01Overview
Stash (known as Хабар in Russian) is a personal finance management app. It is designed with a privacy-first, offline-first architecture: your financial data lives on your device, encrypted, and is never sent to our servers — because we have no servers.
02Data You Provide
When you use the app you may enter:
- Financial transactions (amounts, categories, dates, merchants, comments)
- Budget periods, categories, and cashboxes
- Goals and scheduled contributions
- Manual exchange rates
All of this data is stored locally on your device in an encrypted database (SQLCipher with Android Keystore). It never leaves your device unless you explicitly export a backup file.
03Gmail Access
If you choose to connect your Gmail account, the app requests read-only access to your Gmail inbox via Google OAuth 2.0. This access is used solely to fetch financial alert emails (e.g. bank transaction notifications) and parse transaction details from them.
- We do not read, store, or transmit the content of non-financial emails.
- Fetched email content is stored locally on your device only, encrypted.
- Your Gmail OAuth token is stored locally on your device, encrypted with the Android Keystore.
- We do not share any Gmail data with third parties.
- You can disconnect Gmail at any time from the app’s Settings screen, which deletes the locally stored token.
Our use of Gmail data complies with the Google API Services User Data Policy, including the Limited Use requirements.
04Push Notification Access
If you grant Notification Access, the app can read push notifications from banking apps you explicitly select from a whitelist. This is used to parse transaction alerts from those apps.
- Only notifications from apps you have whitelisted are read.
- Notification content is stored locally on your device only, encrypted.
- You can revoke Notification Access at any time in Android Settings → Notifications → Notification access.
05Exchange Rate Data (Optional)
If you enable automatic exchange rate refresh (opt-in, disabled by default), the app contacts a public exchange rate API to fetch currency rates. No personal data is sent in this request — only a request for publicly available rate data.
06Google Play Billing
If you purchase a PRO subscription, the transaction is handled entirely by Google Play. We receive only a purchase confirmation token from Google Play to verify your entitlement. This token is stored locally on your device, encrypted. We do not operate a payment backend.
07Data We Do Not Collect
We do not collect:
- Analytics or usage statistics
- Crash reports
- Advertising identifiers
- Location data
- Any data sent to our servers (we have none)
08Data Storage and Security
All app data is encrypted on-device using SQLCipher (AES-256) with keys managed by the Android Keystore, bound to your device’s screen lock. Encrypted backup files are protected by a separate password you set at export time.
09Data Deletion
To delete all your data, uninstall the app. Uninstalling removes the encrypted database, all tokens, and all locally stored content. Any backup files you exported to your device storage must be deleted manually.
To disconnect Gmail and delete the stored token without uninstalling: Settings → Gmail → Disconnect.
10Children
This app is not directed at children under 13 and does not knowingly collect data from children.
11Changes to This Policy
If we make material changes, we will update the “Last updated” date above. Continued use of the app after changes constitutes acceptance.
12Contact
Questions or data requests: support@stashbudget.app