Take everything with you
Export all your data as a file at any time, even without a plan, or keep a passphrase-protected backup file.
Privacy and security
Built so we can't read your money.
Sign in once with email or Google, and ControlExpense works fully offline after that. If you choose sync, your data is locked on your phone first, with a key that never reaches us.
Read the privacy noticeLayer by layer
What protects what.
Encrypted database
Your ledger is stored in an encrypted database. Its key lives in your phone's hardware-backed keystore, and the database is kept out of cloud phone backups.
App lock
A PIN (stored only as a slow, salted hash) and fingerprint or face unlock, locking after the time you choose. A decoy PIN can open a clean app.
SMS stays on the phone
Messages are parsed on the phone. Only the amount, account, method and merchant are kept. Messages from people are only checked for fake bank alerts.
End-to-end encrypted sync
Each record is encrypted on your phone (XChaCha20-Poly1305), padded so sizes give little away, and stored under a random id. The server can't tell a rent payment from a chai.
Adding a phone
A new phone gets the key only when you approve it on a phone you already have, using a short code that works once.
Recovery key
Shown once, kept by you. If you lose every phone and this key, synced data can't be recovered, by you or by us. That's the point.
Plainly
What our servers can and can't see.
Without sync, our server knows your email and your plan, nothing more. With sync on, this is the full list.
- Your transactions, accounts, notes, photos
- Encrypted records we cannot open, with their sizes rounded up and their timestamps.
- Your bank SMS
- Never sent. Not encrypted, not hashed: simply never leaves the phone.
- Your voice
- Never sent by ControlExpense. The offline model runs on the phone.
- Your email and password
- Your email, to sign you in and send password reset codes. Your password is stored only as a slow, salted hash, never as text. Reset codes are hashed and expire in 5 minutes.
- Your subscription
- Whether Pro is active, from Google Play through our billing provider.
- Crash reports
- If you leave them on: the error and device model, with amounts, account numbers, UPI IDs and emails removed first. You can turn them off.
- Ads, analytics, trackers
- None. There is no advertising ID and no analytics SDK in the app.
Delete everything
Delete your account in the app or on the web. Records, devices, sessions and subscription links are removed; only an anonymous receipt remains.