Privacy Policy - EZer Finance App

Platform: iOS | Effective Date: January 1, 2025 | Last Updated: October 2, 2026 | App version: 2.1.1

In short:

Your financial data is stored in an encrypted database on your iPhone or iPad.
It leaves your device only when you export it or turn on a cloud feature: AI statement parsing or cloud backup. Each is optional and explained below.
Even if you use no cloud feature, the app uses an anonymous account ID, an app-integrity check and crash reports (see sections 3 and 4).
We do not sell your data, we do not show ads and we do not track you across other companies' apps or websites.

1. Introduction

Welcome to EZer, a personal finance management application. This Privacy Policy explains what information the EZer iOS app (version 2.1.1) handles, where it is stored, who receives it and how you can control it.

Data controller: Jeremiah Divyan David (trading as EZer), Kanchipuram, Tamil Nadu, India
Privacy contact: privacy@ezerapp.com

2. Information Stored on Your Device

The following information is stored on your device in an encrypted SQLCipher database (AES-256):

Financial Transactions: Income, expenses, transfers with dates, amounts, categories, and notes
Accounts: Bank accounts, credit cards, wallets (names and balances only - no account numbers or login credentials)
Budgets: Budget categories, limits, and spending tracking
Goals: Financial goals, target amounts, and progress
Bills: Recurring bill reminders and payment history
Loans: Loan tracking information (principal, interest rate, EMI)
Categories: Custom transaction categories
Receipts: Receipt images you attach and the text read from them
App Settings: User preferences, theme selection, language, currency, region

Transactions are categorized on your device using built-in merchant rules and the corrections you make. Spending insights are calculated on your device. We do not send your transactions off your device for categorization.

Important: If you delete the app or lose your device, this data cannot be recovered unless you have created a backup (section 6).

We NEVER ask for bank account passwords or login credentials, full credit/debit card numbers, CVV/PIN codes, Social Security Numbers or government ID numbers. If a statement you send for AI parsing shows your name, your bank's name or the last digits of an account, those details can appear in the parsed result that we store (see section 5).

3. Information Sent to Our Servers for All Users

Our servers run on Google Cloud (Firebase). The following happens even if you never turn on a cloud feature:

3.1 Anonymous account ID

When the app first starts, it creates an anonymous account with Firebase Authentication. This account has a random identifier and no name or email. The app uses it to authenticate its requests to our servers (Google Cloud Functions), for example to check your EZer Plus subscription, to record your privacy choices, to look up currency rates and, if you use them, for AI statement parsing and cloud backup.

3.2 App integrity check

To protect our servers from abuse, the app uses Firebase App Check with Apple DeviceCheck. Apple and Google check that the request comes from a genuine copy of EZer on a genuine Apple device, and the resulting token is sent with the app's requests to our servers.

3.3 Subscription status and purchases

Purchases of EZer Plus and credits are handled by Apple through the App Store. We never receive your payment card details. After a purchase, the app sends the App Store transaction record to our server, which verifies it with Apple and stores the transaction identifiers, product, purchase and expiry dates, linked to your account ID. Apple also sends our server notifications about renewals, cancellations and refunds of EZer purchases. While you use the app, it asks our servers for your current EZer Plus status (about once an hour, sooner after a failed attempt).

3.4 Privacy choice records

When you give or withdraw a consent in the app (for example crash reporting, analytics or AI statement parsing), a record is sent to our servers: the consent type, whether it was given, the time, the policy version, the app version, the platform and your account ID. We keep these records as proof of your choices (see section 9).

3.5 Currency rate lookups

When you have accounts or transactions in more than one currency, the app asks our server for an exchange rate. The request contains only the two currency codes and a date, together with the anonymous account ID and app-integrity token that every request to our servers carries. No amounts or transaction details are sent. Our server obtains rates from the European Central Bank and keeps them in a cache organised by date and currency pair that is not linked to you.

3.6 App configuration

The app downloads configuration settings (for example, switching a feature on or off) from Firebase Remote Config. The request identifies the app installation with a Firebase installation ID. Nothing about your finances is sent.

3.7 Device information

Device model, iOS version and app version (used on your device and included in crash reports)
Device language and time zone (used on your device)
A random installation ID created by the app (not your advertising identifier). It is attached to AI parsing history records and to feedback you choose to send, so that feedback sent from your device can be deleted when you delete your data.
A Firebase installation ID, used by crash reporting, app configuration and push notifications

EZer does not access the advertising identifier (IDFA) and does not ask for App Tracking Transparency permission.

4. Crash Reporting and Analytics

4.1 Crash Reporting (Legitimate Interest, on by default)

We collect crash reports and non-fatal error logs through Firebase Crashlytics under our legitimate interest in keeping the app stable (GDPR Article 6(1)(f); equivalent legal bases under DPDPA and similar frameworks). Reports include:

Crash stack traces and error context
Device model, operating system version, and app version
A Firebase installation ID and app session information (Firebase Sessions)
For some errors, the internal identifier of the record involved (for example a transaction ID), never its contents
Approximate region (derived from IP; the IP itself is not stored)

We do not add your transactions, balances or names to crash reports. Crash reporting is on by default but you can turn it off at any time in Settings → Privacy Dashboard → Crash Reporting.

4.2 Usage Analytics (opt-in, off by default)

Usage analytics are off by default. If you turn them on in the Privacy Dashboard, Google Analytics for Firebase receives the app features you use and the screens you view, without transaction amounts, merchant names or account details. You can turn them off again at any time.

5. AI Statement Parsing (EZer Plus, Optional)

AI statement parsing reads a bank or credit card statement that you choose (PDF, image or CSV) and turns it into transactions. It is off until you give consent in the app, and you can withdraw consent at any time in Settings → Privacy Dashboard. All other features keep working without it.

What is sent, and to whom:

The app sends the statement file (or, for CSV, its text) to our server on Google Cloud over an encrypted connection, together with the country and currency codes, the statement type, the page count, the names of your categories (so the AI can suggest one), the app installation ID and your account ID.
Our server sends the statement content, country and currency codes, statement type and category names to Anthropic (Claude), which extracts the transactions. It does not send your account ID, name or email to Anthropic.
Anthropic processes the statement on our behalf under its API terms and is located in the United States. It may keep what it receives for a limited period (for example, up to 30 days) for abuse and misuse monitoring, as described in its own terms.

What we keep on our servers:

The statement file itself is not stored on our servers.
Parse cache: the parsed result (transactions with their dates, descriptions and amounts, and any account holder name, bank name or last digits of an account that appear on the statement) is stored in our database (Google Cloud Firestore), linked to your account, so that parsing the same statement again is instant and not charged again.
Parse job: the result is also saved with the parse request, so you still receive it if the app is closed or loses its connection while parsing.
Parse history: for billing and support we keep a record of each parse: date, model used, country, currency, statement type, page count, number of transactions, credits charged and the app installation ID. It does not contain transactions.
Retention: the parse cache, parse jobs and parse history are kept until you delete your data with Delete All Data (section 10.3), which removes them. There is no automatic expiry. If you do not want parsed results kept, turn on "Don't cache my statements on our servers" (below).

Turning the cache off: in Settings → Security Settings, switch on "Don't cache my statements on our servers". While it is on, the parsed result is not stored in the parse cache or with the parse job (only the job's status is kept); the parse history record is still kept, and every parse is charged.

Reporting a parsing problem (optional, separate consent): if you report a problem with a parsed statement, we receive the parsed transactions (not the statement file), your description, the country and currency codes, the model, the page count, error details, the app version and the app installation ID. We use it only to improve parsing. These reports are deleted with Delete All Data.

6. Sign-In and Backups

6.1 Optional sign-in

Sign-in is optional. It is required only for backups. You can sign in with Apple, Google or Microsoft. Our authentication service (Firebase Authentication, provided by Google) then receives the name, email address and account identifier that the provider shares. If you use Sign in with Apple and choose "Hide My Email", we receive only the relay address Apple creates.

6.2 Backups (local and cloud)

Every backup file, local or cloud, is encrypted on your device with AES-256 before it is saved or uploaded. Cloud backup (iCloud Drive, Google Drive or Microsoft OneDrive) is part of EZer Plus and is started by you in Settings → Backup & Restore. The encrypted file is stored in EZer's app folder in the cloud storage account you choose (for iCloud, EZer's iCloud container on your Apple ID). Our servers never receive the backup file, and we cannot access your cloud storage account.

The backup encryption key:

The key is generated for your EZer account and stored on our servers (Google Cloud Firestore), so that you can restore a backup on a new device by signing in with the same account. The app also keeps a copy on your device so backup and restore work offline.
The key can be read only through our authenticated server function for your own account. Because the key is on our servers, EZer could in principle decrypt a backup file if it obtained one; we never receive the file. People with administrative access to our cloud project could technically access the key; we do not access it.
Deleting your EZer data with Delete All Data deletes the key. After that, existing backup files can no longer be restored.

What's backed up: transaction history, account information, budget, bill, loan and goal data, app preferences, receipt records and attachments.

Third parties: Apple iCloud (Apple Privacy Policy), Google Drive (Google Privacy Policy), Microsoft OneDrive (Microsoft Privacy Statement). They receive the encrypted backup file only; the key is not stored with the file.

7. Receipt Scanning and Notifications

7.1 Receipt scanning

When you scan a receipt, its text is read on your device with Google ML Kit. Nothing is sent to Google for this. The receipt image and the text read from it are stored on your device.

Receipt scan feedback (optional): the app asks before the first time this is sent, and you can choose "No thanks". If you choose to share a scan that did not read correctly, we receive the receipt image with its top and bottom blurred, the scanned text with card numbers, names and phone numbers removed, the corrections you made, your region, the OCR engine and confidence, the app version and the app installation ID. If the image cannot be blurred (for example a PDF), nothing is sent. We use it only to improve receipt scanning. It is stored in Cloud Firestore and Cloud Storage for Firebase and is deleted with Delete All Data.

7.2 Notifications

Bill payment reminders, budget limit alerts and goal milestones are generated locally on your device. If you are signed in, the app also registers a push notification token (Firebase Cloud Messaging, delivered through Apple Push Notification service) with your platform and app language, so that our servers can send you notifications. You can turn notifications off in iOS Settings or in the app.

8. iOS Permissions

EZer requests the following iOS permissions only when needed. All are optional:

Camera: To scan receipts
Photo Library: To attach receipt images to transactions, and to save scanned receipt images if you choose
Face ID / Touch ID: To lock the app with biometric authentication
Notifications: To send bill reminders and budget alerts

EZer does not request access to your location, contacts, microphone, SMS messages or clipboard monitoring. SMS transaction import is not available on iOS. All permissions can be revoked anytime in iOS Settings → EZer.

9. Data Held on Our Servers

This is everything we hold about you on our servers, and for how long:

Data	When	Kept until
Anonymous account ID	All users	Delete All Data (uninstalling the app does not remove it)
Sign-in account (name, email, provider ID)	If you sign in	Delete All Data
Subscription and purchase records (App Store transaction identifiers), credit balance and credit history	If you buy EZer Plus or credits	Delete All Data
Privacy choice records	All users	Delete All Data; a copy without your account ID (replaced by a one-way pseudonym) is kept for 7 years as proof of consent
AI parse cache, parse jobs, parse history	If you use AI statement parsing	Delete All Data; no automatic expiry. Parse cache and parse jobs are not kept while "Don't cache my statements on our servers" is on
Parsing problem reports and receipt scan feedback	Only if you send them	Delete All Data (including receipt images)
Backup encryption key	If you use backup	Delete All Data (existing backups then cannot be restored)
Push notification token with platform and app language	Signed-in users only	Delete All Data
Crash reports (Firebase Crashlytics)	Unless you turn crash reporting off	The retention period set by Firebase Crashlytics (not removed by Delete All Data)

Data on our servers is processed by Google Cloud (Firebase). Our server functions run in the United States (us-central1); our database is located in India (Mumbai, asia-south1).

10. Your Privacy Rights and Controls

10.1 Privacy Dashboard

Access: Settings → Privacy Dashboard

Give or withdraw consent for usage analytics, crash reporting, AI statement parsing and AI parsing problem reports
View the history of your consent changes
Export my data
Delete All Data

The anonymous account ID and the app-integrity check cannot be turned off, because the app's requests to our servers depend on them.

10.2 Data Portability

Settings → Privacy Dashboard → Export my data creates one ZIP file: transactions.csv, accounts.csv, budgets.csv and categories.csv, your settings and privacy choice history as JSON files, and a README. PDF and Excel reports are available from Reports.

Exported files are not encrypted. Anyone you share the file with, or anyone who can open it on your device or storage, can read it. To keep an encrypted copy, use Backup.

10.3 Right to Deletion (Delete All Data)

Settings → Delete Account, or Settings → Privacy Dashboard → Delete All Data (both run the same deletion, called "Delete All Data" in this policy)
Confirm deletion by typing DELETE (this is permanent)
The app first asks our server to delete your server-side data, then wipes the EZer database on your device. A few local settings (for example the app-lock PIN and cached sign-in tokens) may remain on the device until you uninstall the app
On our servers we delete: your account (anonymous or signed-in), subscription and purchase records and the link between your store purchase and your account, credits, AI parse cache, parse jobs and parse history, parsing problem reports and receipt scan feedback (including images), privacy choice records (a pseudonymized proof-of-consent copy is kept for 7 years), your push notification tokens and your backup encryption key
Backup files already in your own cloud storage account stay there until you delete them, but they can no longer be restored because the key is deleted
Exported files you saved or shared are not affected. We cannot recover deleted data

Deleting your EZer data does not cancel an App Store subscription. Manage or cancel it in iOS Settings → your name → Subscriptions. If deletion from our servers fails in the app, you can retry or email privacy@ezerapp.com. You can also request deletion at https://www.ezerapp.com/data-deletion.html. We complete deletion requests within 30 days.

