Privacy Policy

1. Introduction

Welcome to MoneyRoo. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your information when you use our budget and savings mobile application and related services (collectively, the "Service").

By using MoneyRoo, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us:

• Account Information: Name, email address, and any profile details you choose to add
• Budget Data: Category budgets, monthly totals, and spending limits
• Expense Data: Transactions, amounts, categories, and notes
• Goals: Savings goals, target amounts, and progress
• Communications: Messages you send through our support channels

2.2 Gmail Transaction Import

If you choose to connect a Gmail account, we request read-only access to Gmail through Google OAuth. We may process message metadata such as the sender, subject, message ID, date, and snippet, and the content of a matching transaction email. We do not request or process email attachments for this feature.

Gmail access is optional. You can disconnect an account or revoke access from your Google Account at any time. Imported items wait for review by default. If you explicitly enable automatic posting for a tested rule, future matching alerts can update your ledger without individual approval.

2.3 Information Collected Automatically

When you use our Service, we may automatically collect:

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Features used, actions taken, time spent in the app
• Log Data: IP address, access times, pages or screens viewed

2.4 Information from Third Parties

We may receive information from third-party authentication providers when you sign in (e.g., email or social login).

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Store and sync your budgets, expenses, and goals
• Create and manage your account
• Import transaction information from Gmail messages when you enable Gmail import and approve the resulting candidates or explicitly enable automatic posting for a tested rule
• Use sender and subject rules that you configure to identify future transaction emails
• Use an automated extraction service to propose transaction amount, date, type, merchant, description, account, and category from a matching email; you can edit these fields before approval
• Provide customer support and respond to your requests
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues
• Comply with legal obligations and enforce our terms
• Send important updates about our Service (with your consent for marketing)

4. Data Sharing and Third-Party Services

4.1 Third-Party Service Providers

We work with trusted third-party service providers to operate our Service:

• Firebase and Google Cloud: Authentication, backend processing, database storage, and secure operation of Gmail synchronization
• Google: Gmail API and Google OAuth provide the read-only connection you authorize
• OpenRouter: We transmit the content of a matching transaction email, or a sample you ask us to analyze, to OpenRouter and its selected AI providers to propose transaction fields or extraction patterns. Categorization sends merchant names, transaction types, and your category names and identifiers, without the source email body or amount. We restrict requests containing Google-derived data to endpoints that do not retain the request content or use it for model training. If no compliant endpoint is available, the AI request fails rather than using a less private route.
• PostHog: Product analytics and service performance insights. We do not send Gmail message bodies, subjects, sender addresses, or access tokens to analytics.

These providers only have access to information necessary to perform their functions and are obligated to maintain confidentiality.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental request, or to protect our rights, property, or safety, or that of our users or the public.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We obtain your explicit prior consent before transferring Google user data as part of such a transaction.

4.4 Gmail Transaction Import and Google API Data

MoneyRoo uses Gmail data only to provide the transaction import feature you request: finding matching messages, extracting transaction details, creating review candidates, and applying imports after your approval or through a tested rule whose automatic posting you have explicitly enabled. We do not sell Gmail data, use it for advertising, or use it to create an advertising profile.

We use the minimum Gmail permission needed for this feature, currently read-only Gmail access and your Google account email address for connection identification. We do not use Gmail data for unrelated purposes. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google-derived data to train or improve general AI models, or permit our processors to do so.

Open Profile → Email sync → your Gmail connection to disconnect it or choose Remove import data. Disconnect stops new imports and revokes Google access. Removing import data also removes connection details, mappings and import review records. Approved ledger transactions remain until you delete those transactions or your MoneyRoo account. Account deletion also removes attributable bank-support submissions and failure records. You can revoke access in your Google Account settings and contact help@moneyroo.app for help with data requests.

4.5 Gmail Processing and AI Limitations

We fetch message metadata before fetching a message body. A body is fetched during normal synchronization after a configured sender and subject rule matches. Published bank templates extract transaction fields without an AI body request; legacy rules may use AI extraction. When you select a message or upload a sample for analysis, its content may also be sent to OpenRouter to generate extraction fields or patterns. Merchant categorization is a separate AI request. Temporary analysis drafts are deleted on confirmation or by expiry cleanup after 24 hours. We do not retain full bodies from ordinary sync.

AI extraction can be incomplete or incorrect. Review candidate details before approving them. If you enable automatic posting, check your tested rule and review the resulting transactions. MoneyRoo does not treat an AI suggestion as a financial statement or as financial, tax, or investment advice.

If you voluntarily submit a bank-support .eml sample, MoneyRoo encrypts it and authorized MoneyRoo admin may read it to add or repair that bank format. The sample may be processed by the AI provider to draft a rule. The complete submission, including its headers and draft, is deleted after 30 days by scheduled expiry cleanup, or earlier when you delete your account. Human review test fixtures copied from a submission share the same expiry and account-deletion controls. Expired samples are blocked from admin access while awaiting cleanup. Human access to other Google user data is limited to your documented consent, security investigations, or legal requirements.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information:

• Encryption of data in transit and at rest
• Secure authentication mechanisms
• Access controls and monitoring
• Secure data storage with trusted cloud providers

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as necessary to:

• Provide our Service and maintain your account
• Maintain your budget and expense history
• Comply with legal obligations
• Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within a reasonable timeframe, except where we are required to retain it for legal purposes.

Gmail connection credentials are stored in encrypted form and are removed when the connection is disconnected or its Gmail data is deleted. Connection summaries, mappings, processed message records, and pending candidates are retained only as needed to provide the import feature, prevent duplicate imports, resolve support issues, and maintain your account. Approved transactions remain in your ledger unless deleted under the account or transaction deletion process.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Request transfer of your data in a structured format
• Restriction / Objection: Request limitation of or object to processing
• Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, contact us at help@moneyroo.app. We will respond within a reasonable timeframe and as required by applicable law.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your session and keep you logged in
• Remember your preferences
• Analyze how you use our Service

You can control cookies through your browser settings. Disabling cookies may limit certain features of our Service.

9. Children's Privacy

Our Service is not intended for children under 13 years of age (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at help@moneyroo.app, and we will delete such information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using our Service, you consent to the transfer of your information. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we may provide additional notice (e.g., in-app or email). We encourage you to review this policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or our data practices, please contact us: