Zarmo Privacy Policy

Effective Date: April 30, 2026 · Last Updated: August 20, 2026 (rev 26)

0. This release is a beta

Zarmo is currently distributed as a beta, through Apple TestFlight and Google Play closed testing. Two things follow from that, and they are stated here rather than buried because they affect your data directly:

• The app may be unstable. Features may fail, behave unexpectedly, or change between builds.
• Beta data may be reset without notice. While the app is in beta we may need to clear

server-side records — your usage document and subscription state — as part of fixing or rebuilding the backend. This does not touch the expense data on your device or in your own Google Drive / iCloud account, but it is a real possibility and you should not treat a beta build as the only home for records you cannot lose. Export a .zarmo backup file (section 2f) if the data matters to you.

Some features described below are not available in this release. Where that is the case it is marked explicitly. Nothing in this policy should be read as describing data we collect today when the feature that would collect it cannot be reached.

1. Introduction

Zarmo ("we," "our," or "the app") is a personal expense tracking application developed by Himanshu Kumawat, an individual based in India. This Privacy Policy explains how we collect, use, and protect your information when you use Zarmo. By using the app you agree to the practices described here.

2. Information We Collect

We never collect your location, approximate or precise. Zarmo declares no location permission on Android and none of the iOS location usage descriptions, so neither operating system is able to hand the app your position — there is no setting to get wrong and no prompt you have to decline. The country, currency and date format the app uses come from the region you pick yourself during setup and can be changed at any time; your device location is never read to work them out.

2a. Data Stored Locally on Your Device

Zarmo stores all expense data (amounts, categories, descriptions, dates, currencies) on your device using a local SQLite database. This data is not transmitted to any external server unless you use the cloud sync feature (see section 2e).

Zarmo also keeps a copy of the document a bill came from: the photo of a receipt you scan, and any photo, PDF, spreadsheet or text file you attach to a bill yourself. Photos are compressed; other file types are stored exactly as you provided them. All of them are kept in the app's private storage area on your device, and are only ever sent to your own cloud account if you use cloud sync (see section 2e).

A document belongs to a whole bill rather than to one line of it. You can open and view it from any expense that carries it, and you can attach, replace or remove it while reviewing a scanned or uploaded bill, or by editing that bill again later. An expense you type in by hand has no document: the manual entry screen neither shows nor offers one. Removing a document deletes the stored file from your device, and from your cloud account on the next sync. You can also save your own copy: tapping "Save" in the document viewer passes the file to your device's standard share sheet, and the destination you pick (Photos, Files, another app) governs what happens to that copy from then on — it is not sent to us.

Zarmo can also receive a file from another app through your device's share sheet ("Share → Zarmo"). A file sent that way is copied into the app's private cache and handed to the scanning flow described in section 2d; the copy is deleted as soon as that flow is finished with it, and anything left behind by an interrupted session is swept the next time the app starts. A shared file is treated exactly like one you picked inside the app — nothing extra is collected because it arrived from elsewhere.

2b. Account & Authentication

Zarmo requires a Google or Apple account to sign in. Authentication is handled by Firebase Authentication (Google LLC). When you sign in:

• Your name, email address, and profile photo (from your chosen identity provider) are stored locally on your device.
• Firebase Authentication processes your identity and issues a secure session token. Firebase's use of data is governed by Google's Privacy Policy: https://policies.google.com/privacy
• Google's privacy policy governs Google sign-in: https://policies.google.com/privacy
• Apple's privacy policy governs Sign in with Apple: https://www.apple.com/legal/privacy/

2c. PIN & Biometric Authentication

• A PIN you create is hashed (SHA-256 with a device-unique random salt) and stored in your device's secure enclave (iOS Keychain / Android Keystore) via expo-secure-store. The raw PIN and salt are never transmitted off-device.
• Biometric authentication (Face ID, Touch ID, fingerprint) uses your device's hardware. Biometric data never leaves your device and is handled entirely by the operating system.
• Incorrect PIN attempts are counted, and the count is persisted across app restarts. After five consecutive incorrect attempts you are signed out for security and must sign in again with your Google or Apple account; your locally stored expense data is preserved.

2d. Camera & Document Access

Zarmo requests camera access solely to scan receipts and documents. Receipt scanning normally requires a Pro or Advanced subscription; during the beta every feature that has shipped is unlocked for all users at no charge, so scanning is available to everyone and the descriptions below apply to you. When you scan, the following external services receive data via a Firebase Cloud Functions proxy. The proxy is a Firebase Cloud Function hosted in Google Cloud region europe-west1 (Belgium); your receipt content passes through that region on its way to the provider, and the providers themselves process it on their own infrastructure, which may be outside your country. Requests are authenticated with your Firebase ID token so the proxy can confirm the request is yours; the proxy does not retain the content it forwards.

• Google Cloud Vision API (Pro and Advanced only) — receives the receipt image (base64-encoded) to extract text (OCR). Subject to Google's Cloud Vision data usage policy.
• OpenAI (via Firebase proxy) — receives extracted receipt text, or the image/PDF/spreadsheet content, to parse expense details. Subject to OpenAI's privacy policy: https://openai.com/policies/privacy-policy
• Anthropic / Claude (via Firebase proxy) — alternative LLM provider that may receive the same receipt content. Subject to Anthropic's privacy policy: https://www.anthropic.com/privacy

To recognize which merchant a bill belongs to, each parse request also includes your learned merchant list (merchant names only, as stored in Settings → Manage merchants) and your selected country/locale. Newly recognized merchant names are saved back to this list on your device. You can choose on-device OCR for images at any time by switching off Settings → AI → "Cloud OCR" (Apple Vision framework on iOS, Google ML Kit on Android). With cloud OCR off, receipt images never leave the device — only the extracted text is sent for parsing. Separately from scanning, a copy of the scanned or uploaded document is kept on your device so you can look at the bill later (see sections 2a and 2e). Keeping it does not send it anywhere new: the OCR and parsing steps above are unchanged, and the stored copy only leaves your device if you use cloud sync, in which case it goes to your own Google Drive or iCloud account. Images and documents sent for OCR or parsing are processed transiently: the proxy does not retain them, and we keep no server-side copy of anything you scan. The only copy Zarmo keeps is the on-device one described in section 2a, which is yours to remove.

2e. Cloud Sync

Zarmo syncs to a cloud account you already own; the destination depends on your sign-in method. Sync is two-way and non-destructive: your expense data (including your currency conversion history, learned merchant list, and stored receipt documents) is merged with the copy stored in your personal cloud account so the same data is available across your devices. Sync runs when you tap the sync button and automatically when you open the app and after you add, edit, or delete an expense. Cloud sync is optional and can be switched off in the app. You are asked to choose when you first sign in, and you can change it at any time from Settings → Backup & Data → "Back up to Google Drive / iCloud". While it is off, nothing — no expense data and no receipt documents — is sent to your cloud account, and the app keeps working entirely on local storage; in that case the only backup you have is a .zarmo file you export yourself (see section 2f). Sync also stops if you disconnect the destination: revoke Zarmo's access from your Google account settings, or switch Zarmo off in your iOS iCloud Drive settings. Your data stays fully usable on the device either way.

• Google users: expense data and receipt documents are synced to your personal Google Drive "app data" folder. Only you can access this folder; it is not visible to other apps or to us. You may revoke access at any time from your Google account settings.
• Apple users: expense data and receipt documents are synced to your personal iCloud Drive storage. The sync file and documents are stored in the app's private iCloud container, accessible only to you. Subject to Apple's iCloud Terms and Conditions.

Receipt documents are handled as follows: a document is uploaded to your cloud account once the expense that references it has been saved, and is downloaded to another of your devices only when you actually open that expense to view it. When no expense references a document any more — because you removed it or deleted the expense — the file is deleted from your device and from your cloud account on the next sync. These files count against your own Google Drive or iCloud storage quota, not ours.

