (transactions and amounts, accounts and balances, categories, goals, notes and reminders), your profile name and your app settings only on your device. The database is encrypted, and its key is protected by the Android Keystore or the iOS Keychain. Charts, analytics and reports are calculated on the device. We have no copy of this data. It leaves your device only if you choose to: export or back up a file, share accounts through Shared Finance (end-to-end encrypted), or type financial details into a support message yourself. Other features that work only on the device: the optional app lock uses your device's biometric or passcode check, and the result never leaves the device; reminders are local notifications; the camera (iOS) or the Google Play services code scanner (Android) is used only to read a Shared Finance pairing QR code, and the image is neither stored nor uploaded. On Android, PayCheck excludes its data from Android's automatic cloud backup. On iOS, the encrypted database can be part of the device backups that you make with iCloud or a computer.

You can use PayCheck without an account. An account is needed for some features, for example to activate Premium bought on Google Play and to manage or delete your server-side data. Sign-in is provided by Supabase (https://supabase.com/privacy). You can sign in with: - Google: Google confirms your identity and the app sends the resulting Google ID token to Supabase. Supabase stores your e-mail address, Google account identifier, name and profile picture URL from that token. - Sign in with Apple (iOS): Apple provides a user identifier and an e-mail address, which is an Apple relay address if you choose "Hide My Email". - E-mail and password: your e-mail address and a hash of your password. The plain password is never stored. For each account we also store a random 12-character PayCheck ID (shown in the app and used to verify deletion requests), the account's creation and last sign-in times and, on Android, the display name you enter in PayCheck. Supabase keeps technical authentication logs, such as sign-in events with IP address, for security. Session tokens are stored encrypted on your device. Signing out removes the session from the device but does not delete the server account, your local data or any Google Drive authorization. Signing in does not upload your financial history and does not by itself give PayCheck access to your Google Drive.

Payments are handled entirely by Google Play or the Apple App Store. We never receive your card number, bank details or billing address. Premium removes ads. Google Play (Android): buying Premium requires a PayCheck account. After a purchase, the app sends the purchase token and product ID to our server at vados.dev. The server checks the subscription with the Google Play Developer API and stores, linked to your account: product ID, subscription state, expiry date, order ID, a SHA-256 hash of the purchase token (not the token itself) and the subscription record returned by Google with all tokens removed. This record includes, for example, purchase and expiry times and the country or region of the purchase. Changes are kept in an entitlement history. The app also gives Google Play a one-way hash of your account identifier so that the purchase belongs to your account. App Store (iOS): StoreKit verifies purchases on your device, and PayCheck does not send App Store receipts or transactions to our server. If you are signed in, the app attaches your PayCheck account's internal identifier to the purchase as an App Store "app account token", so Apple's purchase record is associated with your account. Manage or cancel a subscription in your Google Play or Apple account. Deleting your PayCheck account or the app does not cancel a subscription.

The free version shows ads from Google AdMob (Google Mobile Ads SDK). For active Premium subscribers the app does not request ads. Before requesting ads, the app uses Google's User Messaging Platform (UMP) to ask for your consent where the law requires it, for example in the EEA, the UK and Switzerland. You can review or change your choice at any time in Settings → Ad privacy options (shown where it applies). Android: if you consent, or where consent is not required, Google may show personalised ads using your device's advertising ID. If you decline, Google shows non-personalised ads. You can reset or delete the advertising ID in Android settings. iOS: PayCheck requests only non-personalised ads, turns off the publisher first-party ID and does not ask for App Tracking Transparency permission, so the advertising identifier (IDFA) is not available to the app or to Google. On both platforms the Google Mobile Ads SDK collects data such as IP address (used to estimate an approximate location), device and app identifiers, ad interactions and performance and diagnostic data for ad delivery, frequency capping, measurement and fraud prevention, including for non-personalised ads. We never pass your transactions, balances, account data, e-mail or PayCheck ID to AdMob. How Google uses this data: https://policies.google.com/technologies/partner-sites.

