Privacy Policy

AlloCat is a personal-finance app operated by Octane Innovations. Your financial data is yours. We collect the minimum needed to run the app, we never sell your data, and we never share it with third-party advertisers or data brokers. On Android, the raw content of your SMS messages never leaves your device. On iPhone, if you set up automatic capture, the text of matching bank messages is sent to us to be read and is never stored.

AlloCat’s core feature is automatic spend tracking from your bank/UPI transaction SMS (“SMS-based money management”). To support this on Android, the app uses the RECEIVE_SMS permission. We handle this data as follows:

• On-device parsing. When a new SMS arrives, it is examined on your device. Only messages that look like a financial transaction (a debit/credit with an amount) are processed. One-time passwords (OTPs), personal messages, and promotional texts are filtered out and discarded immediately.
• The raw SMS never leaves your device. The full message text and the sender are stored only in local storage on your phone (for display and de-duplication). They are not uploaded to our servers.
• No third parties. SMS content is never sent to any third-party service, advertiser, or AI provider. All parsing is local.
• We do not read your SMS inbox. AlloCat only inspects messages as they arrive; it does not request the READ_SMS permission and never reads your existing stored messages.
• What syncs to your account. Only the fields extracted from a transaction SMS - the amount, currency, a normalized merchant name, the direction (spend/credit), and a date - together with a one-way hashed de-duplication key, are synced to your account so your budgets stay consistent across devices.

iPhone apps cannot read SMS. If you choose to set it up, an automation you create in Apple’s Shortcuts app sends the text of incoming messages that contain a keyword you pick (for example “debited”) to AlloCat. We handle this data as follows:

• Only what you choose. AlloCat never sees any message unless it matches the keyword in your own automation. The sender is not sent.
• Read once, never stored. Our server reads the message text in memory to find the amount and merchant, using the same parser as the Android app, then discards it. It is not written to our database or our logs, and is never sent to any third party or AI provider.
• What is kept. The same extracted fields as on Android - amount, currency, merchant, direction and time - plus one-way hashed keys used to avoid duplicates.
• Your key. The shortcut identifies your account with a personal key. We store only a one-way hash of it. You can switch it off at any time in the app, which stops all capture immediately.

When you sign in, we store the data you create in the app - budgets, categories, goals, debts, assets, net-worth snapshots, and the extracted transaction fields described above. This is kept in our managed database (Supabase) and is associated with your account so it can sync across your devices. It is transmitted over encrypted connections.

We support email and Google sign-in. We store your email address and an account identifier to operate your account. We do not access your Google contacts, email, or other Google data beyond basic profile/email needed for sign-in.

Your data is used solely to provide the app’s features: tracking budgets and spending, syncing across your devices, and sending you notifications you have enabled (for example, a budget-limit alert). We do not use it for advertising or marketing, and we do not sell it.

Our marketing site (grow.allocat.xyz) counts page views and clicks on the download, sign-in and donate buttons so we can tell whether the page is doing its job. These counts are anonymous: we record the event name, a coarse device type (Android, iOS or desktop), the page path, and the hostname of the site you arrived from. The marketing site does not set cookies, use any third-party analytics service, or store your IP address, and nothing recorded there can be linked back to you or to an AlloCat account.

Inside the app (on the web and in the Android app) we use PostHog to understand how AlloCat is used, so we can tell which features help people and where they get stuck. We record which screens you open, which features you use (for example “added a budget item” or “made a debt payment”), how long a session lasts, and a coarse device type (web, installed app or Android).

These analytics are anonymous. They are tied to a random identifier stored on your device, not to your AlloCat account, email or name, and that identifier is replaced when you sign out. We do not send amounts, balances, merchant or category names, notes, or any SMS content.

We also record some sessions (session replay) to find confusing screens and bugs. In these recordings every piece of text, every input field and every image is masked on your device before anything is sent, so they show the layout and taps but none of your financial details.

PostHog processes this data on our behalf. It is not used for advertising, not shared with advertisers or data brokers, and not sold.

Some AlloCat features use AI, including the in-app assistant, weekly insights, and certain alert messages. To generate these, we send the relevant derived financial context (such as budget totals, spending amounts, and category names) to our AI provider, OpenRouter, which processes the request and returns a response. We do not send the raw content of your SMS messages to any AI provider. This data is used only to produce the feature you asked for; it is not used for advertising or marketing, and we do not sell it.

AlloCat is free. There is no subscription, no paid tier, and no in-app purchase - every feature is available to every account.

If you claim a founding-member spot, we record your account's email address, the date and the platform you claimed on (web, installed app or Android). We use this only to tell you when Premium launches and to apply founding-member pricing to your account. Claiming costs nothing and changes nothing about how the app works. The record is deleted with your account.

With your permission, AlloCat sends local and push notifications - for example, when a new transaction needs categorizing or a budget nears its limit. You can disable these in your device settings at any time.

You can withdraw SMS or notification permission at any time in Android settings; the related features simply stop. On iPhone, delete the automation in the Shortcuts app or turn off iPhone auto-capture in AlloCat. You may permanently delete your account and all associated data in-app under Profile → Delete account, or by following the steps on our account-deletion page. Deleting the app also removes all locally stored data, including any raw SMS text.

AlloCat is not directed to children under 13.

We may update this policy; material changes will be reflected by the “Last updated” date above.

Questions about this policy or your data? Email innovationsoctane@gmail.com.