2f. Backup Files You Export (.zarmo)

You can export all of your data — expenses, currency conversion history, deletion records, your learned merchant list and your stored receipt documents — as a single .zarmo file, from Settings → Backup & Data → Export backup file, or from the "Download backup" button on the warning shown when you sign out with cloud sync switched off. This is the same data cloud sync would send, packaged as one file.

• The file is encrypted with AES-256-GCM and can only be opened by Zarmo. The key is built into the app, not derived from your account, so that a file you export today still opens after you sign out or move to a new phone.
• Zarmo does not upload the file anywhere. It is written to your device and handed to your operating system's share sheet, and where it goes next — Files, a cloud drive of your choosing, email, another app — is entirely your decision. Once it leaves the app we have no visibility of it and no ability to delete it.
• Anything you do with that file afterwards, including where you store it and who you send it to, is outside Zarmo's control. Treat it as you would any other copy of your financial records.
• Importing a .zarmo file (Settings → Backup & Data → Import backup file, or the import prompt shown on an empty dashboard) merges its contents into what is already on the device using the same rules as cloud sync: existing entries are kept unless the file holds a newer version of the same entry.

2g. Usage & Subscription Data (Firebase Firestore & RevenueCat)

To manage subscription status and usage, Zarmo stores the following data in Firebase Firestore (Google LLC), associated with your Firebase user ID:

• Your subscription tier — free, pro or advanced (tier, and the legacy isPro flag)
• Number of scans used (scansUsed), kept as a cost measure
• Usage counter reset date (resetDate)

This data is used solely to determine which features you may use and to measure usage, and is never shared with third parties other than Firebase.

No purchases in this release, and no data sent to RevenueCat. Zarmo is free for everyone during the beta. There is nothing to buy: no subscription products exist on either store, the app presents no purchase or restore option anywhere, and the RevenueCat SDK is not started at all in this build. Because it never starts, no device identifier and no purchase receipt is sent to RevenueCat, and the app requests no billing permission from Android.

If paid plans are introduced in a future release, in-app purchases would be handled by RevenueCat, Inc., which would then receive your device identifier and purchase receipt to verify your entitlement (subject to RevenueCat's privacy policy: https://www.revenuecat.com/privacy). This policy will be updated before any such release, not after it.

2h. Currency Conversion

When you use currency conversion features, the app queries the Frankfurter API (open exchange rate service) for current exchange rates. Only the requested currency codes are sent — no personal data, expense amounts, or identifiers are transmitted.

2i. Remote Configuration

Zarmo uses Firebase Remote Config to fetch app configuration (such as which AI provider to use, app update information, and maintenance notices). It is a read-only configuration fetch: no expense data, no account details and nothing you have entered in the app are sent. To serve it, Firebase identifies the app installation itself — an installation identifier generated on your device, plus the app version and platform. That identifier is created by Firebase, is not linked to your expenses, and is discarded when you delete the app.

The Google library that provides Remote Config also carries the Firebase Analytics SDK into the app, whether or not an app makes use of it. Zarmo makes no use of it, and does not leave it dormant either: it is switched off when the app is built, in the permanent form that cannot be re-enabled while the version you installed is running. It records no events, reports no screens, reads no advertising or device identifier for measurement purposes, and sends nothing. This matters because an analytics SDK left at its defaults reports app opens by itself, and the network address those reports arrive on would tell Google roughly which city you were in — which is exactly what section 2 says we do not collect.

2j. AI Spending Insights (Advanced) — NOT AVAILABLE IN THIS RELEASE

The entire Analysis section — spending reports, budgets, the recurring-charge radar, the "Ask Your Money" assistant and the year-end Wrapped recap — is switched off in this build and cannot be reached by any user. None of the data flows described in this section happen in this release. The description is kept so the policy is complete and so you can see in advance what these features will do when they ship; it will not be quietly enabled — a build that turns them on ships alongside a policy that says so.

Some Advanced analysis features use a cloud AI model to interpret your spending. When you use the "Ask Your Money" assistant, the app sends the question you type — and, on demand while answering it, targeted slices of your own expense data (for example the specific date ranges, categories, merchant/keyword searches, spending totals, recurring charges, or budget figures needed to answer that question) — to Anthropic / Claude via the same Firebase Cloud Functions proxy used for receipt scanning. The assistant fetches only the data relevant to each question from your on-device database, rather than uploading your whole ledger. So it can follow up on earlier questions, the ongoing conversation for that chat is also sent with each message; this chat history is kept only in memory while the chat is open, is never written to disk, and is cleared when you start a new chat or leave the screen. Similarly, the "AI budget planner" inside Budgets sends a summary of up to your last six complete months of spending (monthly totals with your top categories and merchants per month) to the same proxy to generate suggested per-category budget limits; it runs when an Advanced subscriber opens Budgets with no budgets set, or requests new suggestions. The AI narrative inside Spending Reports and the year-end "Wrapped" recap likewise send a small summary of the period's statistics (total spent, the prior period's total, your top categories with amounts, and the single largest purchase) to the same proxy to generate a written recap. The recurring-charge radar sends a bounded list of the distinct item names you logged over roughly the last year, each with the merchant/receipt names it was logged under (tax lines, service charges and discounts are excluded) — never any amounts and never any dates — to the same proxy so the AI model can tell which items are genuinely recurring charges (subscriptions, rent, memberships, bills) apart from everyday purchases that simply repeat (like groceries), and which differently-named entries are in fact the same charge; the actual monthly-cost, price-change and cadence math is then computed on-device from your full expense history, never by the AI. In all cases this data is used only to generate your result; it is processed transiently and is not stored permanently by Zarmo or the proxy. The assistant can also record an expense for you when you ask it to (for example "log 12.50 for lunch at Pret"): the details you give it are part of the question already sent as described above, and if something essential is missing — the receipt title or an amount — it replies with a follow-up question rather than guessing. It builds the receipt with you a question at a time, shows you the draft, and writes nothing until you confirm it; if you cancel, nothing is saved. The expense itself is written to the database on your device — the same place a scanned or manually entered expense goes — and is shown to you as a receipt you can open, edit or delete. Nothing extra is sent to the AI provider in order to save it. These cloud features require an Advanced subscription. The deterministic parts of Budgets and Spending Reports run entirely on your device and send no data anywhere.

2k. Data Exports (Advanced) — NOT AVAILABLE IN THIS RELEASE

CSV/PDF export is part of the Analysis section and is switched off in this build. (A .zarmo backup export, section 2f, is available to everyone and is unaffected.)

The Expense Export feature lets you generate a CSV or PDF file of the expenses you logged within a date range you choose. These files are created entirely on your device — no expense data is sent to any server to produce them. When you choose to share an exported file, your device's standard share sheet sends it to the destination you select (e.g. email, Files, or another app); what happens to the file after that is governed by that destination, not by Zarmo.

• OpenAI's privacy policy: https://openai.com/policies/privacy-policy
• Anthropic's privacy policy: https://www.anthropic.com/privacy

2l. Microphone & Voice Questions (Advanced) — NOT AVAILABLE IN THIS RELEASE

Voice input belongs to the Analysis section and is switched off in this build. Going further: the Android build of this release does not request the microphone permission at all — it has been removed from the app's manifest, so no audio can be captured by this build under any circumstances. On iOS the app declares a microphone usage description, but nothing in the build can reach the microphone, so the system will never prompt you for it. No audio is recorded, transcribed or transmitted in this release.

You can ask the "Ask Your Money" assistant a question by speaking it instead of typing it. The microphone is used only for this: recording starts when you tap the microphone button (or open the assistant from the voice shortcut on the tab bar) and stops when you tap stop, or automatically after two minutes. Nothing is recorded at any other time, and the app never listens in the background or for a wake word. When you stop the recording, the audio clip is sent — via the same Firebase Cloud Functions proxy used for receipt scanning — to OpenAI's speech-to-text service to be converted into text, together with your selected country/locale so the spoken language can be recognized correctly. Subject to OpenAI's privacy policy: https://openai.com/policies/privacy-policy The clip is temporary: it is written to the app's cache while you record, deleted from your device as soon as it has been transcribed (or if you discard the recording), never added to an expense, and never included in cloud sync. The recognized text is placed in the message box for you to read and edit; nothing is asked of the assistant until you tap send, at which point it is handled exactly like a typed question (see section 2j). Voice questions require an Advanced subscription.

