Loading…
In short
Sollus is a local-first personal finance app. Your financial data is stored only on your device. We do not run a server, we have no accounts or sign-in, and we do not collect, transmit, sell or share your data. Everything the app shows — including Smart Insights — is calculated on your device.
Sollus (the "app") is developed and published by Ivan Kelesh ("we", "us", "our"). The app is distributed on Google Play under the package identifier com.ivankelesh.moneytracker. This policy also covers this website, https://money-control-website.vercel.app.
For the purposes of the EU and UK General Data Protection Regulation, we act as the data controller for any personal data you choose to send us directly — for example, an email to support. We are not a controller or processor of the financial data you record in the app, because that data never reaches us.
You can contact us at any time at support@kelesh.dev.
All of the following is stored locally, in your device's private app storage (IndexedDB and app files inside the operating system's application sandbox). None of it leaves the device unless you explicitly export it:
No identity is attached to this data. There is no account, no user ID, no device fingerprint and no advertising identifier. The app cannot tell one installation from another, and neither can we.
Nothing. The app collects no personal data and shares no personal data. This is what our Google Play Data Safety declaration states, and it is accurate.
Specifically, the app contains:
If any of this changes in a future version — for example if optional cloud backup is introduced — this policy and the Google Play Data Safety declaration will be updated before that version is released, and where the law requires it, you will be asked for consent first.
Smart Insights — the financial-health score, the plain-language summary and the spending observations — are generated entirely on your device using ordinary calculations over the transactions you have recorded.
No external AI service or API is involved. Your financial data is not sent anywhere in order to produce them, and no model provider receives any part of it.
The app requests the minimum set of Android permissions needed to function, and explicitly does not request the sensitive ones people expect a finance app to want.
| Permission | Why it is declared |
|---|---|
| INTERNET | Required by the WebView runtime the app is built on. All screens, fonts, icons and translations are bundled into the install, so the app works fully offline. It is used for exactly one thing: fetching public currency exchange rates (see section 6). No personal or financial data is ever transmitted. |
| POST_NOTIFICATIONS | Only so the app can show reminders you set yourself on a transaction. Android asks you for this the first time you create a reminder — never at startup. Decline it and the rest of the app is unaffected. |
| RECEIVE_BOOT_COMPLETED | Lets reminders you already scheduled survive a device restart. Without it, restarting your phone would silently cancel them. |
The app does not request storage or file-access permissions at all. Importing and exporting go through the system file picker and share sheet, which hand the app the one file you chose — it cannot browse your storage on its own.
It also does not request the exact-alarm permissions (SCHEDULE_EXACT_ALARM / USE_EXACT_ALARM). Android delivers reminders at its own convenience around the scheduled time, which is more than accurate enough for a payment reminder and avoids asking you for a sensitive permission we do not need.
The app does not request access to location, contacts, camera, microphone, SMS, call logs, phone state, calendar, health data, or any bank-account aggregation service. It has no background services and does not run when you are not using it.
The app integrates no third-party SDKs — no analytics, no advertising, no crash reporting, no attribution, no content delivery networks. It makes exactly one outbound request, described first below. Two further third parties are part of the overall picture, and you should know about them:
To be explicit about what this means for the promise we make: the exchange-rate lookup is the only way the app talks to the internet, and none of your financial information is part of it. Your transactions, balances, accounts, categories and notes never leave your device unless you export them yourself.
If we add optional website analytics in future, it will be a privacy-respecting, cookie-free product, and this section will name it before it goes live.
This website sets no advertising or tracking cookies and embeds no third-party trackers, social widgets or remote fonts.
It stores two small values in your browser, both purely functional and neither shared with anyone: your language choice, and your light or dark theme preference. Clearing your browser data removes both.
If you submit the contact form or subscribe to the newsletter, the email address and message you provide are used only to reply to you or to send the newsletter you asked for. You can unsubscribe from any newsletter email in one click.
The app can export your data as a CSV file or a complete JSON backup. These files are created on your device and are shared only where you choose to send them — saved to Files, passed to another app, or uploaded to a cloud drive you control — through the operating system share sheet.
Once you move an exported file somewhere else, it is governed by the terms of that destination rather than by this policy. We never receive these files and cannot read them.
The app can import a JSON backup, a CSV file, or a SQLite export from another money tracker that you provide. Import is performed entirely on your device.
The Android app deliberately opts out of Google's automatic cloud backup and device-to-device transfer (allowBackup is set to false). Your financial data is therefore never copied to Google's servers as part of a system backup.
The trade-off is that moving to a new device is a manual step: export a JSON backup from the old device and import it on the new one. We consider that the right default for a finance app.
The app sends no push notifications. It has no push service, no messaging SDK and no device token, so there is no channel through which anyone could send you anything.
It can show local reminders — but only for a transaction where you set a reminder yourself. These are ordinary device alarms scheduled by Android on your phone. Nothing about them involves a server, and nothing about them leaves your device.
Because a notification can appear on your lock screen, where anyone nearby could read it, reminders are deliberately vague. They tell you a scheduled transaction is due and nothing else — never the amount, the category, the account, or the note you wrote. The details stay behind your device unlock, where they belong.
Android asks for notification permission the first time you create a reminder, never at startup. If you decline, no reminders are shown and nothing else about the app changes. Deleting a transaction cancels its reminder.
Your data stays on your device for as long as you keep the app installed. You are in complete control of removing it:
Because we store nothing on our side, there is no server-side copy for you to request or for us to delete.
Emails you send us are retained only as long as needed to handle your query, and newsletter subscriptions until you unsubscribe.
Under the GDPR and similar laws you have the right to access, rectify, erase, restrict and port your personal data, to object to processing, and to lodge a complaint with your supervisory authority.
In practice these rights have an unusual shape here, because we hold almost nothing:
To exercise any right, email support@kelesh.dev. We respond within 30 days.
Where we process the limited personal data described above, we rely on the following legal bases: your consent, for newsletter subscriptions; our legitimate interest in responding to you, for support correspondence; and our legitimate interest in operating a secure website, for server request logs.
Your financial data is not transferred anywhere — it never leaves your device. Website hosting and email may involve providers operating outside your country; where that involves a transfer out of the EEA or UK, it is covered by the relevant standard contractual clauses or an adequacy decision.
The app is a general-purpose finance tool and is not directed at children. It collects no personal data from anyone, including children.
The strongest security property of this app is structural: there is no server to breach, no account to compromise and no central database of users to leak.
On the device, your data sits inside the app's private sandbox, protected by the operating system's application isolation and by your device's own full-disk encryption and screen lock. We strongly recommend keeping a device passcode enabled.
Files you export leave that protection. Treat a JSON backup as you would a bank statement.
We may update this policy to reflect new features or legal requirements. Material changes will be published here, with an updated "last updated" date, and — where they affect what the app does with data — reflected in the app and in the Play Data Safety declaration before the corresponding version ships.
Questions about this policy, or about how the app handles data: support@kelesh.dev. General support: support@kelesh.dev.
Questions about this document?
Email support@kelesh.dev and a person will answer.