Privacy Policy

Last updated: October 20, 2026

This policy explains what Onetap ("the app," "we," "us") does and does not do with your information. It describes the app as it is actually built — every statement below was checked against the source code, not written from memory.

The short version

Onetap has no account of its own, no password and no advertising. Your ledger — your transactions, categories, budgets and lists — is encrypted and kept on your phone. We do not run a server that stores it.

Three things do leave your phone, and you should know exactly what they are: the audio you record when you hold the microphone, the text of the expense you describe, and the text of payment notifications from the banking apps you choose to add. All three go to an AI provider to be read. Card and account numbers are masked before they go, and one-time passcodes are never sent at all. The sections below set this out in full.

There is one more thing, and it is a small one: Onetap sends product analytics — a short list of named events such as "a screen was opened", "a setup step was reached" or "a locked feature was tapped" — so we can see where the app is failing people. No amount, no merchant, no note, no category and no name is ever part of it, and none of it is linked to your name or any account. Section 9 lists every event.

Information we process

1. Voice recordings

The microphone is used only while you are holding the microphone button. It does not listen in the background, and it does not listen when you are not holding it.

When you release it, the recording is uploaded over HTTPS to a relay we operate, which passes it to Groq (api.groq.com) to be transcribed by the Whisper speech model, and returns the text. This is not your phone's built-in speech recognition — the audio does leave the device. It is sent without any name, account or identifier attached to it, because Onetap has no account to attach. Section 4 explains what the relay is and why it exists.

2. The expense you describe

The transcribed text — or text you type — is sent by the same route to the same provider's language model, so it can be turned into an amount, a description and one of your own category names. The result is shown to you in an editor to confirm or change; nothing is saved until you do.

If the provider cannot be reached, Onetap falls back to a parser that runs entirely on your phone and reads plain notes without any network at all.

3. Bank and payment notifications

This is the most sensitive thing Onetap does, so it is worth reading closely.

If you switch on bank automation, you grant Onetap notification access and add the specific banking, wallet or payment apps you want it to watch. To make that a tap rather than a pasted link, Onetap checks whether any of a fixed list of about fifty well-known banking and wallet apps is installed, and shows the ones it finds. That check can see only the apps on that list, happens entirely on your phone, and its result is never stored or sent anywhere. From then on:

Only the apps you added are ever read. A notification from any other app is discarded on its package name alone, before its text is looked at.
One-time passcodes and verification messages are never stored or sent. They are detected on your phone and dropped immediately — they are not transactions, and the code inside one is the most sensitive thing a phone receives.
Card, account, IBAN and phone numbers are masked on your phone to their last four digits before the text goes anywhere.
What remains — typically a line such as "Your payment of $12.80 to Uber was successful", with any long number already masked — is sent to the same AI provider, together with the names of your categories, so it can tell whether money actually moved and how much.
The notification is also kept on your phone while it is being processed, so nothing is lost if you are offline. Notifications Onetap decided to pass over are listed in Settings under Ignored notifications, so you can see what it chose not to record.

Notification access can be revoked at any time in Android's own settings, and bank automation can be switched off in Onetap's settings, independently.

While you are not subscribed, payment alerts from those same apps are still captured, masked and one-time-code checked exactly as above — but they are held on your phone and not sent anywhere, because reading them is the part that needs a subscription. They are listed in Settings under "Waiting to be recorded", where you can record them if you subscribe, delete any of them, or discard them all. Anything not dealt with is removed automatically after 30 days.

4. About the AI provider

Onetap currently uses Groq for both transcription and interpretation. Requests are sent over HTTPS and carry no account identifier, because Onetap has no account.

They do not go to Groq directly. They go first to a relay we operate — a small function hosted on Supabase — which attaches our Groq credential and passes the request on, then hands the answer back to the app. It exists for one reason: so that the credential is not inside the app itself, where anyone who downloaded Onetap could extract it from the installed file and spend against our account.

The relay forwards and returns. It does not store your audio or your text. What it does keep is a count: a random identifier generated on your device — not your Android ID, not linked to you, not used anywhere else in the app — together with a date and the number of requests made. That is there so one installation cannot exhaust the service for everybody else. No audio, no text, no amounts, no merchants.

Under Groq's own terms, which we rely on and you can read yourself:

They do not train on what is sent. Groq's Services Agreement states it "is not permitted to use Inputs or Outputs for training or fine-tuning any AI Model Services or other models, unless explicitly granted permission or instructed by Customer." We have granted no such permission.
Nothing is retained by default. Groq's documentation states that "by default, Groq does not retain customer data for inference requests."
The one exception is abuse investigation. Groq may temporarily log inputs and outputs while investigating suspected abuse, and says such logs are kept for up to 30 days unless it is legally required to keep them longer.

We keep no copy of your audio or text. The relay described above is the only server we operate, and it is a pipe rather than a store. We may change provider as the app evolves — the app is written so that this is a configuration change — and this page will be updated when we do.

5. Your ledger

Transactions, categories, budgets, tags, lists and recurring entries are stored on your device in Android's EncryptedSharedPreferences (AES-256, with the key held in the Android Keystore). They are not transmitted to us. Uninstalling the app, or clearing its storage in Android's settings, removes them.

6. Sign in with Google (optional)

Onetap has no account of its own. You can optionally sign in with an existing Google account, for two reasons: to back up to your own Google Drive (section 7), and so a subscription stays with your Google account when you change phone.

Your name, email address and profile photo are kept on your phone, to show which account is signed in. They are not sent to us or to anyone else.
Google's identifier for the account — a number, not your email — is sent to RevenueCat (section 8), so that a purchase can be found again on a new phone.
Signing out removes the profile from your phone and detaches the subscription from it.

7. Google Drive backup (optional)

Onetap can back up your ledger to your own Google Drive so you do not lose it when you change phone. This is entirely opt-in — nothing is backed up unless you sign in and ask for it.

Onetap requests only the drive.appdata scope, which reaches a single hidden folder created for Onetap — not your wider Drive, and none of your other files.
That folder is not visible in Drive's normal app or website, even to you; it exists only so Onetap can store and retrieve its own backup file.
The backup goes directly from your device to your Google account. We never see it.
When you sign in, your Google account's email address is shown in Settings and kept on your device so the app knows which account the backup belongs to.
To remove it, revoke Onetap from your Google Account's connected-apps settings, which deletes its hidden folder. You can Restore first if you want the data back on the phone.

8. Purchases

Onetap is free for three days — no card and no sign-up — and after that some features need a subscription. If you buy one, the purchase is handled by Google Play and its status is managed through RevenueCat, which records that a purchase exists and whether it is active. RevenueCat knows you by a random identifier generated on your phone or, if you signed in, by Google's account identifier (section 6) — never your name or email. Onetap never sees or stores your card details — Google Play handles payment entirely.

9. Product analytics

Onetap uses PostHog to count how the app is being used. This is the only analytics in the app: there is no advertising SDK, no ad network, no ad identifier, and no session recording or screen recording of any kind.

Automatic capture of taps is switched off, and so is session recording. What is sent is a fixed list written by hand, and it is the whole list:

Event	What it carries
The app was installed, updated, opened or closed	The Onetap version. Nothing else
A screen was opened	The screen's internal name, e.g. `moneyHomeFragment`. Never anything shown on it
A setup step was reached	The step's internal name, e.g. `voiceInputFragment`
Setup finished	Nothing
The free trial started, reached day 1/2/3, or ended	The day number
A locked feature was tapped	Which one — voice, bank automation, history, export, backup, extra list
The subscription screen was shown	Whether it came from setup or from the app
A purchase or restore finished	Which plan, and whether it succeeded, was cancelled or failed. Never a price, and never a payment detail
A bank alert was handled	The outcome — recorded, needs review, set aside, held, unreadable — and the package name of the banking app that posted it, so we can fix a bank whose alerts we read badly. Never the alert's text, and never an amount or account number
A spoken entry was interpreted	Whether it was understood. Never the words, and never the amount
A transaction was saved	How the editor was filled — by voice, by hand, or from a bank alert. Never what was in it
Bank automation's state, once per launch	Whether it is on, off, waiting for a bank to be chosen, paused for notification access, or limited to when the app is open
An export finished	CSV or PDF, and whether it saved or failed. Never the file name, the list, or how many rows were in it
A Google Drive backup or restore finished	Which of the three it was, and whether it worked. Never the contents of the backup
A budget was set or cleared	Which of the two, and how many budgets the list holds afterwards. Never the category it was on, and never the amount
The first-entry hint was shown	Nothing
Your first transaction was saved, once	How it was added — by voice, by hand, or from a bank alert. Never what was in it
Voice recording started, or could not start	Nothing, or why it could not: no microphone permission, no internet, or an error. Never any audio or words
A banking app was added to the watched list	Whether it was picked from the apps found on your phone or added by its Google Play link. Never which app
A purchase was started	Which plan was tapped: monthly, yearly or lifetime. Never a price, and never a payment detail
Where the app was installed from, once	The campaign tags on the Google Play link you installed from, for example `utm_source=website`, or `google-play / organic` for an install from a Play search. Only those three tags, read through Google Play's install referrer, and nothing about when or where you tapped it

Once each time the app starts, Onetap also sends a short usage summary, made only of counts and settings: whether you are on the trial, free or Pro, and how many days of the trial are left; how many lists, transactions, budgets, categories, tags and banking apps you have; how many transactions came from bank alerts and how many were added in the last 7 days; whether you have any income or recurring entries; bank automation's state; whether budget alerts and income are switched on; which period you view (weekly, monthly and so on); whether you are signed in to Google Drive; and how many days ago the app was installed. It shows us how the app is used across everyone, for example how many people set a budget at all. It never contains an amount, a name or anything you typed.

