The boss is your budget, not your privacy.

01Who we are

DAMAGE ("the app") is an expense tracker for food delivery, rides and other small, frequent purchases, available for Android. It is developed and published by Jan Aguja, an independent developer in the Philippines ("we", "us"). This policy explains what information the app handles, where it goes, and how long it stays there.

02What we collect

We, the developer, don't receive your entries, your name or anything else. There's no DAMAGE server to send them to.

DAMAGE has no sign-up and no DAMAGE account. We do not operate a backend server or database, and we do not receive the expenses you log. Information the app handles goes to one of these places, depending on the features you use:

• Your device: everything you enter (section 3).
• Your own Google Sheet: only if you choose cloud sync (section 4), and shared with a partner only if you invite one (section 5).
• Google: sign-in, Drive sharing, ads in the free version and purchases, each under Google's own policies (sections 4, 8, 9).

The app contains no analytics, tracking or crash-reporting SDKs. We do not sell, rent or share your information with anyone.

03What stays on your device

This is the main event, and it stays put.

The following is stored in a local SQLite database and a local preferences store inside the app's private storage on your phone:

• Your expense entries: amount, optional note, tracker (for example Food Delivery or Gaming), entry type, the author name, when it was logged, and, if deleted, when it was deleted
• Your monthly budgets per tracker, currency, billing-period cutoff day, theme, background, sound setting and similar preferences
• Your display name (by default your Google account name if you use sync; you can change it in Settings)
• The ID of the Google Sheet you're linked to, if any
• Which trackers you've unlocked and whether ads are removed
• A cached copy of the auto-log rules file (section 7) and your per-app auto-log toggles
• Temporary auto-log data, only if you've granted notification access (section 6)

Other apps can't read the app's private storage, and neither can we. The expense database and the notification hand-off file are excluded from Android's automatic backup. Android may still back up the app's small preferences file (settings, display name and sheet link) to your own Google account if device backup is turned on; that backup is handled by Google and is not accessible to us.

If you choose Local only when you first open the app, your entries never leave your phone.

04Google sign-in & Google Sheets sync

Optional. One spreadsheet, in your Drive, that the app made or that you pointed it to.

If you choose Cloud sync, DAMAGE uses Google Sign-In and then talks directly from your phone to the Google Sheets and Google Drive APIs over HTTPS. Nothing passes through a server of ours.

What access we ask for

The only Google API scope DAMAGE requests is https://www.googleapis.com/auth/drive.file. It lets the app see and change only files it created, or files you explicitly select for it with Google's file picker. It does not give access to any other file in your Drive. Like every Google sign-in, Google also shares your basic profile (name and email address) with the app; DAMAGE uses your name, or your email if no name is set, as the default author name on your entries, and doesn't use the email for anything else. We do not request access to Gmail, Contacts, Calendar, Photos or any other Google service.

What the app does with that access

• Creates one spreadsheet named [DO NOT RENAME] DAMAGE App Data in your Drive, or links to an existing one you choose
• When you sign in on a new device, looks for that spreadsheet by name. Because of the drive.file scope, this search can only ever return files the app created.
• Reads and writes your entries and settings in that spreadsheet to keep your devices (and your partner's) in sync
• Adds a gentle "are you sure?" warning on the spreadsheet's tabs so manual edits don't break sync
• Shares the spreadsheet with a partner, only when you ask it to (section 5)

The spreadsheet contains:

It never contains:

Sign-in tokens are managed by Google's Sign-In SDK on your device. You can disconnect DAMAGE at any time from your Google Account at myaccount.google.com/connections, or switch back to a different sheet from Settings.

05Partner sharing

Two phones, one sheet, shared the normal Google Drive way.

From Settings you can invite a partner to your spreadsheet:

• You type your partner's Google email address. The app asks Google Drive to give that account edit access to your spreadsheet, and Google emails them a standard sharing notice. DAMAGE doesn't store the address.
• The app then lets you send a join link (janapps.com/damage/join?sheet=…) through any messaging app you choose, or show it as a QR code. The link contains the spreadsheet's ID. The ID alone doesn't open anything: Google only lets in accounts you've shared the sheet with.
• When your partner opens the link, the join page simply hands them over to the DAMAGE app. To grant the app access to the shared sheet, the app opens a small picker page on janapps.com in their browser, which shows Google's own file picker. A short-lived Google access token is passed to that page in the part of the address after the #, which browsers never send to our server; the page uses it only to show Google's picker.

Once linked, both of you can see and add to everything in the spreadsheet, including notes and author names, across every tracker. Only invite someone you're happy to share your spending with. You can remove their access at any time from the sheet's Share settings in Google Drive.

06Notification access & auto-logging

Completely optional. Delivery-app notifications only, read on your phone, and nothing is logged until you say so.

If you grant DAMAGE notification access in Android's settings (Settings → Notification access → DAMAGE), the app's notification listener can see notifications as they arrive. It works like this:

• Only supported delivery apps are processed. The app keeps a list of watched apps (currently Grab, plus delivery apps listed for future support such as Foodpanda, Uber Eats and DoorDash). Notifications from every other app, including messages, email and banking, are ignored immediately and not stored.
• Read on your device. For a watched app, the notification's title, text and time are saved to a temporary file in the app's private storage. This lets the app catch orders even while it's closed, and it re-checks your notification shade when you open the app so missed orders aren't lost.
• You confirm. The app matches that text against its rules to find the order amount, then shows you a confirmation sheet. Only the entries you confirm are saved, and they contain just the amount, tracker, entry type and time. The notification's wording is not saved in the entry and is never written to your Google Sheet.
• Cleaned up. When you submit or clear the confirmation sheet, the temporary notification rows are deleted. To stop the same notification from being offered twice, the app keeps a private record of already-handled notifications for 7 days, then deletes it.
• Unrecognised payment notifications. If a watched app sends a notification that contains a money amount but doesn't match any rule, the app keeps it privately on your phone for up to 48 hours. If it sees a few of these, it may offer to help: tapping send opens your own email app with that notification text filled in, addressed to [email protected], so we can add support. You can read it, edit it or not send it at all. Dismissing the banner deletes them.

No notification content is ever sent to us or to any server by the app itself. You can turn auto-logging off per app in Settings, and revoke notification access at any time in Android's settings. Revoking it doesn't affect anything you've already logged.

07Downloads from janapps.com

The app downloads a rules file. It doesn't upload anything about you.

So auto-logging can keep up when delivery apps change their wording, DAMAGE downloads a small rules file from https://janapps.com/damage/rules.json when it starts (at most about once every six hours) and when you open Settings. The file lists which apps to watch and what their order notifications look like. It contains no information about you, and the app sends nothing with the request beyond what any web request involves, such as your IP address. If the download fails, the app uses its built-in or cached rules.

janapps.com also hosts the partner join and picker pages described in section 5. The website is served by Cloudflare, which, like any web host, may process standard request information (IP address, browser type, the page requested) to deliver and protect the site. We don't run analytics on these pages and don't use that information to identify you.

08Ads

Banner ads in the free version, served by Google. Buy any tracker and they're gone for good.

The free version of DAMAGE shows banner ads served by Google AdMob. To show and measure ads, the Google Mobile Ads SDK may collect information such as your device's advertising ID, IP address, general device information and how you interact with ads, and Google may use it to show personalised ads, according to Google's policies. We don't receive this information in a form that identifies you.

You can limit this on your device: on Android, go to Settings → Privacy → Ads (or Settings → Google → Ads, depending on your phone) to delete or reset your advertising ID or opt out of personalised ads. Ads are permanently removed across the whole app after any in-app purchase.

Learn more in how Google uses information from apps that use its services.

09Purchases

Extra trackers (Gaming, Adulting, Shopping, Hobbies & Gadgets) are one-time in-app purchases made through Google Play. Google handles the payment entirely under its own terms and privacy policy. We never see or store your payment details. The app only learns which trackers you own, so it can unlock them and remove ads, and it restores past purchases from Google Play when it starts.

10Third-party services

All Google, plus the web host for our site.

• Google Sign-In, Google Sheets API, Google Drive API and Google Picker: only if you use cloud sync or partner sharing. Google Privacy Policy.
• Google AdMob (Google Mobile Ads SDK): banner ads in the free version. How Google uses data from partner apps.
• Google Play Billing: in-app purchases. Google Payments Privacy Notice.
• Cloudflare: hosts janapps.com, including the rules file and the join and picker pages. Cloudflare Privacy Policy.

DAMAGE includes no analytics or crash-reporting SDKs and no advertising networks other than Google AdMob.

11Permissions

• Internet: to sync with your Google Sheet, download the rules file, load ads and talk to Google Play.
• Notification access (special access you grant in Android's settings): only for optional auto-logging, as described in section 6.
• Notifications (POST_NOTIFICATIONS): declared by the app; DAMAGE does not currently send you notifications of its own.
• Google Play billing, advertising ID and network state: added automatically by Google's billing and ads libraries, for purchases and ads.

DAMAGE does not request access to your location, contacts, camera, microphone, photos or files. Opening a join link or QR code uses Android's normal link handling (damage://) and needs no permission.

12Retention & deletion

You hold all the data, so you hold the delete button.

• On your device: kept until you clear the app's data or uninstall it (Android Settings → Apps → DAMAGE). Temporary auto-log data is deleted as described in section 6.
• Deleted entries are marked as deleted (with a timestamp) rather than erased, so the deletion can sync to your sheet and your partner's phone. The row stays in your spreadsheet until you remove it there.
• Your Google Sheet: it's your file, in your Drive. It stays there until you delete it; uninstalling the app doesn't remove it.
• Google, Cloudflare: data they process is kept according to their own policies.

Step-by-step instructions are on the Delete your data page. Because we hold no copy of your data, there's nothing for us to delete on our side, but if you have a question, email us and we'll help.

13Your rights

Depending on where you live, including under the Philippine Data Privacy Act of 2012, the GDPR or similar laws, you may have the right to access, correct, export or delete personal data held about you, and to object to certain processing. Because DAMAGE keeps your data on your device and in your own Google Sheet, you can do all of this directly: edit or delete entries in the app or the sheet, download the sheet from Google, or delete it. For data processed by Google or Cloudflare, use their tools and policies linked above. For anything else, contact us.

14Children's privacy

DAMAGE is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, contact us and we'll help remove it.

15Changes to this policy

If this policy changes, the updated version will be posted at this address with a new effective date. If a change meaningfully affects what data leaves your device, we'll mention it in the app's release notes or Google Play listing. Continued use of the app after a change means you accept the updated policy.

16Contact

Questions about privacy? Email [email protected]. It goes straight to Jan Aguja, the developer.