Privacy Policy

Last updated: 7 September 2026

This Privacy Policy explains what information is processed when you use the Android application Fortuna: Money Tracker (the "App"), published on Google Play by Afflike OÜ ("we", "us", "our").

The App is an offline-first expense tracker. You record expenses, income and debts, scan receipts, view monthly statistics and pick a default currency and language. There is no user account. Your financial records are stored on your device and are never sent to us.

1. Who is responsible for your data

The data controller is:

Afflike OÜ is the developer named in the App's Google Play listing. For any privacy question or request, write to the email above.

2. Summary

• Your transactions, categories, notes, scanned receipt text and settings stay on your device. Receipt photos are deleted right after the amount is recognised. We have no server that receives them and we cannot see them.
• The App shows advertising. Advertising, analytics, crash-reporting and attribution SDKs built into the App receive technical data about your device and how you use the App, including your Android advertising ID where permitted.
• The App is for adults (18+).
• In the EEA, the UK and Switzerland you are asked for consent before advertising and analytics identifiers are used. You can change your choice at any time in Settings → Privacy options.
• The App does not ask for your name, email address, phone number, bank or card details, contacts or precise location.
• You can delete everything the App stores by clearing the App's data or uninstalling it.

3. Data that stays on your device

The App stores the following in its private storage on your device:

• transactions you enter (type, amount, currency, category, date, optional note);
• the text recognised from receipts you scan (the photo itself is deleted as soon as recognition finishes, see section 5.5);
• your default currency, language, notification and consent preferences.

This data is not transmitted to us or to any of the third-party services listed in section 5. Receipt text recognition runs entirely on your device (see section 5.5).

Android backup. Like most Android apps, the App participates in the Android backup service. If you have backup enabled in your device settings, Android encrypts the App's data and stores it in your own Google Account so it can be restored on a new device. This backup is operated by Google under your Google Account settings and is not accessible to us. You can disable it in your device settings (Settings → Google → Backup) or by turning off backup for the App.

Deleting on-device data. Delete individual records in the App, or delete everything with Android Settings → Apps → Fortuna: Money Tracker → Storage → Clear data, or by uninstalling the App. Because we hold no copy, there is nothing further for us to delete.

4. Data we do not collect

For ordinary use of the App we do not request or process:

• your name, email address, phone number or postal address;
• bank, card or payment account details;
• login credentials (there is no account or sign-in);
• your contacts, calendar, SMS or call log;
• precise (GPS) location;
• the content of your financial records or receipt images.

5. Data processed automatically by third-party SDKs

When you install, open or use the App, software development kits (SDKs) built into the App may collect and process technical information. Depending on your region, device settings and consent choices, this information may include:

Device and technical data: device manufacturer and model, operating system version, App version, language and locale, screen size, network type, IP address, country or approximate region derived from the IP address, time zone.

Identifiers: Android advertising ID (where permitted by your consent and device settings), App Set ID, Firebase installation ID, Adjust device identifier, Firebase Cloud Messaging registration token, and identifiers generated by the advertising SDKs.

Usage data: App opens, sessions and their duration, screens viewed, features used (for example "receipt scanned", "transaction saved", "currency changed"), the default currency you selected, notification category interacted with, onboarding steps completed, attribution events. Usage events do not include transaction amounts, notes or receipt contents.

Advertising data: ad requests, impressions, clicks, video views, rewarded-ad completions, and fraud-prevention signals.

Diagnostics: crash logs, stack traces, device state at the time of a crash, App performance traces (start-up time, network request timings).

Some of these items are personal data under the GDPR and similar laws even though they do not identify you by name.

5.1 Google Firebase (Google Ireland Ltd / Google LLC)

We use the following Firebase services:

• Firebase Analytics — to understand how the App is used and measure features. Processes usage events, device data, the Firebase installation ID and, only with your consent, the advertising ID.
• Firebase Crashlytics — to detect and fix crashes. Processes crash logs, stack traces, device data and the installation ID.
• Firebase Performance Monitoring — to measure start-up time and network performance. Processes performance traces, device data and the installation ID.
• Firebase Remote Config — to deliver App configuration such as feature flags, onboarding and notification variants and ad settings. Processes the installation ID and device data.
• Firebase Cloud Messaging — to deliver push notifications. Processes the registration token and device data.