Android: the app includes Google Firebase Crashlytics, Google Analytics for Firebase and Firebase App Check. - Crashlytics sends a report when the app crashes or hits an unexpected error: stack trace, device model, Android version, app version, a random Crashlytics installation ID and a few technical values we attach (app language, currency code and the result of the app's built-in security check). Error messages are redacted before sending, and reports never contain your financial records. - Google Analytics for Firebase collects automatic events (for example first open, app update, session start and in-app purchase) together with an app-instance ID and device and app information. It also records five custom events: onboarding completed, first transaction added, Premium purchased, Shared Finance created and bank import turned on. These events contain no amounts, names or account data. The advertising ID is collected only after consent has been given through the consent form described under Advertising. - The app also obtains a device-integrity token from Google Play, which we may use to tell genuine app installations from automated traffic. iOS: PayCheck contains no crash-reporting or analytics SDK. If you turn on "Share With App Developers" in iOS settings, Apple may share crash and usage data with us under Apple's terms. We use this data only to find and fix bugs, keep the app secure and understand overall usage. Google processes it as our service provider. Technical reports (optional, off by default). In Settings you can turn on "Send technical reports". When it is on, the app sends us short, structured records of technical events: app start, screens opened, error type and the code location where it occurred, whether a bank notification was recognised, operation durations, device model, operating system and app version, app language, and a random identifier created by the app for this copy. The name of the bank whose notification was (or was not) recognised is included only when you have turned technical reports on. The records have no fields for amounts, balances, account or category names, transaction descriptions, notification text, e-mail, name, PayCheck ID, backup contents, Shared Finance data, location or contacts, so such data cannot be included. The identifier is not linked to your account, to advertising or to crash reports, and it changes whenever you turn the setting off and on again. We keep these records for up to 60 days on our own server, do not back them up, and delete all records linked to your identifier within 24 hours when you use "Delete my reports" in the app. Turning the setting off stops sending immediately.

Shared Finance lets 2 people (up to 6 with Premium) see accounts that each member chooses to share. There is no PayCheck sharing server: each member's shared data lives in one file in that member's own Google Drive. How it works: - You connect a Google account and grant the "drive.file" permission. It lets PayCheck create and read only files that PayCheck created or that you explicitly open with the Google file picker; PayCheck cannot see any other files in your Drive. The Google access token is stored only on your device. - The app writes the accounts you choose to share (names, currencies, balances and transactions from the start date you choose, including amounts, dates, descriptions and categories), together with your display name, colour and Google e-mail address, into your Drive file. This content is encrypted (AES-256-GCM) and signed on your device with keys that are created and kept only on the members' devices. Google stores the file but cannot read its content. We never receive the file or the keys. - Your file is shared read-only with the other members' Google e-mail addresses through Google Drive permissions, without a Google notification e-mail. Each member confirms access once in the Google file picker. - Other members see your display name, colour and Google e-mail address and the accounts and transactions you share. Google can see that the file exists, its size and update times, its name (which contains your display name) and the Google accounts it is shared with. - Pairing uses QR codes shown and scanned between phones in person. They contain public keys, names, e-mail addresses and file identifiers and are not sent to us. Stopping and leaving: when you stop sharing an account, it is removed from your file at the next sync. When a member leaves or is removed, the group key is replaced and that member's access to the other members' files is revoked, so they cannot read future updates. A leaving member's file is emptied straight away and deleted from their Drive after 14 days. Anything another member's device has already downloaded stays on that device; we cannot delete it remotely. You can delete your file in Google Drive at any time and revoke PayCheck's access at https://myaccount.google.com/permissions. Google API Services: PayCheck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google Drive data is used only to provide Shared Finance to you. It is not used for advertising, not sold, not used to train AI models and not read by people, except with your explicit permission, for security purposes or to comply with the law.

