Pawlet Privacy Policy
In short: Pawlet has no user accounts and no third-party analytics. It reads your bank SMS messages on your device to build a personal finance ledger, and that ledger is stored only on your phone. When an unrecognised message has to be classified by an AI model, that text may be sent for classification, depending on your version and configuration. Play Store installs that use Pawlet's classification service have a Settings switch ("Use LLM for unknown messages", on by default) that lets you keep message text on your device entirely: with it turned off, an unrecognised message is marked as failed in the app instead, and you can retry it later. When message text is sent, it is handled in transit and is never written to a database or a log file by us. We keep no copy of your messages, transactions, or balances — only an anonymous installation identifier and a few counts about it: which days it was opened or ran, its app version and device integrity verdict, which AI setting it used, how many classification requests it made, and how many messages the on-device model handled by itself versus could not settle by itself. Those counts are what prevent the service being abused, tell us how many installations are in use, and tell us how well the on-device model works.
1. Who we are and what this covers
This is the privacy policy for Pawlet, an Android application published on Google Play under the package name com.pastabyte.pawlet. Pawlet is developed and published by PastaByte ("we", "us", "the developer"). This policy explains how the app accesses, collects, uses, shares, retains, and deletes your information, and it applies to all versions of the app distributed on Google Play.
2. Information Pawlet handles
SMS messages
Pawlet's core function is reading transaction notifications sent by your bank or card issuer over SMS. With your permission, the app reads incoming messages and your existing SMS inbox. For each message it keeps the sender, the message text, and the timestamp on your device.
Messages that are not financial are discarded; records of ignored messages are automatically deleted after 7 days.
Financial information derived from those messages
From the messages, Pawlet extracts and stores transaction amounts, dates, merchant or description text, bank and card names, and bill due dates. You may also enter this information manually. This data is used only to display your balances, spending, and bills inside the app.
Installation identifier and usage counts
When an installation talks to Pawlet's server — whether using our classification service, your own API key, or no AI service at all (see section 4) — the app generates a random installation identifier. It is not your name, your phone number, your Google account, or any hardware identifier, and it is created by the app itself. Before it is stored, it is irreversibly hashed. Against that hash we record only:
- the dates the installation was first and last seen, and, for each day, whether the app was opened and whether it ran at all, and which AI setting the installation used (Pawlet's service with the "Use LLM for unknown messages" switch on or off, your own key, or no AI service);
- the number of classification requests it made each day, and the number of AI tokens those requests used;
- its app version; and, if it uses our classification service (including with the "Use LLM for unknown messages" switch turned off), the device integrity tier and Play licensing verdict reported by Google Play Integrity, and the Android SDK level;
- for each day, how many messages the on-device model classified by itself, how many it could not settle by itself (passed on to the cloud model when one is in use), and how many it could not process.
None of this includes message content, senders, categories, amounts, balances, or anything else about your finances.
This exists for three reasons: to enforce fair-use quotas and block abuse of a service we pay for, to understand how many installations are in use and which app versions they run, and to measure how well the on-device model works, so that fewer messages need to leave your phone. It is never linked to your messages or your financial data, because we do not retain those. A fresh identifier is generated if you reinstall the app, and we have no way to connect a new one to an old one.
What Pawlet does not collect
- No name, email address, phone number, or date of birth.
- No user account — there is nothing to sign up for or log in to.
- No advertising identifier, and no hardware or operating system device identifier such as IMEI, IMSI, SIM serial number, MAC address, or Android ID.
- No location data.
- No third-party analytics, crash-reporting, or advertising SDKs of any kind. The only usage data Pawlet sends is the anonymous, aggregate counts described above.
- No contacts, photos, files, camera, or microphone access.
3. Where your data is stored
Your messages, transactions, bills, and bank details are stored on your device only, in the app's private storage area that other apps cannot read. Specifically:
- Your ledger lives in a local database inside Pawlet's private app sandbox. On modern Android devices this storage is covered by the operating system's own device encryption.
- If you supply your own AI provider API key, it is stored in the Android Keystore, which is hardware-backed encrypted storage.
- Your app lock PIN is stored locally and is never transmitted.
We do not operate any cloud sync, cloud backup, or remote copy of your ledger. The only data held on our servers is the installation hash and the counts described in section 2.
4. When data leaves your device
AI classification
Pawlet classifies messages in three stages. The first two run entirely on your device: a sender and keyword filter, then a bundled on-device machine-learning model. Only when those stages cannot confidently classify a message does Pawlet fall back to a cloud AI model.