Nothing from your ledger is in any of this. No transaction, amount, merchant, note, category name, budget amount, list name, currency, tag, email address or account identifier is ever sent to PostHog. Where a number is sent, it is a count.

You are not identified. Onetap never tells PostHog who you are — no email, no account, no advertising ID, no device serial. Events arrive against a random identifier the analytics library generates on your device; reinstalling the app produces a new one. As part of any internet request, PostHog receives the IP address your device connects from. It uses it to estimate an approximate location (country, region, city, postal area and rough map coordinates, typically accurate to tens or hundreds of kilometres), which is stored with the event, and then discards the IP address itself, so it is not stored. That location is only as precise as an IP address allows; Onetap itself never reads your location.

The library also attaches technical details about the device, which it uses to tell an old Android from a new one: manufacturer and model, Android version, the Onetap version, screen size, locale and timezone.

These events are part of how the app works and have no separate switch; nothing in them names you or describes your spending. PostHog's own privacy documentation is here.

10. Crash reports

When Onetap crashes, a report is sent to Firebase Crashlytics, a Google service, so the fault can be found and fixed. Without it a crash on your phone is something we never learn about at all.

A report contains what is needed to locate the fault, and nothing else:

the error and the stack trace — which lines of Onetap's own code were running;
the app version, and whether the app was in the foreground;
the device model, manufacturer, Android version, orientation, and whether memory or storage was low at the time;
a random identifier generated on your device for the install, not linked to you or to any account, and replaced if you reinstall.

Nothing from your ledger is in a crash report. No transaction, amount, merchant, note, category, budget or list name. Onetap attaches no custom values to reports, so nothing it holds can travel with one.

Google's handling of this data is governed by the Firebase privacy documentation.

Permissions Onetap requests, and why

Permission	Why Onetap asks for it
Internet	To reach the AI provider, Google Drive, Google Play billing, product analytics and crash reporting.
Microphone	Only while you are holding the microphone button to speak an expense.
Notifications (post)	To tell you when a budget crosses its alert threshold, and when a bank notification has been recorded.
Notification access	Granted separately by you, in Android's settings, so bank automation can read payment alerts from the apps you added. Revocable at any time.

Onetap does not request location, contacts, photos, calendar, SMS or call logs, and declares no advertising ID.

What we don't do

No Onetap account and no password. The only sign-in is the optional Sign in with Google in section 6.
No advertising, ad networks or ad tracking.
No advertising identifier, and no analytics that identifies you: no session or screen recording, no automatic capture of taps, and nothing from your ledger — see sections 9 and 10 for the complete list of what the product analytics and the crash reporter send.
No selling or renting of any information to anybody.
No reading of notifications from apps you did not add.

Data retention and deletion

Your ledger lives on your device, so uninstalling the app or clearing its storage removes it. Text and audio sent for interpretation pass through our relay to produce an answer and are not retained by us — the relay keeps only the request counts described in section 4, never the content. The provider's own retention is governed by their terms, linked above.

Crash reports are held by Google for 90 days. The events in section 9 are held by PostHog on our behalf. They are not linked to you, so there is no account for us to look up and delete; uninstalling the app stops any more being sent.

If you used Google Drive backup, that copy lives in your own Google account — see section 7 for how to remove it.

We keep no database of users, so there is nothing of yours on our side to delete. What the services above hold is either not linked to you (analytics and crash reports), removed on the provider's own schedule (Groq, Google), or a record of a purchase that Google Play and RevenueCat keep for as long as billing and tax rules require.

Children's privacy

Onetap is not directed at children under 13, and we do not knowingly collect information from children under that age.

Changes to this policy

If Onetap's features or data handling change — a different AI provider, a new source of data — this page is updated and the "Last updated" date above changes with it.

Contact

Questions about this policy or how Onetap handles information can be sent to info@truetechsol.org.

This page is a plain-language description of how Onetap actually works. It is not formal legal advice. If you need to satisfy a specific regulation (GDPR, CCPA and similar), have it reviewed by a lawyer familiar with your target markets.