Drachma
Legal
Privacy policy
The short version. Your money data never leaves your phone. Drachma has no accounts, no bank connections and no server that stores your data. Everything you enter is encrypted on your device. The only things that can leave the device are optional diagnostics — crash reports and anonymous screen-usage counts from a fixed list — and you can switch both off in Settings at any time. We never see amounts, merchants, categories, notes or names.
1. Who is responsible
Drachma is made by Mohammad Khakpaki, an independent developer. For anything in this policy, contact mkhakpaki.ksas@gmail.com. I am the person responsible for the app's data handling — there is no company, data broker or analytics team behind it.
2. The design: offline-first
Drachma is built so that your financial data cannot leak, because it is never collected. There is:
- no sign-up and no user account,
- no bank linking or credential storage,
- no sync service and no cloud database,
- no advertising and no ad identifiers (advertising-ID collection is explicitly disabled at the system level).
The app works fully offline. Internet access exists only for the optional diagnostics described in section 5, for occasional in-app announcements (section 6), for checking a Drachma Plus subscription if you buy one (section 7), and for opening web pages like this one.
3. What stays on your device
Everything you put into Drachma is stored in a local database on your phone, encrypted with SQLCipher (AES-256). The encryption key is generated on your device and protected by your device's secure hardware keystore; it never leaves the device and cannot be exported. This covers:
- transactions — amounts, currency, dates, merchants, notes, line items and receipt photo references,
- categories, tags and your personal categorization rules,
- budgets, envelopes, buffer moves and monthly plans,
- goals, contributions, earmarks and round-ups,
- streaks, XP and achievements,
- imported statement text while you review it (kept privately, cleaned up automatically).
Receipt photos are stored in the app's private storage, inaccessible to other apps. Your preferences (name, currency, theme, reminder choices and similar) are stored in the app's private settings. Android's cloud auto-backup of app data is deliberately disabled (allowBackup=false), so no copy of the database drifts into a cloud backup you didn't ask for.
4. What we never collect
No amounts. No merchants. No categories. No notes or memos. No goal names. No contact lists, no location, no photos beyond the receipts you deliberately add (which stay on the device). No advertising identifiers. No fingerprinting. Drachma sets no user ID of any kind in any third-party service.
5. Optional diagnostics (the only thing that can leave)
Drachma uses two Google Firebase services to keep the app working well. Both are on by default and both have their own switch in Settings → Your data. The app tells you this during onboarding, and switching either off takes effect immediately.
Crash reports (Firebase Crashlytics)
If the app crashes, a technical report is sent so the bug can be fixed: stack trace, device model, OS version and app version. Crash reports never include your money data — it isn't in the app's crash context to begin with.
Usage statistics (Firebase Analytics)
Anonymous counts of which screens and features get used, so it's clear what to improve. These events are restricted in code to a fixed, closed list — the app is physically unable to log free text, amounts or merchant names into analytics. The complete list:
| Event | What it says (and nothing more) |
|---|---|
| screen_view | Which of the app's 11 screens was opened (e.g. "home", "budgets", "settings") |
| onboarding_step / onboarding_completed | Progress through first-run setup |
| entry_logged | Method (keypad / scan / import) and type (expense / income) |
| scan_completed / import_completed | Outcome (success / cancelled / failed) and file kind (pdf / csv / xlsx / image) |
| merge_resolved | Whether a duplicate pair was combined or kept separate |
| budget_wizard_completed / goal_created | That it happened — no names, no amounts |
| export_completed / backup_created / backup_restored | That it happened, and export format (csv / json) |
| notif_toggled / theme_changed | Which reminder was switched, and which theme was picked |
| announcement_shown / _cta / _dismissed | How an in-app announcement was received |
Advertising-ID collection and ad-personalization signals are disabled in the app's configuration. Diagnostics are processed by Google Firebase on Google's infrastructure under Google's Firebase privacy terms.
6. Announcements and push notifications
Drachma can show occasional in-app notices ("what's new", or a required-update notice) fetched from Firebase Remote Config, and can receive broadcast announcements through Firebase Cloud Messaging. These are one-way broadcasts to all installs: the app subscribes to a public "announcements" topic and does not upload or store your push token anywhere on our side — there is no server of ours to send it to. Which announcements you've dismissed is remembered only on your device.
Everyday reminders — the daily nudge, weekly recap, budget pace notes and goal celebrations — are generated locally on your phone and respect your quiet hours. They never involve a network.
7. Drachma Plus purchases (Adapty)
If you subscribe to Drachma Plus, the payment itself is handled entirely by your app store (Google Play or the App Store) under its own terms — Drachma never sees your card or bank details. To know whether Plus is active, the app uses Adapty, a subscription-management service. Adapty receives the store's purchase information (product id, transaction id, subscription price and currency, trial and renewal state) and basic device information (model, OS and app version, locale), tied to a random, install-scoped identifier — never your name, email or anything you typed into the app. It never receives your budget data: no amounts you logged, no merchants, no categories, no goal names. If subscription state can't be checked (you're offline, the store is down), Drachma quietly falls back to the free tier — it never locks you out of your own numbers. Adapty processes this data under Adapty's privacy policy.
8. Backups: files you own
When you create a backup, Drachma writes a single .drachma file to a location you pick. It is sealed with AES-256-GCM encryption; the key is derived from a passphrase you choose (PBKDF2-SHA256, 210,000 iterations, minimum 8 characters). The app never transmits this file. If you save it to your own cloud drive, that is between you and your cloud provider. Without your passphrase the file cannot be opened — by anyone, including me. Receipt photos are not included in backups.
9. Exports: plain files, deliberately
You can export your complete data as CSV or JSON from Settings, saved to a location you pick. Exports are unencrypted on purpose — they're for spreadsheets and your own archives — and the app warns you of exactly that when you export. Treat them like the private documents they are.
10. Receipt scanning and statement import
Receipt text recognition runs entirely on your device using a bundled, offline OCR model. The camera capture screen is provided by Google Play services' document scanner, which runs on-device (Play services may download the scanner module once). Bank statements (PDF, CSV, XLSX) are parsed locally; password-protected PDFs are opened locally with the password you type, which is used in memory and not stored. No receipt image, statement content or recognized text is ever transmitted.
11. Permissions
- Internet — used only for the diagnostics, announcements and web pages described above.
- Notifications — asked for only at the moment you first earn a notification, never at app start. Declining simply means no reminders.
- Drachma requests no camera, storage, media, location or contacts permissions. Receipt capture and photo picking use system components that don't require them.
12. Data retention and deletion
Your data lives exactly as long as you keep it. Delete any entry in the app, or delete everything by uninstalling: the encrypted database and its hardware-bound key are destroyed with the app, and there is no server-side copy to chase. Backups and exports you created are yours to keep or delete wherever you put them. Diagnostics already sent are retained by Firebase for its standard limited windows and are not tied to your identity. Subscription records live at your app store and at Adapty for as long as needed to manage the subscription.
13. Your rights
Privacy laws like the GDPR give you rights of access, portability, correction and erasure. Drachma's design means you exercise almost all of them directly: your data is on your device, exportable in full as CSV/JSON, editable in the app, and erased by uninstalling. For anything about diagnostics — including "please make sure nothing of mine persists" — email mkhakpaki.ksas@gmail.com.
14. Children
Drachma is not directed at children under 13 (or the equivalent minimum age in your country), and I do not knowingly collect personal data from children — by design, the app barely collects personal data from anyone. If you believe a child has used the app and something concerns you, please get in touch.
15. Changes to this policy
If this policy materially changes, the app will tell you: it tracks the version you agreed to and shows a review notice in Settings until you've read and accepted the update. The current version is always at the top of this page and at this address.
16. Contact
Mohammad Khakpaki · mkhakpaki.ksas@gmail.com