In that fallback case, the message sender ID, the message text, and your selected currency code are transmitted over an encrypted HTTPS connection so the model can determine whether the message is financial and extract the amount and merchant.
Bank messages may contain details such as a masked card number or an account balance, so you should be aware of what your bank sends you. No name, email, phone number, or device identifier is attached to the request, and Pawlet holds no account that it could be linked to.
Depending on your version of the app and whether you have supplied your own API key, that request takes one of two routes:
- Directly from your device to OpenRouter, an AI model routing provider. We are not involved in the request and never see it.
- Through Pawlet's classification service, which forwards the request to OpenRouter on your behalf using our API key. In this case the message text passes through our server in memory only. It is never written to a database, never written to a log file, and never retained after the response is returned. Our request logs record only the HTTP method, path, response status, and duration — never the body.
In both routes, the message text reaches OpenRouter and the model provider it selects, and is handled there under OpenRouter's privacy policy.
Play Store installs that use Pawlet's classification service have a Settings switch, "Use LLM for unknown messages", which is on by default. With it turned off, message text never leaves your device at all: messages the on-device model cannot confidently classify are marked as failed in the app, where you can retry them later, rather than being sent. The usage reporting described below continues, and the app still contacts our server for that purpose.
If you use no AI service at all, message text never leaves your device. If you use your own OpenRouter API key, message text the on-device stages cannot classify goes directly from your device to OpenRouter and never reaches us. If you prefer to stop all network communication entirely, you can decline network access in Android Settings on devices that offer it. The on-device stages continue to work offline, and messages the on-device model cannot classify stay unclassified on your device; once marked as failed, you can retry them in the app.
Abuse prevention and app integrity
Before the classification service will accept requests, the app proves it is a genuine, unmodified copy of Pawlet using Google Play Integrity. The app obtains a token from Google Play services and sends it to our server, which asks Google to decode it. Google returns only verdicts — whether the app binary is genuine, whether the device passes basic integrity checks, and whether the install came from Play. Google does not disclose your Google account, email, or device identity to us through this process, and we never see it.
On success the server issues a session token valid for 24 hours. It contains only the installation hash and a random value, and is not stored by us.
Your IP address is visible to our server when your device connects, as it is to any internet service. We use it transiently to rate-limit requests and discard it within the hour. IP addresses are never written to disk and are never associated with your installation identifier or with any message content.
Daily message counts
If you use Pawlet's classification service — including when the "Use LLM for unknown messages" switch is turned off — the app also sends our server, at most a few times a day, a short summary covering today and the previous 29 days: for each day and app version, how many messages the on-device model classified by itself, how many it could not settle by itself (passed on to the cloud model when one is in use), and how many it could not process. The summary travels over HTTPS with the same session token as classification requests, so it is stored against the installation hash described in section 2. It contains no message text, sender, category, amount, or balance. Messages imported from your existing inbox are not counted. If you use your own API key, or no AI service at all, the app never sends it.
Daily activity heartbeat
Every installation of a build configured to talk to Pawlet's server sends a daily activity heartbeat, regardless of which AI setting you use. The app tells our server which days it was opened or ran, which app version it was running, and which AI setting it used (Pawlet's service with the "Use LLM for unknown messages" switch on or off, your own key, or no AI service). It sends this only when that record changes, a few times a day at most, including from a short background check the app runs once a day. The message travels over HTTPS and carries the random installation identifier (stored only as a hash, see section 2), dates, the app version, the AI setting, and two yes/no flags (opened, ran). It contains no message text, sender, category, amount, or balance.
Currency exchange rates
Pawlet fetches public currency exchange rates from open.er-api.com. This is an anonymous request for public rate data. No personal, financial, or message data is included.
5. Backup and restore
Pawlet lets you export your data to a backup file. When you back up, Android's system save dialog opens so that you choose where the JSON file is saved — for example a folder on your phone or your own cloud drive. No temporary copy is kept. We never receive it.
The backup contains your messages, transactions, bills, banks, and settings. It does not contain your app lock PIN or your API key. Because the backup file is not encrypted, store it somewhere you control.
