openPFM privacy policy

Effective 11 October 2026. The openPFM account and AI service sections apply from the first app version that offers them.

openPFM is a free personal finance app for Android, licensed under the GNU AGPL v3 or later. This policy explains what the Android app does with your data.

In short: openPFM has no analytics and no ads. Your statements and everything worked out from them are stored only on your phone. To read statements and answer questions, the app sends data to OpenAI, only after you agree to it, in one of two ways you choose between:

• With your own OpenAI API key, directly from your phone to OpenAI. The developers of openPFM never receive your data.
• With an optional openPFM account (sign in with Google), through the openPFM AI service, which passes your data to OpenAI and sends the answer back without keeping a copy. It records only your account and how much AI you've used, to apply the free allowance.

What the app handles

• Bank statements you add, by picking PDF files or by choosing folders for the app to watch ("Synced folders"). The app only reads the folders you pick.
• What it works out from them: your transactions, balances, categories, spending highlights, and any budgets or edits you make.
• Questions you ask the assistant, and its answers.
• Your OpenAI API key, if you add one.
• Your openPFM account, if you sign in: your Google account's email address and an account id.
• Your settings: currencies, theme and similar preferences.

Where it is stored

All of it is stored only on your phone, in the app's private storage, which other apps can't read. The OpenAI API key and your openPFM sign-in are encrypted with a key held in the Android Keystore. If you have an openPFM account, the account itself is kept by the services described below.

The app's data is excluded from Google's cloud backups. If you move to a new phone with Android's direct phone-to-phone transfer, your statements and settings can be copied across; your OpenAI key and openPFM sign-in can't be decrypted on the new phone, so you enter the key or sign in again.

What leaves your phone, and why

OpenAI (on-device mode)

openPFM uses OpenAI's AI models through OpenAI's API, either with your own API key or through the openPFM AI service (next section). Before anything is sent, the app shows what will be sent and where, and asks you to agree, separately for each of the two. If you don't agree, or later withdraw your agreement in Settings > AI, nothing more is sent.

Once you agree, the app sends, from your phone to OpenAI (directly with your own API key, or through the openPFM AI service):

• To read a statement: its text and page images. These contain your transactions and balances, and may include your name, address and account number as printed on the statement.
• To categorize your spending and write your highlights: your transaction descriptions, categories and amounts, and summary figures.
• To answer a question: your question, the conversation so far, and the figures and transactions the assistant looks up to answer it. These requests ask OpenAI not to store the conversation (store: false).

With your own key, OpenAI processes this data under your own agreement with OpenAI; through the openPFM AI service, under openPFM's. Either way OpenAI's API data usage policies (https://openai.com/policies) apply, which describe how long OpenAI may retain API data, for example for abuse monitoring.

The openPFM AI service (optional, with an openPFM account)

Instead of your own key, you can sign in with Google to an openPFM account and use the openPFM AI service, a free service with daily limits run by openPFM's developers. It's offered only in versions of the app that include Google sign-in (not in F-Droid builds).

• Signing in. Google confirms your account to Supabase, the sign-in and database service openPFM uses, which keeps your Google email address and an account id. The app keeps a sign-in token on your phone, encrypted.
• AI requests. The data listed above goes from your phone to the openPFM AI service (hosted on DigitalOcean), which sends it to OpenAI with openPFM's own API key and returns the answer. The service doesn't store or log the content of your statements, transactions or questions; it handles them in memory only, for the time a request takes. OpenAI is asked not to store the requests (store: false) and receives a pseudonymous id derived from your account, not your email, which it uses to detect abuse.
• What the service records, per request: your account id, which kind of AI step it was, when, how many tokens it used and what it cost, and whether it succeeded. This is used to apply the free allowance (shown in Settings > AI), to stop abuse, and to keep the service's costs under control. It's kept in openPFM's Supabase database.
• Signing out removes the sign-in from your phone. You can switch back to your own key at any time in Settings > AI.

Exchange rates (Frankfurter)

To convert between currencies, the app downloads daily exchange rates from the Frankfurter API (https://frankfurter.dev), which publishes European Central Bank reference rates. The request contains only a date range and a currency code, with no personal or financial data.

Your own openPFM server (server mode, optional)

If you connect the app to an openPFM server that you run yourself (Settings > Advanced), your statements and questions go to that server instead, and its own setup decides what happens to them. Unencrypted http:// connections are only allowed to a server on your own local network.

Reports you choose to send

If you report an AI answer or highlight with the "Report" button, the app opens your email app with a report containing that content. Nothing is sent unless you send that email yourself, and you can edit it first.

Bank statement PDFs

On your phone, the monthly statement PDFs under Reports are built on the device from your own data; nothing is sent to build them. In server mode your openPFM server builds them. The PDF only leaves the app where you save it or whoever you share it with.

What openPFM does not do

• No analytics, tracking, advertising or crash-reporting libraries.
• No account needed: an openPFM account is optional, only for the openPFM AI service.
• No selling or sharing of your data with anyone else.
• No access to your contacts, location, camera or microphone.

Demo mode

"Try with sample data" shows a made-up year of banking generated on your phone. Nothing is sent anywhere in demo mode.

Keeping or deleting your data

You can delete individual statements and banks in the app. Removing your OpenAI key withdraws your agreement to send data to OpenAI with it. Uninstalling the app, or clearing its storage in Android's settings, deletes everything the app stored on your phone. Data already sent to OpenAI is handled under OpenAI's policies.

Deleting your openPFM account

In the app: Settings > AI > Delete account. This deletes your openPFM account at once: your sign-in (your Google email address and account id, kept by Supabase) and the AI service's records of your usage. If the sign-in can't be removed right away, openPFM's operators remove it within 30 days; the account can't be used in the meantime. Your statements and everything else on your phone are not affected, and you can keep using the app with your own OpenAI key or a new account.

Without the app: email privacy@openpfm.site from the account's email address, asking for the openPFM account to be deleted; we delete it within 30 days. A suspended account is deleted this way.

What remains afterwards: a record that a deletion was requested and completed, holding only the account's random id and the dates, no email or usage; and the day's total spend across all users, which isn't linked to any account. Data already sent to OpenAI is handled under OpenAI's policies.

Children

openPFM is intended for adults managing their own finances and is not directed at children.

Changes

If this policy changes, the new version will be published at this address with a new effective date.

Contact

Questions about this policy, or requests about your data: privacy@openpfm.site.