2m. Feedback You Send Us

Settings → Send feedback lets you report a bug, suggest an idea or ask a question. It is entirely optional: nothing is sent unless you write a message and tap send, and the app works exactly the same if you never use it.

When you do send one, the following goes with it — and the screen lists it, with the real values filled in, before you send:

• The message you typed and which of the four subjects you picked (bug, idea, question, other).
• The email address and display name on your Zarmo account, so we can reply to you. These are

read from your authentication record on the server rather than sent from the app, and your reply address is always your own account's.

• Your Firebase user ID.
• Details about this installation: the app version and build number, the platform (iOS or

Android), the OS name and version, the device model, the region you selected in the app, and an anonymous install ID.

The install ID is a random number the app generates on your device the first time you send feedback and keeps in its own storage. It exists only so that two reports from the same installation can be recognised as such. It is not your device's identifier — not the Android ID, not the iOS vendor ID — it is not shared with any other app, it is not linked to your expense data, and it is gone when you uninstall Zarmo.

No expense data is included. Not your expenses, not your receipts or the documents attached to them, not your merchant list, not your backups, and no screenshot. If a bug involves a specific bill, we may write back and ask you about it; we cannot see it otherwise.

The report is sent through the same Firebase Cloud Functions proxy as everything else (europe-west1, Belgium) and is emailed to the developer using Amazon Simple Email Service (Amazon Web Services, Ireland region) from a noreply@sarmonic.com address. It arrives in the developer's mailbox and is kept there so the issue can be followed up; we do not store feedback in the app's database or use it for any purpose other than answering you and fixing the problem. You can ask us to delete a report you sent by writing to support@sarmonic.com.

3. How We Use Permissions

3a. Android permissions this release actually declares

This list is taken from the merged manifest of the built release artifact — the same thing Google Play reads — not from intent.

On iOS there is no permission list of this kind. The app declares usage descriptions for the camera, the photo library and Face ID, and iOS asks you at the moment a feature first needs one.

3b. Permissions not in this release

Most of these are requested by libraries the app depends on and have been explicitly stripped from the build; SYSTEM_ALERT_WINDOW is different — it only ever existed in development builds. None of them is in the release you install, so none is requested from you:

READ_MEDIA_IMAGES is not requested. Earlier versions of this policy listed it; that was wrong — the app has never declared it. Choosing an image from your gallery goes through the system photo picker, which hands the app only the file you pick and needs no permission at all.

4. Third-Party Services Summary

In this release, the rows above marked "(Advanced)" do not carry any data. The Analysis section, the assistant, voice input and CSV/PDF export are all switched off (sections 2j–2l), so in this build the AI providers receive receipt content for scan parsing and nothing else, and no audio is sent to anyone.

OpenAI and Anthropic are alternatives, not both used at once. Which one parses a scan is a server-side setting we can change without shipping a new app version, so both are listed above and either may receive your receipt content. At the time of writing, cloud OCR is performed by Google Cloud Vision and parsing by Anthropic / Claude, so OpenAI receives nothing unless that setting changes.

5. Data Sharing

We do not sell, rent, or share your personal data with any third parties beyond the services listed in Section 4, which are required to operate specific features of the app. We do not use your data for advertising, we run no analytics or tracking SDK, we never collect your location, and we do not profile you. (The Firebase Analytics SDK ships inside a Google library we depend on for something else; it is deactivated at build time and collects nothing — see section 2i.) All cloud AI and OCR calls are routed through a Firebase Cloud Functions proxy; your data is not sent directly to OpenAI, Anthropic, or Google Vision from the device.