Privacy policy: https://firebase.google.com/support/privacy

5.2 Adjust (Adjust GmbH)

Purpose: measure which marketing campaign or store page led to your installation, and count installs and App events per campaign.

Data: advertising ID (with consent), Adjust device identifier, IP address, device data, install and usage events.

Privacy policy: https://www.adjust.com/terms/privacy-policy/

5.3 AppLovin MAX and mediated advertising networks

The App is monetised through advertising. We use AppLovin MAX as an advertising mediation platform: it requests ads from several advertising networks and shows the winning ad. Ad formats used are native ads embedded in lists, full-screen interstitial ads, app-open ads shown when the App is launched, and optional rewarded video ads, which you choose to watch in exchange for an in-app benefit.

Advertising networks that may receive data through MAX:

• AppLovin (AppLovin Corporation) — https://www.applovin.com/privacy/
• Google AdMob (Google LLC) — https://policies.google.com/technologies/partner-sites
• Liftoff Monetize (Liftoff Mobile, Inc.) — https://liftoff.io/privacy-policy/
• Mintegral (Mintegral International Ltd) — https://www.mintegral.com/en/privacy/
• Pangle (ByteDance Pte. Ltd.) — https://www.pangleglobal.com/privacy
• Unity Ads (Unity Technologies) — https://unity.com/legal/privacy-policy

Which network serves a given ad depends on availability, your country, consent status and auction results. Not every network receives data in every session.

Advertising SDKs may process: IP address, device data, advertising ID and other identifiers where permitted, approximate region, impressions, clicks, video views, interaction data, diagnostic data and fraud-prevention signals.

5.4 Google User Messaging Platform and Google Play services

Google Play services on your device provide the advertising ID and support the consent dialog. Privacy policy: https://policies.google.com/privacy

5.5 Google ML Kit text recognition (on-device)

Receipt scanning uses Google ML Kit text recognition. Recognition runs on your device; the receipt image and the recognised text are not sent to Google or to us. The photo is stored only temporarily in the App's private cache while recognition runs and is deleted once the transaction is saved or the scan is cancelled. Google Play services may download the recognition model to your device and may report model download diagnostics to Google under Google's privacy policy.

6. Advertising and your choices

Personalised and non-personalised ads. Depending on your region and your consent, ads may be personalised (based on your advertising ID and inferred interests) or non-personalised (based on context such as your country and language).

Consent in the EEA, the UK and Switzerland. On first launch the App shows a consent dialog (Google's User Messaging Platform, integrated through AppLovin MAX, which follows the IAB Transparency and Consent Framework). Analytics and advertising identifiers are used only if you consent. You can review or withdraw your choices at any time in Settings → Privacy options.

Elsewhere. Where consent is not legally required, personalised ads may be shown by default. You can opt out through your device settings described below or by contacting us.

Device controls. In Android settings (Settings → Google → Ads, or Settings → Privacy → Ads) you can delete or reset your advertising ID. Deleting it stops SDKs from using it.

Declining personalised ads does not remove ads from the App; you will see non-personalised ads instead. Some processing continues where permitted for ad delivery, frequency capping, fraud prevention and aggregate measurement.

7. Notifications

The App can show two kinds of notifications:

• Local reminders (for example, a reminder to log expenses after a period of inactivity), scheduled on your device without any server.
• Push notifications sent by us through Firebase Cloud Messaging, including product news and tips. To deliver them, Firebase issues a registration token that identifies your installation.

You can disable any notification channel or all notifications in Android Settings → Apps → Fortuna: Money Tracker → Notifications, and the App asks for notification permission before showing any.