On Android you can optionally turn on automatic import from bank notifications. It needs the system "Notification access" permission, which you grant and can revoke at any time in Android settings. PayCheck reads only notifications from a built-in list of supported banking apps and ignores all others. It extracts the amount, currency, description and time on your device and then adds a transaction or asks you to review it. Notification content is processed only on your device and is never sent to us or to third parties. When you review an imported bank operation, the original notification text is kept encrypted on your device only for up to 24 hours (or until the review is done) and is never sent anywhere. This feature is a beta, is available only in some regions and does not exist on iOS. PayCheck does not read SMS messages.

Exports (CSV, JSON, PDF, XLSX) and backups are created on your device and saved only where you choose through the system file or share dialog, for example device storage, a cloud drive, a messenger or e-mail. PayCheck never uploads them to us. Plain exports are not encrypted, and the app warns you before creating one. Password-protected backups are encrypted with your password. Scheduled automatic backups (Premium) contain the encrypted database and are kept on your device or in the location you choose. Encrypted backups also contain your Shared Finance keys so that a restore can continue your group. Once you save or send a file to another service, that service's terms apply, and you are responsible for deleting copies you no longer need.

The app downloads App News posts and currency exchange rates from vados.dev. If you vote in a poll, the app sends your choice and a random voter ID created by the app. The voter ID is used only to prevent duplicate votes and is not linked to your account, e-mail or financial data. Like any internet request, these requests show your IP address and app or device type (User-Agent) to our server and to Cloudflare; see "PayCheck website, beta program and server logs".

When you send feedback or an issue report from the app, we receive what you enter (rating, comment or issue description and severity), an e-mail address if you choose to give one, and technical details: platform, device manufacturer and model, operating system version and app version. Our server also records the IP address and User-Agent of the request to prevent abuse. The app never attaches logs, transactions, balances, account names or backup files. Please do not put financial details in your message. If you e-mail us, we receive your e-mail address and message. We use support data only to answer you and to improve PayCheck.

vados.dev runs on a virtual server we rent from Contabo in Europe and is delivered through Cloudflare (network and security). When the app or your browser contacts vados.dev, the web server and Cloudflare process your IP address, User-Agent, the requested address and the time. Web server and application logs on our server are rotated daily and kept for 14 days; Cloudflare handles its logs according to its own policy (https://www.cloudflare.com/privacypolicy/). The server also keeps short-lived rate-limit records keyed by IP address to block abuse. On PayCheck web pages we keep a security and statistics log (page views and security events with IP address, User-Agent, referrer and approximate country) and, when enabled, use PostHog analytics (EU cloud). The apps do not include PostHog. If you join the PayCheck beta program, we process the data you provide (e-mail, username, name, chosen testing areas, messages, bug reports and screenshots you upload) and registration details (IP address, User-Agent, device and approximate country and city) to run the program. E-mails we send (for example account deletion confirmations and beta notices) are delivered by Resend, and we keep a copy of each sent e-mail in our e-mail log.

Data on your device: delete records in the app or uninstall the app (on Android you can also clear the app's data). Delete exports and backups wherever you saved them. For Shared Finance, leave the group in the app and delete your file in Google Drive. PayCheck account: in the app, open Settings and use the account deletion option, or use the web page https://vados.dev/en/paycheck/account-deletion, which works without the app (you enter your account e-mail and your 12-character PayCheck ID). Either way, we e-mail a single-use confirmation link to your account address. The link is valid for 30 minutes, and nothing is deleted until you open it and confirm. When you confirm, we delete: your sign-in account at Supabase (e-mail, password hash, Google or Apple identifiers, name and picture URL), your PayCheck ID and profile, your synced display name and preferences, your Premium entitlement records and their history, beta-program data linked to the account (including bug reports and uploaded screenshots) and our stored copies of e-mails sent to your address. What we keep: a record of the deletion request (e-mail address, PayCheck ID, internal account ID, timestamps, a hash of the IP address and the User-Agent used to confirm) as proof that the request was handled; support messages that are not linked to your account (ask us and we will delete them); and short-lived security logs until they expire. Google and Apple keep their own purchase records. Data can remain in Supabase's daily backups until they are rotated out under Supabase's backup policy (https://supabase.com/docs/guides/platform/backups), and in our providers' logs until those expire. Deleting your account does not cancel a Google Play or App Store subscription, does not erase data on your device and does not delete your Google Drive file or data that another Shared Finance member has already downloaded. You can also remove PayCheck from your Google account at https://myaccount.google.com/permissions and, if you used Sign in with Apple, stop using your Apple ID with PayCheck in your Apple ID settings.

