What leaves your phone, and what never does.
The promise isn't that we guard your finances well on our server. It's that we never receive them. Below is the evidence for that, in the form you can check: the data flow, every Android permission line by line, three tests you can run yourself, and the limits of what any of it proves.
Three places your data can be. That's the list.
Most finance apps have a fourth box: their own database, holding a copy of your transactions. CroSum doesn't have one, which is why there's nothing here to leak.
Your phone
Every transaction, budget, loan and savings goal you enter. Stored in the app's private storage on the device. Nothing here is uploaded by default.
Your own Drive
Optional. A backup file written to your Google Drive on Android, or your private iCloud on iPhone. Your account, your storage, and it never passes through us.
Our billing server
A subscription receipt: whether a purchase is valid and when it renews. No transaction, no balance, no budget, no goal — there is no endpoint that would accept them.
Manual entry is the reason this shape is possible. CroSum has no bank connection and no open-banking link, so there is no stream of your account history flowing through anyone's servers — not ours, not an aggregator's. You type the numbers in. That's the cost, and this page is the benefit.
What never leaves, and what does.
What never leaves your device
- Income, expenses, categories and notes
- Budgets and your Safe to Spend figure
- Loans, balances, interest rates and schedules
- Savings goals and progress
- Planner scenarios and generated reports
- Anything the recommendations are derived from
What does leave — and why
- A subscription receipt, so Premium features can be unlocked on your account
- An email address, only if you create an account on Android to subscribe or to sync
- Your backup file — only when you back up, and only to your own Drive or iCloud
- Nothing else. No analytics SDK, no advertising library, no crash-reporting service
On iPhone there is no CroSum account at all: subscriptions run through the App Store and optional sync writes to your own private iCloud, so even the email address in the right-hand column doesn't exist. The full detail lives in the privacy policy, which is the binding document — if this page and that one ever disagree, the policy wins.
All 11 Android permissions, one by one.
These are the eleven android.permission entries the shipping build declares — the same eleven Exodus counted. Below them sits one more of a different kind, com.android.vending.BILLING, which is Google Play’s own permission for selling a subscription rather than an Android system permission; we list it so the table matches what you find if you go looking. Two of the eleven look worse than they are, and we’ve said so rather than hoping you don’t notice.
| Permission | What it's for | When it's used |
|---|---|---|
| INTERNET | Lets the app make a network request at all. | Checking your subscription, and backing up to your own Drive if you've switched that on. Never to send finance data. |
| ACCESS_NETWORK_STATE | Reads whether the device currently has a connection. | Before either of the two jobs above, so an offline phone gets a quiet skip instead of a hanging spinner. |
| POST_NOTIFICATIONS | Allows the app to show you a notification. | Only the bill, budget and savings reminders you switch on. Leave reminders off and nothing is ever posted. |
| RECEIVE_BOOT_COMPLETED | Tells the app the phone has finished restarting. | Android clears scheduled alarms on reboot. This re-registers your reminders afterwards; without it they would silently stop. |
| WAKE_LOCK | Keeps the processor awake for a moment. | So a reminder that fires while the phone is asleep finishes firing. Seconds at a time, not minutes. |
| com.android.vending.BILLING | Lets the app sell a subscription through Google Play. | Google Play handles the payment; CroSum only learns whether a subscription is valid. No card details ever reach us. |
| BIND_JOB_SERVICE | Declares a background job that Android is allowed to run. | The reminder scheduler. This is one Android holds over the app, not one the app holds over your phone — it's how a scheduled job has to be declared. |
| BIND_REMOTEVIEWS | Lets another app draw a view that CroSum supplies. | The home-screen widget. Same shape as the row above: it exists so your launcher can render the widget, not so CroSum can reach into anything. |
| USE_BIOMETRIC | Asks Android to confirm your fingerprint or face. | Only if you turn the app lock on. CroSum never receives the fingerprint itself — Android answers yes or no and nothing more. |
| USE_FINGERPRINT | The older name for the same check. | Kept for Android versions that predate the newer biometric API. Same app lock, same yes-or-no answer. |
| USE_CREDENTIALS | Lets the sign-in flow use an account already on the device. | Only the Android sign-in that ties a subscription to you, or authorises your own Drive. It reads no mail, no contacts and no other app's account. |
| DUMP | A diagnostics permission, and the one that sounds alarming. | It arrives in the manifest through an Android system component CroSum depends on, not through anything CroSum wrote. CroSum does not use it to read other apps. If the dependency allowed us to drop it, we would. |
Now the absences, which matter more than the list. There is no location permission, no contacts permission, no SMS permission, no camera permission and no storage-scanning permission. A budgeting app that reads your texts to find bank alerts needs SMS access; CroSum doesn't, because you type the numbers in instead.