6. Permissions and why they are needed
| Permission | Why Pawlet needs it |
|---|---|
READ_SMS | Read existing bank messages in your inbox to build your transaction history. |
RECEIVE_SMS | Detect new bank messages as they arrive so balances stay current. |
INTERNET, ACCESS_NETWORK_STATE | Cloud AI fallback classification, exchange rate lookup, and the usage reporting described in section 4. |
RECEIVE_BOOT_COMPLETED, WAKE_LOCK, REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | Keep the background message listener alive so transactions are not missed. |
POST_NOTIFICATIONS | Show processing status and bill reminders. |
USE_BIOMETRIC | Optional fingerprint or face unlock for the app lock. |
SMS access is requested at runtime and you can refuse or revoke it at any time in Android Settings. Without it, Pawlet still works for manually entered transactions.
7. Sharing with third parties
We do not sell, rent, or trade your data. We do not share it with advertisers, data brokers, or analytics providers, and Pawlet contains no third-party software development kits that collect data. The complete list of third parties that ever receive data from Pawlet is as follows.
| Recipient | Data transferred | Purpose | When |
|---|---|---|---|
| OpenRouter, and the AI model provider it routes the request to | The SMS sender ID, the SMS message text, and your currency code. No identifier of you or your device. | Classify the message as financial or not, and extract the amount and merchant. | Only when the on-device filter and the on-device model cannot classify a message. |
| Google Play Integrity | An opaque integrity token generated by Google Play services on your device, which we send back to Google to decode. We add no data to it. | Confirm the app is genuine and unmodified before our server accepts its classification requests or its daily message counts, which continue with the "Use LLM for unknown messages" switch turned off. | Once per session, at most once every 24 hours. |
open.er-api.com (ExchangeRate‑API) |
None. An anonymous request for public exchange rate data. | Convert foreign-currency amounts for display. | At most once every 24 hours. |
All transfers use encrypted HTTPS connections. No third party receives your ledger, your balances, or any copy of your local database.
We may disclose information if legally required to do so. The only data we hold that could be the subject of such a request is an anonymous installation hash and the counts described in section 2.
8. Retention and deletion
On your device
- Your ledger is retained on your device for as long as you choose to keep it. We apply no retention period of our own.
- Records of messages identified as non-financial are automatically and permanently deleted after 7 days.
- You can delete individual transactions, bills, and message records at any time inside the app.
- Clearing the app's storage in Android Settings, or uninstalling Pawlet, permanently and irreversibly deletes all of its data from your device.
On our servers
- Message text and classification results: not retained at all. They exist only in memory for the duration of the request.
- Installation hash, request counts, the days it was opened or ran and the AI setting it used on each, and app and device details: retained indefinitely, because historical request volume is what lets us detect and block abuse. This data cannot be used to identify you or to reconstruct anything about your finances.
- Daily on-device message counts: kept against the installation hash for 90 days. After that they are added into daily totals that carry no installation hash, and the installation keeps only a single running total of the messages counted.
- Session tokens expire 24 hours after issue and are not stored.
- Attestation challenges are held in memory for 2 minutes and then discarded.
- IP addresses used for rate limiting are held in memory and discarded within the hour. They are never written to disk.
Because the installation hash is anonymous by design, neither you nor we can trace a stored record back to a particular person or device, so we are unable to locate and delete an individual record on request. Uninstalling the app permanently severs any connection between you and that record: the identifier is generated fresh on reinstall, and we have no means of linking a new identifier to an old one. The record that remains holds nothing but a hash and the counts described in section 2.
Data sent for AI classification
Message text sent to OpenRouter is retained and deleted according to OpenRouter's own privacy policy and that of the model provider handling the request. We have no control over, and no access to, that data once the request is made.
Accounts
Pawlet does not offer account creation. There is no sign-up, no login, and no user account associated with the app, and therefore no account for you to delete and no account data held by us.
9. Security
Pawlet stores data in Android's private per-app storage, keeps credentials in the hardware-backed Keystore, offers an optional PIN and biometric app lock, and uses HTTPS for every network request. On the server side, installation identifiers are irreversibly hashed before storage, message content is never persisted or logged, session tokens are cryptographically signed and short-lived, and access to the classification service is gated behind Google Play Integrity attestation.
No system is perfectly secure, and the security of your device — its screen lock, operating system updates, and where you store exported backups — remains an important part of protecting your information.
10. Children
Pawlet is not directed to children under 13 and we do not knowingly collect information from them.
11. Changes to this policy
We may update this policy as the app changes. The "last updated" date at the top will reflect any revision, and significant changes will be noted in the app's release notes. The current version is always available at this URL.
12. Privacy contact
The privacy point of contact for Pawlet is the developer, PastaByte. To ask a question, raise a privacy concern, or request information about how your data is handled, email ahmedsadman.211@gmail.com.