Your money is your business.
Amount Tracker has no account system and no server that receives your data. Here is how that works in practice.
The short version
It stays on your phone
Transactions, balances, cards and accounts live in a database on the device, encrypted with a key held in Android Keystore.
Locked with you
Card and account numbers open only with your fingerprint or phone PIN. An optional app lock asks every time you open the app.
Hidden from prying eyes
Screenshots, screen recording and the recent-apps preview are blocked by default, and alerts show no amounts on the lock screen.
No ads, no tracking
No advertising, no analytics, no crash reporters, no selling or sharing of your data, and no remote AI reading your messages.
What can leave your phone, and only if you choose
Gmail (optional)
If you connect it, the app reads your mail read-only to find bank alerts and statements. The app password is stored encrypted on the phone, and disconnecting removes it.
Google Drive backup (optional)
An encrypted backup in a hidden folder of your own Drive. Card numbers, expiry dates, CVVs and bank account numbers are never part of a backup.
Google Play (only for Plus)
If you choose a plan, Google Play handles the payment. The app never sees your card or UPI details.
The only other thing the app fetches by itself is one small public settings file, which says which features are part of a plan and how strong the blur is. It carries none of your data, comes only over HTTPS from one fixed address, and can never lock your export, settings, My details or the About page.
What each permission is for
The app asks for as little as it can, explains each one before Android asks, and works if you skip them.
The app does not hold the permission to send text messages and does not read your call log or phone identity.
Checked, not just promised
The app's rules are written into automated checks that fail the build if they are broken.
Locked-down app
Backups by other apps are off, there is no debug mode in releases, only encrypted traffic is allowed, and only three entry points can be reached by other apps.
Exact permissions
A test lists every permission the app may hold. Adding another by accident stops the build.
No secrets in the code
Checks look for keys and secret-looking text, and for any logging of message text, one-time passwords or numbers.
This is the project's own testing, not an outside certification. The security reviews and what they found are kept in the project's documents.
Your rights, under Indian law
The app follows the notice, consent, security and rights expectations of the Information Technology Act 2000 with its SPDI Rules 2011 and the Digital Personal Data Protection Act 2023. Because your data stays on your phone you exercise most rights directly: see, edit, export and delete it. A named grievance contact is on the Contact and grievance page.