We keep personal data only as long as needed for the purposes in this policy. Where no automatic deletion period is configured, the table says so; you can always ask us to delete such data earlier.

- To provide the app and the features you choose (account, Premium, Shared Finance, support, account deletion): performance of our agreement with you. - Personalised ads and, where required, storing or reading information on your device for ads: your consent in the UMP dialog, which you can withdraw in Ad privacy options. - Non-personalised ads, crash reports, app statistics, security logs and rate limits: our legitimate interests in funding a free app, keeping it stable and secure and preventing abuse. You can object at any time (see "Your rights"). - Bank notification import, Google Drive access and the camera: your permission, which you can withdraw in system settings or by disconnecting. - Keeping deletion and privacy-request records: our legal obligations and the establishment or defence of legal claims.

We do not sell personal data. We share it only with providers that run parts of PayCheck for us, and only for that purpose: - Supabase: accounts and Premium records; - Google: Google Play and Play Billing, AdMob and UMP, Firebase Crashlytics, Analytics and App Check, Google Sign-In and Google Drive (Shared Finance); - Apple: App Store, StoreKit and Sign in with Apple; - Cloudflare: network delivery and security for vados.dev; - Resend: e-mail delivery; - Contabo: hosting of the vados.dev server (Europe); - PostHog: website analytics, when enabled. In Shared Finance, the members you pair with receive the data you choose to share. We may disclose data if the law requires it or to protect rights and safety. On Android, personalised AdMob ads may count as "sharing" for targeted advertising under some US state privacy laws. You can opt out by declining personalised ads in Ad privacy options or by deleting your advertising ID in Android settings.

We are based in Ukraine. Our account database (Supabase) is hosted in the West EU (Ireland) region, and the vados.dev server runs on a Contabo virtual server in Europe. Our providers may also process data in the European Union, the United States and other countries where they or their sub-processors operate; Google, Apple and Cloudflare run global infrastructure. Where data protection law requires it, transfers rely on adequacy decisions, the providers' standard contractual clauses or comparable safeguards.

Financial data is encrypted on your device; network connections use HTTPS; Shared Finance content is end-to-end encrypted and signed; purchase tokens and deletion links are stored only as hashes; server and administrator access is restricted. No system is completely secure, so please protect your device, your accounts and your exported files.

PayCheck is not directed at children under 13, or under the minimum age for digital consent in their country if that is higher. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Depending on where you live (for example under the GDPR, the UK GDPR or Ukrainian law), you can ask us to give you access to, correct, delete, restrict or transfer your personal data, object to processing based on our legitimate interests, and withdraw consent at any time without affecting earlier processing. E-mail [email protected]. We may ask you to show that you control the account, for example by writing from the account's e-mail address, and we answer within one month. Most of your data never reaches us, so you can also control it directly in the app, in Google Drive and in your store account. You can complain to your data protection authority; in Ukraine this is the Ukrainian Parliament Commissioner for Human Rights.

We update this policy when PayCheck or our data handling changes and show the new date at the top. For important changes we also tell you in the app or on this page.

Vadym Rusnak (PayCheck), Ukraine: [email protected]. Please never send passwords, backup passwords or full financial data by e-mail.