8. Purposes and legal bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent — for personalised advertising, ad measurement with identifiers, analytics and campaign attribution in the EEA, the UK and Switzerland, where the law requires consent before identifiers are used. Elsewhere these activities rely on legitimate interest or on the applicable local law.
• Legitimate interests — for showing non-personalised ads, frequency capping and fraud prevention (funding a free app and protecting it from invalid traffic); for crash reporting and performance monitoring (keeping the App stable); for remote configuration (operating the App); for push notifications (which you control through Android permissions and settings); and for analytics and attribution where consent is not legally required.
• Legal obligation and legitimate interest — for complying with the law and establishing, exercising or defending legal claims.

Data that stays on your device (section 3) is not processed by us and needs no legal basis on our side.

Where processing is based on consent you may withdraw it at any time; withdrawal does not affect processing that took place before.

9. Who receives data

We share data only with the service providers listed in section 5, and additionally:

• with authorities or courts where required by law or a valid legal request;
• to investigate fraud, abuse or security incidents, or to enforce our terms;
• with a successor entity in the event of a merger, acquisition or transfer of assets, under this Policy.

Firebase, Adjust and Google Play services act as our processors or as independent controllers according to their published terms. Advertising networks act as independent controllers for ad delivery and measurement.

Sale and sharing under U.S. state privacy laws. We do not sell personal information for money. Disclosure of advertising identifiers to advertising networks may qualify as "sharing" or "targeted advertising" under laws of certain U.S. states. Where those laws apply to us, you can opt out through the consent dialog, by deleting your advertising ID in Android settings, or by emailing support@fortunatracker.com. We do not knowingly process sensitive personal information as defined by those laws.

10. International transfers

Our service providers process data in the United States and other countries outside the EEA and the UK. Where required, transfers rely on the EU-U.S. Data Privacy Framework, European Commission Standard Contractual Clauses, the UK Addendum, or other mechanisms recognised by applicable law. Each provider's privacy policy describes the safeguards it uses.

11. Retention

• On-device data: kept until you delete it, clear the App's data or uninstall the App. Android backups follow your Google Account backup settings.
• Data held by service providers: retained for the period set by each provider and by our configuration of that service, then deleted or aggregated. Analytics and attribution data are kept only as long as needed to measure App usage and campaigns; crash data only as long as needed to diagnose and fix defects. Refer to each provider's policy in section 5 for its retention periods.
• Requests and correspondence you send us: kept as long as needed to handle the request and to demonstrate compliance.

12. Security

Data exchanged between the App and service providers is transmitted over encrypted connections (HTTPS). On-device data is stored in the App's private storage, which other apps cannot access, and is protected by your device's lock screen and encryption. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

13. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data deleted;
• restrict or object to processing, including objecting to processing based on legitimate interest;
• withdraw consent at any time;
• receive your data in a portable format;
• opt out of targeted advertising, "sale" or "sharing";
• not be discriminated against for exercising your rights;
• appeal a decision on your request where local law provides for it;
• lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee). You may also complain to the authority of your own country.

How requests work. Because the App has no account, the data processed by SDKs is linked to identifiers such as your advertising ID or installation ID, not to your name. To act on a request we may need you to provide those identifiers or other information sufficient to locate the data. Where we cannot reasonably link data to you, we may be unable to fulfil the request beyond what the law requires. Deleting your advertising ID or the App's data on your device is the most direct way to sever the link.

Send requests to support@fortunatracker.com. We respond within the time limits set by applicable law (one month under the GDPR, extendable where permitted).

14. Age requirement

The App is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has used the App and that data was processed in a way requiring parental consent, contact us at support@fortunatracker.com and we will take appropriate steps.

15. Third-party links and advertisements

Ads shown in the App may lead to websites or apps operated by third parties. Their privacy practices are governed by their own policies, which we do not control.

16. Changes to this Policy

We may update this Policy when the App, the SDKs it uses, our practices or the law change. The "Last updated" date at the top will change accordingly, and the current version is always available at https://fortunatracker.com/privacy.html and from the App's Settings screen. Where required by law we will give additional notice or ask for renewed consent before materially different processing begins.

17. Contact

← Back to Money Tracker