Features How It Works Download App

Privacy Policy

Last updated: October 31, 2026

Code4change ("we", "our", or "us") operates the Moni mobile application. This Privacy Policy describes how we collect, use, and share your personal information when you use our app.

1. Information We Collect

Information You Provide

  • Account Information: Name, email address, and profile picture when you create an account
  • Financial Data: Expense entries, budget settings, group information, and transaction details you input into the app
  • Communications: Messages you send to us for support or feedback

Information Collected Automatically

  • Device Information: Device type, operating system version, unique device identifiers
  • Usage Data: App features used, interaction patterns, crash reports, and performance data
  • Log Data: Access times, pages viewed, and referring app information

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Moni application
  • Process and manage your expense tracking and budget data
  • Enable group expense sharing and settlement features
  • Send notifications about your financial activity and app updates
  • Analyze usage patterns to improve user experience
  • Provide customer support and respond to your requests
  • Detect and prevent fraud or security issues

3. Data Storage & Security

Your financial data is primarily stored locally on your device using SQLite database with encryption at rest. When cloud sync is enabled:

  • Data is encrypted in transit using TLS 1.3
  • Cloud storage uses AES-256 encryption at rest
  • We use Supabase as our cloud infrastructure provider
  • Data is stored in secure data centers with SOC 2 compliance

The app follows an offline-first architecture, meaning your data remains accessible and functional even without an internet connection. Sync occurs automatically when connectivity is restored.

4. Transaction Notification Capture

Moni can optionally create transactions for you from the notifications your bank and e-wallet apps send when money moves in or out of your account. This feature is off by default and only works after you turn it on.

On Android

  • When you turn the feature on in Settings, Android asks you to grant Moni notification access. Moni uses this access only to read notifications from a fixed list of supported bank and e-wallet apps. Notifications from any other app are ignored on the device and never read or sent.
  • Notifications about one-time passwords (OTP), verification codes and sign-in are dropped on your device and never leave it.
  • Your account balance is masked on the device before anything is sent.

On iPhone (iOS 27 or later)

  • You install a Shortcuts automation ("When I get a notification") and choose to switch it on. The automation passes the title, body and app name of notifications from the bank and e-wallet apps it lists to Moni. It runs in the background without opening the app.
  • Moni does not have access to any other notifications on your iPhone. The same OTP filter and balance masking run on the device before sending.

What we send, process and keep

  • Sent to our server: the notification title and text (with the balance masked), the source app, the time it was posted and a device identifier. It is sent over an encrypted HTTPS connection, authenticated with a token issued for your device. We store only a hash of that token, never the token itself.
  • Processing: our server masks the balance and filters OTP and sign-in messages again, then reads the amount, direction and counterparty using built-in templates for supported banks. If no template matches, the masked text may be sent to our AI processing provider, Groq, to read the transaction (see Third-Party Services).
  • What we keep: the resulting transaction (amount, income or expense, date, category, counterparty or memo, and the source app) is saved in your personal wallet and synced like any transaction you enter yourself. We do not store the original notification text; we keep only a one-way fingerprint of it to avoid recording the same transaction twice. Server logs record the source app, a hash of the text and the outcome, never the text, your balance or your token.

Your control

  • Every transaction created this way is marked as automatic, and you can undo, edit or delete it at any time.
  • You can turn the feature off in the app at any time. This revokes the device token on our server, so nothing more is accepted from that device. You can also remove notification access in Android settings or delete the automation in the Shortcuts app.
  • Signing out stops capture for that account. Deleting your account deletes the transactions and capture settings associated with it.

5. Third-Party Services

We integrate with the following third-party services:

  • Supabase: Backend infrastructure and authentication
  • Google Sign-In / Apple Sign-In: Optional authentication providers
  • Expo / React Native: App framework and over-the-air updates
  • Affiliate Partners: For cashback reward features (anonymized purchase data only)
  • Groq: AI processing provider. Groq reads receipt and transfer screenshots you choose to scan, and transaction notifications (with the balance masked and OTP messages removed) that our built-in templates cannot read. Groq processes this data on our behalf to return the result. Under Groq's terms, it does not use this data to train models and does not retain it by default, though it may keep request logs for up to 30 days for reliability and abuse monitoring. Groq may process this data in the United States.

Each third-party service has its own privacy policy governing its use of your data. We encourage you to review their policies.

6. Data Sharing

We do not sell your personal information. We may share your data only in these circumstances:

  • Group Members: Expense data shared within groups you voluntarily join
  • Service Providers: Third-party services that help us operate the app (subject to confidentiality agreements)
  • Legal Requirements: When required by law, legal process, or government request
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

7. Your Rights

You have the right to:

  • Access: Request a copy of your personal data
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your account and associated data
  • Export: Export your financial data in a portable format
  • Opt-out: Disable cloud sync and keep data local-only

To exercise these rights, contact us at moni.support@gmail.com.

8. Children's Privacy

Moni is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately and we will delete such information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the app and updating the "Last updated" date. Your continued use of Moni after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: