Privacy Policy

Updated October 2026 · Bản tiếng Việt

Who is responsible

Sổ Thu Chi is published, and its server operated, by independent developer Đào Huy Phương. Send any question or request about personal data to huyphuongk57ktb@gmail.com.

Where your data lives

Every transaction, wallet, category, budget and goal is stored in a database file on your own device, protected by the operating system and by Face ID lock if you turn it on.

What leaves your device

• When you sign in: your email or Apple account, display name, device name and app version, to recognise your account and the devices signed in to it; the server issues a random device identifier that the app keeps.
• When you turn on sync (Pro) or create or join a shared book: that book’s data (transactions, wallets, categories, budgets, goals) is sent to the server over encrypted HTTPS. In a shared book, your display name is shown to the book’s other members.
• When you buy Pro: the server stores the App Store transaction ID to confirm your purchase.
• When you sign in on an iPhone: that device’s notification token (push token), even before you allow notifications to be shown, used only to notify you of shared-book activity and wake the app to sync; deleted when you sign out, revoke the device or delete your account.
• When you sign in with Apple: the server stores the token Apple issues, only to revoke the link when you delete your account.
• On the free version: Google AdMob receives data to show ads (see Ads).

Technical logs of the app and the server never record amounts, notes, wallet or category names, or full email addresses.

Sync is your choice

Without signing in, your ledger never leaves your device; on the free version, Google AdMob still receives a device identifier and your IP address to show ads. Once you sign in and turn on sync, your ledger goes to the app’s server so your devices share it.

Sign-in

You sign in with Apple or with a 6-digit code sent to your email. Your email is used only to identify your account and to send sign-in codes, never for marketing. If you hide your email when signing in with Apple, the server only sees the relay address Apple provides.

Ads

The free version uses Google AdMob with non-personalised ads. The app never asks for tracking permission (App Tracking Transparency) and never shares your ledger with an ad network. Google AdMob receives the identifier for vendor (IDFV; not the advertising identifier IDFA), your IP address and the approximate location derived from it, device information, ad interactions and SDK diagnostic data to serve and measure ads and to prevent fraud. See Google’s policy at policies.google.com/privacy. With Pro the app no longer loads ads.

Diagnostic data

The app includes no third-party crash reporting or analytics tool other than Google AdMob. Diagnostic data (crashes, performance) comes only from the ad SDK on the free version, as above, and from the crash reports Apple shares with developers if you have turned on “Share With App Developers” in your iPhone settings.

Usage analytics

The Usage analytics switch is off by default. When on, the app only counts a few actions, such as how often it is opened or how many entries were saved, and those counts stay on your device.

How long data is kept

• Your account, synced books and account activity history (sign-ins, books created, exports): until you delete your account.
• Earlier versions of an entry overwritten during sync (to resolve conflicts between devices): 90 days.
• Closed shared books: 30 days, then erased, so an owner who closed one by mistake can ask for it back.
• Exported Excel/PDF files: 24 hours. Expired sign-in codes and sessions: removed periodically.
• Server database backups: at most 14 days.

Deleting your account

You delete your account inside the app (More ▸ Account & sync ▸ Delete account). Your account, personal book, devices, recorded Pro purchase and activity history are then erased from the server for good, and the Sign in with Apple link is revoked. Shared books you own pass to a remaining member (or are erased if nobody is left); the entries you recorded in shared books stay with the people in them. The data on your device stays until you remove the app or delete it yourself. Server database backups are kept for at most 14 days and then deleted automatically; any off-server backup follows the same cycle.

Contact

Questions about personal data: huyphuongk57ktb@gmail.com.