01 / Scope
Who this policy covers
This Privacy Policy applies to the Quota mobile application for Android, published by atharvbyadav ("the Developer"). It describes how the app handles information when you download and use it.
Quota is a personal budgeting and expense-tracking app. It was built around one rule: your financial data is yours, it stays on your device by default and nothing about how you use the app is collected, sold or monitored by us or anyone else.
02 / The short version
What Quota does not collect
Before the details, the list that actually matters:
- No account is required. Quota doesn't ask for your name, email or phone number to function.
- No analytics or usage tracking. The app does not include any analytics SDK, crash-reporting SDK or advertising SDK of any kind.
- No advertising. Quota shows no ads and does not share data with ad networks, because it doesn't work with any.
- No selling of data. There is no data to sell — we don't have a copy of it. It's on your phone.
- No remote server we operate. Quota does not have a backend server that your financial data is sent to. The app talks to the internet in two situations, both optional and both described below: the Google Drive backup feature (Section 4) and live exchange-rate lookups (Section 5).
If you never turn on Google Drive backup and never look up a live exchange rate, Quota never uses your internet connection at all. Live exchange-rate lookups only ever send a currency code (e.g. "INR" and "USD") — never any of your transaction data, amounts or account information.
03 / Local storage
Data stored on your device
Quota stores the following information locally, in an encrypted database on your phone (see Section 7 for how):
- Transactions you enter: amounts, dates, categories, notes and which wallet they belong to
- Wallets, categories, budgets, savings goals, subscriptions and recurring transaction rules you set up
- Your spending quota settings (income, savings target, fixed expenses and the calculated quota)
- App preferences: theme, currency, PIN/biometric lock settings
None of this is transmitted anywhere unless you explicitly export a backup file or turn on Google Drive backup. Uninstalling the app or using the in-app "Delete all data" control, permanently erases it from your device.
04 / Optional feature
Google Drive backup
Quota includes an optional, off-by-default backup feature that uses your own Google Drive. Here is exactly what it does and doesn't do:
- Off unless you turn it on. Nothing related to Google Drive happens until you tap "Connect Google Drive" and complete Google's own sign-in screen.
- One scope, nothing else. Quota requests exactly one Google permission scope:
drive.appdata. This scope does not allow Quota to see, list or touch any other file in your Drive — only a single hidden, app-specific storage area that isn't visible in your normal Drive interface.
- Encrypted before it ever leaves your phone. The backup file is encrypted on your device (AES-256-GCM, with a password only you know) before it is uploaded. Google's servers store an encrypted blob — not your transactions, not your balances, not anything readable. We do not hold a copy of your backup password and cannot recover it for you.
- Nothing is uploaded automatically. A backup is only created when you tap "Back up now." There is no background or scheduled sync.
- You can disconnect at any time. Disconnecting in the app stops Quota from using your Google account. To fully revoke Quota's access at the Google account level, visit your Google Account's third-party access settings.
Google API Services disclosure. Quota's use and transfer of information received from Google APIs to any other app will adhere to the
Google API Services User Data Policy, including the Limited Use requirements. Data obtained through the Drive API is used solely to store and retrieve your own encrypted backup file and is never used for advertising, never read by a human and never used to train any machine learning or AI model.
05 / Optional feature
Live exchange rates
When you log a transaction in a currency other than your chosen base currency, Quota can automatically fill in the current exchange rate instead of you looking it up and typing it in by hand.
- On by default and always overridable. You can turn this off entirely in Settings → Currency → "Live exchange rates." When off, Quota makes no network calls for this feature and you enter every foreign-currency rate manually, fully offline. When on, you can still edit any auto-filled rate by hand before saving.
- What gets sent. Only the two currency codes involved (e.g. "INR" and "USD") are sent as part of the request URL. No transaction amounts, notes, locations, wallet names or any other data leave your device for this feature — the app has no way to attach that information to the request even if it wanted to.
- Who it's sent to. Quota requests current rates from a free, keyless public exchange-rate service (fawazahmed0/currency-api), delivered via two independent content-delivery networks (jsDelivr and Cloudflare Pages) so a single provider outage doesn't break the feature. We have no relationship with either provider beyond making anonymous HTTPS requests to publicly documented endpoints — no account, no API key, no data-sharing agreement.
- What they can see. Like any web request, these CDNs can see your device's IP address and which currency pair you looked up, the same way any website you visit can. This is standard web request metadata, not something Quota adds on top — we don't attach any Quota- or user-identifying information to the request.
- Not real-time market data. Rates are refreshed by the provider roughly once a day, not tick-by-tick. Quota never bundles or hardcodes a rate — every lookup goes out to the network for whatever is currently published — but this is appropriate for logging an expense, not a trading feed.
