Ping Budget

Privacy Policy

PingBudget is made by Brian Smith. It has no account system and no developer-operated server.

Effective: September 29, 2026 · App version: 0.69

The short version: your financial records stay under your control. PingBudget does not upload your transactions, budgets, bank alerts, receipts, or statements. Google's ML Kit sends limited technical diagnostics when its on-device text-recognition features are used; those diagnostics are described below.

Your money data stays on your device

Transactions, budgets, categories, rules, income plans, and notification content are stored in a Room database inside PingBudget's private app storage. Android prevents other apps from reading that storage. PingBudget does not upload this information.

The exception is a backup you deliberately export. Backups are encrypted before they are written. If you choose a folder supplied by a cloud-storage provider, that provider may upload the encrypted backup under its own privacy policy.

Google ML Kit diagnostics

Receipt scanning uses Google's bundled, on-device ML Kit text recognition. Importing a bank statement saved as a PDF uses it only when the PDF has no text layer — that is, when the file is a scan. A PDF produced by your bank is read directly from the text already inside the file, with no image recognition at all. Receipt images, rendered PDF pages, and recognized text are processed locally and are not uploaded.

ML Kit does send Google diagnostic data over HTTPS, including device and app information, a per-installation identifier, performance and timing measurements, input and output sizes, event types, and errors. This is PingBudget's only automatic network egress. ML Kit does not provide a supported opt-out for these diagnostics.

Statement imports

PingBudget accepts QFX/OFX, CSV, and PDF bank statements. QFX/OFX and CSV files are parsed entirely on your device. A PDF that contains a text layer is read directly on your device using a bundled PDF library, with no image recognition and no ML Kit involvement. Only a scanned PDF, which has no text to read, is rendered to images locally and passed to the on-device ML Kit recognizer. Statement files, transaction contents, and recognized text are never uploaded; only the ML Kit diagnostics described above are sent.

Receipt photos

PingBudget requests neither camera permission nor photo-library or storage permission. When you use its camera button, Android writes the capture to an app-private temporary cache. PingBudget reads it locally and deletes it after the scan, including after a failure or cancellation. At its next process launch, PingBudget also removes abandoned captures older than one hour.

If you choose an existing image through Android's photo picker, PingBudget reads it where it is and never copies, alters, or deletes it. Receipt images and the text read from them are never uploaded.

Before a receipt is read, PingBudget offers a screen to crop and rotate the photo, and then adjusts its own working copy — resizing it, converting it to greyscale and increasing its contrast — to make the text easier to recognize. All of that happens in memory on your device. Your original photo is not modified, and the working copy is discarded once the scan finishes.

Bank and payment notifications

Automatic capture is optional. If you enable Android's notification-listener access, PingBudget uses a fixed allowlist of known bank and payment apps and ignores notifications from all other apps before parsing. Capture may operate while PingBudget is closed.

For a supported financial alert, PingBudget may read the title and body to identify the amount, merchant, direction, limited card or account digits, and the account balance when your bank includes one. It retains the original alert title and body on the local transaction so you can correct a bad match later, and keeps the most recent balance for each account in private app storage so it can be shown on the Overview tab. Individual sources can be excluded in Settings. PingBudget never asks for, stores, or uses your banking username or password, and it never signs in to your bank.

Local budget alerts

If you configure an alert, PingBudget evaluates it entirely on this phone when a new live bank or payment notification creates a transaction. Alert settings and once-per-month markers stay in private app storage.

A system notification may contain the merchant, amount, date, budget category, or amount remaining needed to explain the alert. None of that information is sent to PingBudget's developer or to a PingBudget server. Android 13 and later asks for notification-posting permission when you first save an enabled alert; you may decline it and continue using every other feature.

Encrypted backups

You may create encrypted backups and optionally schedule them. A backup contains the full ledger. Ledger content is encrypted with AES-256-GCM using a key derived from your passphrase with PBKDF2-HMAC-SHA256 and 600,000 iterations. For automatic backups, PingBudget can remember the passphrase sealed with Android Keystore so Android WorkManager can write a scheduled backup while the app is closed.

Backup files are written only to the folder you choose. A cloud-storage provider may sync an encrypted file in that folder under its own policy; PingBudget and its developer do not receive it. The backup envelope's non-sensitive header—including format, creation time, and algorithm parameters—is not encrypted; the ledger content is encrypted. Backup files saved outside the app are not removed by “Delete all app data” or uninstalling PingBudget, and must be deleted separately from their saved location.

Biometric unlock

If you enable app unlock, PingBudget never sees your fingerprint, face, or PIN. Android performs the check and tells PingBudget only whether it passed.

No ads or developer tracking

PingBudget contains no advertising, Firebase, first-party analytics, developer telemetry, or crash-reporting service. Nobody is measuring which screens you open or what you spend. The Google ML Kit diagnostics described above are the only exception to this no-tracking approach.

Optional tips

PingBudget is free and nothing in it is behind a paywall. The app offers an optional tip link. Tapping it opens a Stripe checkout page in your browser; PingBudget itself sends nothing and receives nothing. Your card number never reaches PingBudget or its developer.

Stripe collects and processes the payment, contact, and transaction details needed to take the payment, and it does so as an independent company under its own privacy policy. The developer can see the ordinary record of a completed payment that any Stripe account holder sees, and uses it only for accounting. A tip unlocks no features, content, or badges, PingBudget keeps no record of who tipped, and the app behaves identically whether you tip or not.

How to delete your data

PingBudget has no account and no server. There is nothing to request from the developer, no form to submit, and no waiting period — every copy of your data is on your own phone, and you can erase all of it yourself in a few seconds.

Delete everything

  1. Open PingBudget and go to Settings.
  2. Tap Your data to expand that section.
  3. Tap Delete all app data.
  4. Read the confirmation, then tap Delete everything.

This permanently removes every transaction, budget limit, category rule, and paycheck schedule from the phone, and it also forgets any backup passphrase PingBudget was holding in Android Keystore. It cannot be undone, and because nothing is stored on a server there is no copy anywhere to restore from — only a backup file you saved yourself.

Delete a single transaction

Tap any transaction to open its details, tap Delete, and confirm. This is the right tool for removing one mis-read bank alert rather than starting over.

Delete your backup files

Backups you exported are ordinary files in whichever folder you chose, and they are not touched by Delete all app data or by uninstalling. To remove them, delete them yourself from that folder using your phone's Files app or the cloud-storage app that holds them. If the folder was synced to a cloud provider, delete the provider's copy too.

Delete everything by uninstalling

Uninstalling PingBudget removes its private storage along with it, which erases the whole ledger. Exported backup files still survive, as above.

Data held by others

The Google ML Kit diagnostics described above are sent to Google, not to PingBudget, and the developer cannot see them or delete them; they are governed by Google's privacy policy. If you sent an optional tip, the payment record sits with Stripe under its own privacy policy and is kept for the period Stripe's terms and applicable tax law require. Neither of these contains your financial records, budgets, or transactions.

Retention

Your local data remains on the phone until you delete it by one of the methods above. Temporary camera captures are deleted after scanning or by the abandoned-cache cleanup described above. PingBudget has no server copy and no account to close.

Questions about deletion

If any of the above does not work as described, email pingbudget@gmail.com.

Permissions in plain language

Contact

Developer: Brian Smith
Privacy and feedback: pingbudget@gmail.com