The short version
Your money stays on your phone. Transactions, amounts, balances, budgets and categories sit in a database on the device, never synced. There is no account and no login.
What is sent and why
Statement files. Your phone reads most statements itself. A file it cannot read goes to our server, with your category names, for Anthropic to read. Receipts too. It is held in memory only during the read.
Category suggestions. For rows no rule decides, the app sends a description of at most 120 characters, the direction, your currency and its country. Most names and long numbers are removed on the phone. It never sends the amount, date, balance, account or your name. Our server keeps none of it.
Your name and contacts. You can add a name, email and ways to reach you. You never have to. Each is stored against a random install id. The first time, our server sends your name or contact to the founder in a private Telegram message. It stays until you ask us to delete it.
Usage events. An event can carry your platform, app version, language and counts such as rows read. It never records amounts, merchants, descriptions or category names. Events carry your install id, so if you add a name, email or contact, we can link events to it. Events are on by default. Turn them off with Help improve Artos, on You, under Privacy.
Crash reports. A crash always sends the error, device model and OS version, with no switch. A crash also sends a short recording of the screen from just before it, with text and images blanked on the phone, best effort. Amounts, merchants and file names are stripped, best effort. Reports are never tied to your email, and the app does not send your network address to Sentry.
Who processes it
- Anthropic reads files and sorts rows.
- TypeSafe suggests categories.
- MongoDB Atlas holds everything our server keeps, including a record for each install (iPhone or Android, phone or simulator) and counts of reads with no content.
- Sentry receives crash reports.
- Render hosts our server.
- Telegram carries the message to the founder.
- Expo checks for app updates and sees your network address and an update id, never your money data.
- Company names from ACRA open data (Singapore Open Data Licence). Artos is not endorsed by ACRA.
Where it goes
Render runs our server in Singapore. Usage events are stored in Singapore. Anthropic, TypeSafe, Sentry and Expo process in the United States. Telegram can be outside Singapore.
Legal basis
We read a file you send, and suggest categories, to give the service you ask for. Crash reports and usage events rest on our legitimate interest in fixing and improving the app. You can turn usage events off. A name, email or contact rests on your consent, which you can withdraw at any time.
How long it is kept
Rows and file names go when your phone asks, or 15 minutes after last use, and never longer than an hour. Anthropic may keep the text for up to 30 days, and 2 years if it flags a policy breach. TypeSafe gives no fixed period. Your email, name and contacts stay until you remove them. Usage events stay until you ask us to delete them. To limit reads, we keep a one-way hash of your network address, never the address, for up to three days.
Your choices and rights
- Turn off usage events stops the app sending them.
- Remove your email, name or contact from our server. Usage events stay, and a copy the founder made goes when you ask.
- Delete all data wipes the phone database and removes your email from our server. A name or contact stays.
- Delete the app takes the database with it. Remove your email, name and contacts first.
- To see, correct or remove what is stored, email us. You can also complain to a data protection authority.
- Send feedback opens your mail app. The founder keeps your message.
Contact
Data protection contact: Dewa, dewa@artos.cash.