- No location
- No contacts
- No SMS
- No camera
- No storage scanning
Three ways to check, in about five minutes.
Each of these is something you can do without us, on your own phone, and each would fail visibly if the claims above were false.
Read the permission list at the source
On the Google Play listing, open About this app, scroll to App permissions and tap See more. Google generates that list from the installed package, not from anything we write. Compare it with the table above.
If the two ever disagree, Play is the authority and we're the ones who need to explain. Mail support@crosum.app and we will.
Cut the app off from the network
Turn on airplane mode and use CroSum normally: add an expense, set a budget, open your dashboard, check the widget. It all works, because the calculations happen on the device. An app that quietly sends your data somewhere cannot behave like that.
Two things do wait for a connection: a subscription check and, if you've enabled it, a Drive backup. Both are named in the table above.
Take your data and leave
Open Backup & Restore and tap Backup Data. You get one plain file with everything in it, saved where you choose — readable in a text editor, importable into a spreadsheet, restorable on another phone.
Export and restore are free on both tiers, permanently. Charging someone to get their own numbers out is how lock-in starts.
Scanned by a third party, not by us.
Exodus Privacy is an independent non-profit that decompiles Android apps and checks them against a database of known tracker signatures. It has no relationship with us and we cannot influence the result.
Their scan of CroSum 1.4.9 reports 0 trackers and 11 permissions — "we have not found code signature of any tracker we know". You can read it yourself:
The Exodus report for CroSum 1.4.9 →
Now the caveats, because they matter. Exodus uses static analysis against a list of trackers it already knows about — so it is a scan, not an audit, and it cannot prove the absence of something it has no signature for. It also describes the version that was scanned, not every version released since. We say all of that plainly because overclaiming a favourable result would be exactly the behaviour we are asking you not to expect from us.
What this page can't prove.
A privacy claim you can't verify is worth nothing, so here is where ours runs out.
- CroSum is closed-source. You cannot read the code, which means you are trusting a stated architecture rather than inspecting one. That is a real limitation and no amount of confident wording changes it.
- The strongest evidence is behavioural and structural, not cryptographic. Behavioural: the app does its whole job in airplane mode. Structural: the billing backend has no endpoint that accepts a transaction, a balance or a budget, so there is nothing for finance data to be posted to even by mistake.
- Backups leave our reach entirely. Once a backup file is in your Drive or your iCloud, its safety is your account's security — your password, your two-factor setup, your provider's terms. We cannot read it, and equally we cannot protect it.
- The permission list is a snapshot. It describes the current shipping Android build. Builds change; when this list does, this page changes with it, and Play's own list stays the check that doesn't depend on us.
- A tracker scan is not a full privacy audit. Exodus checks compiled code against a list of known trackers; it is strong evidence, not a formal audit by a security firm. What CroSum can point to instead is structural: no investors, no ad partners and nobody to sell data to — a registered Dutch business (KvK 42069368) whose entire revenue is the subscription.
And one thing CroSum isn't. It's a tracking and budgeting tool, not a regulated financial adviser. Everything it shows — Safe to Spend, projections, recommendations — is derived from the numbers you entered yourself. It is not personalised financial advice, and for decisions that matter you should talk to someone qualified.
The legal versions.
This page is the plain-English explanation. These two are the ones that count if it ever comes to it.
The privacy policy sets out the data we hold, the sub-processors involved, your GDPR rights and how to exercise them. The terms cover the subscription, the trial and the disclaimers.
Budgeting that never touches your bank.
Free to start. No card, no ads, no trackers. Android is live on Google Play; an iPhone version is on the way.
Coming to iPhone