11. Data Security

SQLCipher Encryption: All data on your device is stored with 256-bit AES encryption
Secure Storage: The database key and other sensitive values are stored in the iOS Keychain; EZer does not upload the database key
App Lock: Optional Face ID / Touch ID protection
App switcher cover: When EZer goes to the background, its screen is covered so your finances do not appear in the app switcher
Encrypted backups: Backups are encrypted on your device before upload (key held on our servers, see section 6.2)
Network: TLS for all network communications; requests to our servers must carry a valid account token and, for most functions, a valid app-integrity token; database access rules limit each user to their own data

We have not yet commissioned an independent security review. If you find a security problem, please report it to privacy@ezerapp.com.

12. Service Providers

We do not sell your data and do not share it with advertisers or data brokers. These providers process data on our behalf:

Provider	Purpose	When
Google Firebase (Authentication, Cloud Functions, Cloud Firestore, App Check, Remote Config, Cloud Storage)	Anonymous account, server functions, database, app-integrity check, app configuration, receipt feedback images	All users
Firebase Crashlytics	Crash reports	On by default, can be turned off
Google Analytics for Firebase	Usage analytics	Only if you opt in
Firebase Cloud Messaging / Apple Push Notification service	Push notifications	Signed-in users
Apple (App Store, DeviceCheck, Sign in with Apple, iCloud)	Purchases, app-integrity check, optional sign-in, optional backup	As described above
Anthropic (Claude API)	AI statement parsing	Only if you use AI statement parsing
Google Sign-In, Google Drive; Microsoft sign-in, OneDrive	Optional sign-in and encrypted backup storage	Only if you choose them
Google ML Kit	Receipt text recognition on your device	Nothing is sent
European Central Bank	Public exchange rates downloaded by our server	Nothing about you is sent

Firebase privacy information: https://firebase.google.com/support/privacy

We may disclose information if required by law, in response to valid legal requests, to protect our rights, to investigate fraud or security issues, or to protect user safety.

13. International Data Transfers

Your financial data is stored locally on your device
Data held on our servers (section 9) is processed by Google Cloud in the United States and India
AI statement parsing sends statement content to Anthropic in the United States
Cloud backups are stored by your cloud storage provider in locations that depend on your account with them
When your data is transferred outside your country (to Google Cloud in India and the United States, and to Anthropic in the United States for AI statement parsing), we rely on the European Commission's Standard Contractual Clauses (and, for UK users, the UK International Data Transfer Addendum) included in Google's Cloud Data Processing Addendum and Anthropic's Data Processing Addendum. You can ask us for a copy of the relevant safeguards at privacy@ezerapp.com.

14. Legal Basis for Processing (GDPR)

Data	Legal Basis
Account information (anonymous ID, sign-in details), transaction data, subscription and purchase records, currency rate lookups	Contract
App-integrity tokens, crash reports	Legitimate interest
Usage analytics, AI statement parsing, parsing problem reports, receipt scan feedback, backups	Consent
Privacy choice records	Legal obligation

15. Children's Privacy

EZer is intended for adults and is not intended for use by anyone under the age of 18. We do not knowingly collect information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

16. Compliance

We aim to comply with the Digital Personal Data Protection Act, 2023 (India), the General Data Protection Regulation (EU), applicable US state privacy laws, and the App Store Review Guidelines on data collection and storage.

17. Financial Disclaimer

Important: EZer is a personal finance tracking tool. It does not connect to your bank accounts, and we do not provide financial, investment, tax or legal advice, loans or credit. Any financial decisions you make are your sole responsibility.

18. Changes to This Privacy Policy

We will update the "Last Updated" date at the top
Major changes will be announced in the app
If a change affects a feature you have consented to (such as AI statement parsing), the app asks you to confirm your consent again

19. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

Data controller: Jeremiah Divyan David (trading as EZer), Kanchipuram, Tamil Nadu, India

Privacy: privacy@ezerapp.com

Support: support@ezerapp.com

Website: https://www.ezerapp.com/privacy-ios.html

Response Time: Privacy requests within 7 business days; data deletion requests within 30 days.