Privacy Policy

1. Overview

ExLog ("we," "us," "our," or "App") is an intelligent expense tracking application designed to help users manage their finances efficiently. We are committed to protecting your privacy and ensuring transparency about how we collect, use, and protect your personal information.

This Privacy Policy explains our practices regarding data collection and protection. By downloading and using ExLog, you agree to the terms outlined in this policy. If you do not agree with our practices, please do not use the App.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, password (encrypted), profile preferences
• Transaction Data: Manual transaction entries, category assignments, payee information, amounts, dates, notes
• Category Preferences: Custom categories, spending limits, notification preferences
• CSV Import Data: Historical financial data uploaded through our import feature

2.2 SMS Data

ExLog requests access to your SMS messages solely to automatically parse bank and UPI transaction notifications. We:

• Only read SMS messages from banking institutions and UPI service providers
• Extract transaction details (amount, payee, date, transaction type)
• Do NOT store, transmit, or share the raw SMS content to any external servers
• Process all SMS data locally on your device
• Allow you to control which SMS messages are imported

2.3 Device Information

• Device Type & OS: iPhone model, iOS version
• Location Data (Optional): GPS location only when explicitly enabled by you for transaction geo-tagging
• Crash & Performance Data: Anonymized analytics through Firebase Crashlytics
• Usage Analytics: App usage patterns to improve user experience

2.4 Automatically Collected Information

• Cookies & Local Storage: Authentication tokens, user preferences, cached data
• IP Address: For security, fraud detection, and service improvement
• Timestamps: When you access the App and perform actions
• Firebase Analytics: Anonymous usage data for improving the App

3. How We Use Your Information

We use the information we collect for the following purposes:

4. SMS Access & Privacy

4.1 SMS Processing

• All SMS parsing occurs locally on your device
• We extract only the transaction amount, payee name, date, and transaction type
• Raw SMS text is never transmitted to our servers
• You retain full control—permission can be revoked anytime in iOS Settings

4.2 What We Don't Do

• ❌ We never share SMS content with third parties
• ❌ We never use SMS data for advertising or marketing
• ❌ We never sell your financial data
• ❌ We never cross-reference SMS with other data for profiling

4.3 Your Control

Due to iOS privacy architecture, ExLog cannot directly read or extract SMS messages from your device. You are always in full control of how transactions are created:

• Manual Entry: You can add any transaction by entering the details yourself directly within the app.
• SMS Import (Copy & Paste): You can copy the body of a bank or UPI SMS message and paste it into ExLog. The app will parse the pasted text locally on your device and automatically fill in the transaction details.

No SMS data ever leaves your device. All parsing happens locally, and only the extracted transaction details (amount, payee, date) are saved to your account.

5. Data Security

5.1 Encryption

• In Transit: All communication with Firebase uses TLS 1.2+ encryption
• At Rest: Firebase Firestore encrypts data at rest using AES-256
• Local Storage: Sensitive data on your device is encrypted using iOS Keychain
• Password: Passwords are never stored; Firebase handles hashing with bcrypt

5.2 Access Controls

• Firebase security rules restrict access to your own data
• Multi-factor authentication (via Firebase Auth) for enhanced account security
• Staff access to data is restricted and logged
• Regular security audits and penetration testing

5.3 Limitations

While we implement industry-standard security measures, no system is completely secure. We cannot guarantee absolute security. We will notify you of any data breach affecting your personal information as required by law.

6. Data Retention

7. Third-Party Services

ExLog uses the following third-party services:

These third parties have their own privacy policies. We are not responsible for their data practices. Review their privacy policies before using ExLog.

8. Your Rights

8.1 Access & Portability

You have the right to access and export your personal data at any time. ExLog provides a built-in data export feature directly within the app — no need to contact us. You can download a copy of all your transactions and account data in a portable format instantly from within the App.

8.2 Correction & Deletion

You can update or correct your account information and transactions anytime within the App. To permanently delete your account and all associated data, navigate to More → Settings → Delete Account. Deletion is immediate and irreversible.

8.3 Opt-Out Rights

• Disable notifications in iOS Settings
• Revoke SMS/Location permissions anytime
• Opt-out of analytics through App Settings
• Unsubscribe from marketing emails

8.4 Regulatory Rights

If you are in the EU (GDPR), California (CCPA), or other regulated regions, you have additional rights including data access, erasure ("right to be forgotten"), and objection to processing. Contact us to exercise these rights.

9. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be announced through the App or via email to your registered address.

Your continued use of ExLog after changes become effective constitutes your acceptance of the updated policy. We recommend reviewing this policy regularly.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: