Threat model

This page summarizes how My Instincts: Expense Tracker thinks about risk. It is written for privacy-conscious users evaluating the app — not as a formal security audit.

What we protect

Your transaction history: amounts, merchants, accounts, and dates inferred from payment notifications on your phone.

What the app reads

Notifications from bank, UPI, and card apps via Android's notification-listener permission, which you grant and can revoke in system settings. The app does not request SMS permission. Non-payment notifications are not used for your spending log; specifics of which packages are parsed may change as banks update their apps — check in-app capture status for what is working on your device.

Where data lives

• In the app's private storage on your phone.
• No account, no sign-up, no company server holding your history.
• Google Play Data safety: no data collected or shared by the developer in the ordinary use of the app.

What can leave the device (only if you choose)

• Backup to your Google Drive or Files: Encrypted with a passphrase you set before upload. We do not hold your passphrase.
• Missed-alert report: Opt-in. The app shows you the payload before anything is sent. Contents depend on what you choose to include — review the in-app screen before confirming.
• CSV export (Pro): A file you save or share yourself.
• Pro purchase: Google Play Billing. Google sees purchase metadata; we do not receive your spending log through billing.
• In-App Review: May contact Google Play through the Store app when the app asks for a rating. No transaction data is included.

We do not claim the app never uses the network — only that your spending log is not uploaded to us by default.

Protections

• Optional app lock with PIN or biometrics.
• Local storage scoped to the app; protected by Android sandboxing.
• No third-party analytics or ad SDKs in the spending path.

Not protected against

• Someone with your unlocked phone while app lock is off (or while your device has no lock screen).
• Malware or another app with notification or accessibility access on the same device.
• Compromise of your Google account if you store an encrypted backup in Drive.
• Risks inherent to Google Play, Android, and your device OEM.

Verify it yourself

• Read the Play Data safety section for com.myinstincts.app.
• Read the privacy policy on this site.
• Use the app in airplane mode for everyday tracking — purchases and optional uploads aside.
• Revoke notification access in Android Settings to stop capture.

Contact

Security or privacy questions: support@corespaces.ae