6. Data Security

• All local expense data is stored in a SQLite database on your device.
• Authentication tokens and your PIN hash (salted SHA-256) are stored in the device's secure storage (iOS Keychain / Android Keystore) via expo-secure-store.
• PIN entry is attempt-limited: the failed-attempt count is persisted across app restarts, and five consecutive incorrect attempts sign you out and require full re-authentication with your identity provider.
• All communications with external APIs (Firebase, OpenAI, Anthropic, RevenueCat, Frankfurter, Amazon SES) are made over HTTPS/TLS.
• On each launch, the app checks whether the device has been jailbroken (iOS) or rooted (Android). If a compromise is detected, access to the app is blocked to protect your data.
• If you delete the app, all locally stored data is permanently removed from your device.

7. Data Retention & Deletion

• Local SQLite data: retained until you delete the app, manually delete expenses within the app, sign out, or delete your account.
• Signing out: signing out clears this device. Every expense, currency conversion, learned merchant and stored receipt document is deleted from local storage, so one person's records are never left behind for the next account that signs in. If cloud sync is on, that data is still in your own Google Drive or iCloud account and comes back when you sign in again. If cloud sync is off, the device held the only copy — the app warns you and offers a .zarmo export before completing the sign-out. (This is not the same as the sign-out that follows five incorrect PIN attempts, described in section 2c, which deliberately leaves your local data in place.)
• Stored receipt documents: retained on your device for as long as an expense references them. Removing a document, or deleting the expense it belongs to, deletes the file from your device and from your cloud account on the next sync.
• Voice recordings: deleted from your device immediately after the clip has been transcribed or discarded. They are never synced, never attached to an expense, and not stored by Zarmo or the proxy.
• Feedback you send (section 2m): kept in the developer's mailbox for as long as needed to answer you and fix what you reported. It is not stored in the app's database and is not deleted by deleting your account — an email already sent cannot be recalled — so if you want a report removed, write to support@sarmonic.com and it will be deleted. The anonymous install ID it carries is removed from your device when you uninstall the app.
• Firebase Firestore (usage data): deleted immediately when you delete your account via the in-app option.
• Cloud sync files and receipt documents (Google Drive / iCloud): the app deletes them from your cloud account when you delete your account via the in-app option. Because they live in your account rather than ours, that step is best-effort: it needs your cloud account to be reachable and still connected at that moment. If it does not succeed, account deletion still goes ahead, and you can remove the leftover file yourself from your Google Drive app data folder or your iCloud settings.
• Account deletion: you may permanently delete your account at any time from Settings → Delete Account. This immediately and irreversibly deletes all expense data and stored receipt documents from your device, your Firebase Authentication account, and your Firestore usage record; your cloud sync file and receipt documents are deleted on the best-effort basis described above. We retain no data about you after deletion.
• Beta resets: while the app is in beta we may clear server-side records (your Firestore usage

document and subscription state) when rebuilding the backend — see section 0. Data on your device and in your own Google Drive / iCloud account is not affected.

• Subscriptions: there are none in this release, so nothing continues after deletion and nothing

needs cancelling. Were paid plans introduced later, deleting your account would not cancel an App Store or Google Play subscription — that billing is managed entirely by Apple or Google and would have to be cancelled through their settings.

8. User Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate personal data.
• Erasure: delete your account and all associated data instantly via Settings → Delete Account. No contact or waiting period required.
• Portability: your expense data can be exported as an encrypted .zarmo backup file from Settings → Backup & Data → Export backup file, via the cloud sync feature (Google Drive or iCloud), or — in app versions where the export feature is available — as CSV/PDF from Settings → Export, before deleting your account.
• Objection: object to processing where applicable.

To exercise any of these rights, contact us at support@sarmonic.com.

9. Children's Privacy

Zarmo is intended for adults: you must be 18 or over to use it. The app is not directed at children, is not listed for a child audience on either store, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect new features or legal requirements. Any changes will be reflected by updating the "Last Updated" date above. We will notify users of material changes via an in-app banner. Continued use of the app after such notice constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or to exercise your data rights, please contact us at: Email: support@sarmonic.com App: Zarmo (Package: com.sarmonic.zarmo) Developer: Himanshu Kumawat (individual), India Web: https://sarmonic.com

See also: Terms and Conditions (terms.md)