Voice Expense TrackerApp information & policies

YOUR INFORMATION

Privacy Policy

What Voice Expense Tracker accesses, why it is used, and where it goes.

Effective date:

1. Scope and operator

This notice covers the Voice Expense Tracker application at voice-expense-tracker.novaro.my and this separate information website. The app is currently for private, single-owner use, not open public registration. It helps its owner record and manage personal income and expenses in MYR.

Voice Expense Tracker is a product operated under Novaro Solutions. For support, privacy and data deletion requests, contact zknova.ai@gmail.com. Do not send passwords, OAuth tokens or other credentials in a support request.

2. Information used by the app

Account and preferences
Google account identifiers and sign-in information, including email and display name where provided; your Auto Save preference; and the active workbook and worksheet identifiers.
Transactions
Date, direction, amount, note, optional category, payment method and optional channel, together with transaction identifiers and creation/update timestamps. Notes and recordings may contain personal financial information.
Voice and drafts
Audio you choose to record, its transcript, recording-local date context, and proposed transaction fields. Review drafts and pending/retry information may be kept in your browser session storage.
Connection and operation metadata
Google authorization scopes and encrypted refresh credentials, plus technical identifiers, timestamps, hashes and status records used for connection ownership, duplicate prevention and safe retries.

Hosting and service providers may also process request information such as IP addresses, browser details and security or diagnostic events, under their applicable service settings and terms.

3. Google sign-in and workbook permissions

Google sign-in establishes your app identity through Supabase Auth. Connecting a Google workbook is a separate authorization flow. That connection requests:

  • openid — to verify that the connected Google account matches your Google sign-in identity.
  • https://www.googleapis.com/auth/drive.file — to create and work with files created with, or explicitly authorized for, the app, including a workbook selected through Google Picker.

The workbook connection does not request broad access to every file in your Google Drive. Google grants access at the file level, not just to one worksheet. Application code targets its own transaction worksheet and is not designed to overwrite unrelated worksheets.

The app uses authorized access to validate the connection, read records and monthly summaries, and create, edit or delete transactions you save. Review is the default. If you enable Auto Save, a complete, valid and unambiguous voice transaction may be saved without another manual Save action.

Google data is used for these account and transaction features. The reviewed application contains no advertising, data-broker or credit-scoring integration. Necessary operational access and manual request handling are described below.

4. Voice and AI processing

When you record, the browser sends audio through the application server to OpenAI for transcription. The transcript and Malaysia recording-local date context are sent to OpenAI to propose one structured transaction. This can include financial details you say aloud. These voice-processing requests do not send existing workbook rows or Google OAuth credentials to OpenAI.

The application does not implement permanent raw-audio storage. Audio is handled transiently for recording and processing; references may remain in memory during a request or failure handling. This is not a promise of immediate deletion from every browser process, infrastructure system or service provider.

Transcripts and proposed fields are returned to the browser for review and may be retained in a session draft. The app does not itself train AI models. OpenAI processing, security logging, retention and data use depend on its applicable terms and actual account settings. This notice does not assert that a training opt-out, zero-retention setting or particular provider data-sharing configuration is enabled.

AI output may be inaccurate. Review the transaction and manually complete anything missing or uncertain before saving.

5. Storage and security

Google Sheets holds saved transactions. Supabase is used for authentication, profiles, settings, workbook ownership/connection metadata and technical operation records; it is not a duplicate transaction ledger.

Google refresh credentials are encrypted by application code before storage in Supabase, with the encryption key used server-side. This statement concerns those credentials; it is not a claim that every data field is end-to-end encrypted or inaccessible to all operators and providers.

When Google Picker is used, the browser receives a short-lived Google access token so the Picker can work. Refresh credentials remain server-side. Authentication cookies and browser session storage support sign-in, drafts and retry handling.

The application checks the authenticated user and resource ownership on the server. Novaro Solutions may need human access to account, connection and operation metadata to operate the service, investigate errors or security issues, verify identity and handle requests. Administrative privileges or authorized Google access can also permit access to workbook information; this notice does not claim all data is inaccessible to humans. Service providers may have access under their applicable terms and settings. No security measure guarantees protection against every risk. Keep your Google account and device secure, and avoid shared devices for private financial records.

6. Supporting services

These providers receive data necessary for their role. Their processing locations, logs, retention and contractual protections depend on actual service configuration. This notice makes no specific data-residency or provider retention guarantee. No provider training opt-out or specific data-sharing configuration is asserted.

This information site has no sign-in form, recording function, analytics script or application database connection. It does not set application cookies or use browser storage. Its hosting provider may still process delivery and security information.

7. Your choices and requests

  • Use manual entry instead of recording. Decline microphone permission if you do not want voice input.
  • Keep Auto Save off to review before every save.
  • Inspect and manage your workbook directly in Google Sheets. Transaction actions in the app can change the connected worksheet.
  • Review or revoke access through Google Account connections. Revocation does not delete an existing workbook, erase app metadata or undo changes already made.
  • Clear browser site data to remove locally stored drafts and authentication data. Doing so may discard unsaved work.
  • Request access, correction or deletion of operator-held account metadata by emailing zknova.ai@gmail.com. Novaro Solutions monitors this email and handles requests manually after appropriate identity verification. Do not send passwords, OAuth tokens or unnecessary financial details. There is no automatic in-app account deletion service or promised deletion deadline.

Deleting data from your Google Sheet and requesting deletion of application metadata are separate actions. Workbooks and Google-account data remain subject to your Google controls and Google's own processes. A metadata-deletion request does not automatically delete a workbook, revoke its sharing permissions or erase Google-held data.

8. Retention, updates and contact

Saved transactions remain in the workbook until changed or removed. Account, connection and operation metadata are retained by the application until changed or removed through an applicable process. Browser session storage and provider backups/logs have separate lifecycles.

Records may need to be retained for unresolved operation safety, security investigations or applicable legal obligations. Provider logs and backups have separate retention and deletion processes outside the application's direct control. Manual request handling does not promise immediate removal from every provider system or backup, a fixed retention period, or automatic deletion of inactive accounts. Relevant limitations will be explained when handling a request.

Material changes to data use should be reflected in this notice and communicated as required, with fresh consent where needed. This policy takes effect on its actual publication date.

Questions or privacy requests: zknova.ai@gmail.com.