- Cached for offline use. The last rate fetched for each currency pair is saved on your device so the field still has a sensible starting value if you're offline later — clearly labeled as not live when that happens. This cached data is just numbers (a rate and a date), never linked to any transaction.
06 / Permissions
What each permission is for
Android requires apps to declare what they need access to. Quota requests the minimum needed for its own features and nothing else:
- Biometric (fingerprint / face unlock): used only to unlock the app itself, via Android's own Keystore system. Your fingerprint or face data is handled entirely by the operating system — Quota never receives, stores or has access to that biometric data in any form.
- Notifications: used for local reminders you set yourself (like an upcoming subscription renewal). These are generated and shown entirely on your device — no notification content is sent to or from a server.
- Internet: used by two independently toggleable features — the optional Google Drive backup (Section 4) and live exchange-rate lookups (Section 5), on by default but switchable off in Settings. Neither feature transmits your financial data; see those sections for exactly what each one sends.
Quota does not request access to your contacts, location, camera, microphone, call logs, SMS or any other sensitive Android permission not listed above.
07 / Security
How your data is protected
- Database encryption: the local database is encrypted with SQLCipher (AES-256), with its encryption key held in the Android Keystore, hardware-backed where the device supports it.
- App lock: if you set a PIN, it's never stored in plain text — it's hashed with PBKDF2-HMAC-SHA256 (60,000 iterations) plus a random salt, with escalating lockout delays after repeated failed attempts.
- Backup files: both local export files and Google Drive backups are encrypted with AES-256-GCM, with the encryption key derived from your chosen password via PBKDF2 (210,000 iterations). This means the backup file cannot be opened by anyone — including us — without that password.
- No plaintext transmission: the only data Quota ever sends over the internet is the encrypted backup blob described in Section 4, sent over HTTPS.
No method of storage or transmission is 100% secure and we can't guarantee absolute security. But the design goal throughout is that even if a backup file were intercepted or Google's servers were compromised, an attacker would have only unreadable ciphertext without your password.
08 / Retention
How long data is kept and how to delete it
- On your device: data is kept until you delete it yourself — via the in-app "Delete all data" control, by deleting individual entries or by uninstalling the app.
- Local backup files: you control these entirely; they exist only where you choose to save them.
- Google Drive backup: the encrypted backup file remains in your Drive's app-data storage until you delete it — either by uploading a new backup (which replaces the old one) or by disconnecting Quota's access and removing the file via your Google Account settings.
Because we don't operate a server that stores your data, there is no copy on our end to retain or delete — deleting it on your device (and, if used, in your Drive) removes it entirely.
09 / Sharing
Who we share information with
We do not sell, rent or trade your information. We do not share it with advertisers, data brokers or analytics companies, because we don't work with any.
The third parties involved in Quota are Google (only if you enable Google Drive backup) and the exchange-rate CDNs described in Section 5 (only if live exchange rates are on, which is the default). Neither receives your financial data — see the relevant section for exactly what each one is sent.
We may disclose information if required to by law, but since we don't hold your financial data ourselves, there is generally nothing on our servers to disclose.
10 / Children
Children's privacy
Quota is not directed at children under 13 (or the equivalent minimum age in your region) and we do not knowingly collect personal information from children. Since Quota does not collect personal information from any user in the first place, this is largely academic — but if you believe a child has provided information through the app in a way that concerns you, contact us using the details in Section 14.
11 / Your rights
Your rights and choices
Depending on where you live, laws like the GDPR (EU/UK) or the CCPA/CPRA (California) give you rights over your personal data — access, correction, deletion, portability and the right to opt out of sale or sharing. Here's how those apply to Quota in practice:
- Access & portability: your data is already on your device. You can view it in the app at any time or export it as a CSV, PDF report or full encrypted backup file whenever you like.
- Deletion: use "Delete all data" in Settings or uninstall the app. If you've used Google Drive backup, also delete the backup file via your Google Account settings.
- Correction: edit or delete any entry directly in the app.
- Sale or sharing of data: we don't sell or share your data, so there is nothing to opt out of. We do not sell personal information as defined under the CCPA/CPRA and do not respond differently to Global Privacy Control signals because we do not perform the tracking those signals are meant to stop.
12 / International use
Where your data lives
Because Quota stores data locally, your information stays on your device regardless of where you are. The one exception is the optional Google Drive backup: if enabled, your encrypted backup file is stored on Google's infrastructure, which may involve servers outside your country, subject to Google's own data handling practices.
13 / Updates
Changes to this policy
If we change what data Quota accesses, collects or how it's used — particularly regarding Google user data — we will update this policy and where required, prompt you to review and accept the changes before continuing to use the affected feature. The "Last updated" date at the top of this page always reflects the most recent version.