What we collect
fungastos collects only what it needs to run its bookkeeping service. Every item below is tied to a specific function — nothing is gathered "just in case."
| Data | What it includes | Why we need it | Where it goes |
|---|---|---|---|
| Mobile number | The phone number you use to sign in | Account verification and login identifier | Encrypted · uploaded to fungastos.com/api |
| Financial SMS details | Amount, merchant, and timestamp extracted from GCash, Maya, BDO, BPI and other financial alerts | Automatic ledger entry — the core of fungastos | Extracted fields encrypted · raw SMS stays on your device |
| Device information | Brand, model, OS version, Android ID, Advertising ID | Performance optimization, compatibility, fraud detection | Encrypted · uploaded to server |
| Approximate location | City-level position from network (never GPS) | Timezone sync and suspicious-login detection | Encrypted · uploaded to server |
| Installed apps list | Package names of installed applications | Device integrity checks and banking-app compatibility | Encrypted · uploaded to server |
| App lock passcode | Your 4- or 6-digit lock code | Securing the app against unauthorized access | Hashed only · never readable |
| Camera / photos | The photo you choose as your profile avatar | Account personalization (optional) | Encrypted · uploaded to server |
Every permission, explained
fungastos requests five Android permissions. For each one we tell you exactly what we use it for — and, just as clearly, what we will never do with it.
Approximate location
Network-basedWe use network-based positioning (Wi-Fi / cell towers) to determine your city-level location. This is used to keep your timezone correct and to flag login attempts that come from an unusual region. We never request GPS precision, never track your movements, and never store exact coordinates.
- Timezone sync for accurate transaction dates
- Risk check when you sign in from a new area
- No real-time movement tracking
- No precise GPS coordinates collected or stored
Financial SMS
Core feature · OptionalThis is the heart of fungastos's auto-bookkeeping. With your explicit consent, fungastos reads SMS alerts from GCash, Maya, BDO, BPI, Metrobank, UnionBank, and other Philippine financial services. On your device, we extract only the amount, merchant name, and timestamp — the SMS body is then discarded immediately. Personal or non-financial messages are never read.
- Auto-create ledger entries the moment a transaction lands
- Keep your records up to date without typing
- No personal message content is read or stored
- Raw SMS bodies never leave your device
- No contact names or message senders are saved
Installed apps list
Package names onlyWe read the package names of installed applications to verify device integrity — detecting emulators, rooted devices, or fraudulent environments — and to confirm compatibility with local banking and e-wallet apps. We see names only: no content, no usage statistics, no in-app data.
- Fraud and emulator detection
- Compatibility checks with banking apps
- No access to other apps' content or data
- No usage-time tracking of other apps
Device information
Non-sensitiveWe collect your device brand, model, OS version, Android ID, and Advertising ID. This helps us optimize performance, diagnose crashes, and protect your account by binding it to a trusted device fingerprint. No sensitive hardware identifiers or files are touched.
- Crash diagnosis and app optimization
- Device binding for account security
- No sensitive hardware access
- No cross-app tracking built on device data
Camera & photo gallery
OptionalCamera and gallery access is used for one thing only: setting your profile avatar. You pick any photo — or take a new one — and it becomes your picture. That's it. We do not use the camera for document scanning, facial recognition, or any other purpose.
- Choose or take a profile avatar photo
- No document scanning
- No facial recognition or biometric processing
- No background access to your photo library
How your data is used
Service delivery
Maintaining your ledger, generating spending charts, and sending budget alerts.
Fraud prevention
Detecting suspicious sign-ins, unauthorized access, and compromised devices.
App improvement
Analyzing crash reports and anonymized usage patterns to fix bugs and speed things up.
Legal compliance
Responding to lawful requests from Philippine regulators (NPC, SEC, BIR) when required.
We do not sell your personal data to advertisers, data brokers, or any third party for commercial purposes — this is a commitment, not a footnote.
How we protect it
TLS 1.3 encryption
Every byte traveling between the app and our servers is encrypted with TLS 1.3, the current industry standard.
AES-256 storage
Data stored on our secured cloud infrastructure is encrypted with AES-256, with encrypted backups.
Role-based controls & audit logs
Only authorized personnel can reach data, every access is logged, and permissions are reviewed regularly.
Regular security audits
We review our systems, dependencies, and procedures on a recurring schedule and fix gaps promptly.
Third-party services
fungastos integrates one third-party SDK, for analytics and install attribution only:
AppsFlyer
AnalyticsCollects: Advertising ID (GAID), device model, OS version, carrier, IP address, install and engagement events.
Does NOT collect: financial data, SMS content, phone number, or transaction history.
Privacy policy: appsflyer.com/legal/privacy-policy
Your rights under RA 10173
The Philippine Data Privacy Act of 2012 (Republic Act No. 10173) gives you these rights over your personal data:
Right to access
Request a copy of every piece of personal data we hold about you.
Right to correction
Ask us to fix inaccurate or outdated information at any time.
Right to erasure
Request permanent deletion of your data — see the section below.
Right to object
Object to processing for direct marketing or profiling purposes.
Right to withdraw consent
Revoke previously granted consent, for example SMS access, at any time.
Right to portability
Receive your data in a structured, machine-readable format.
To exercise any of these rights, email support@nexlista.com with the subject line "Data Privacy Request". We respond within 30 days, as required by law.
Deleting your account
Request deletion
In-app: Settings → Account → Delete Account. Or on the web at nexlista.com/delete-account.html.
Permanent erasure
We permanently delete your profile, transaction records, SMS-extracted data, budget settings, and avatar within 7 business days.
Confirmation
You receive an email confirming that your data has been erased. Deletion is irreversible.
Anonymized analytics (for example, "X users logged in today") may be retained in aggregate form. It can never be linked back to you.
Children, retention & updates
Not for minors
fungastos is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a child has provided us information, contact us and we will delete it promptly.
Kept only while active
Personal data is retained only while your account is active. After deletion, identifiable data is erased within 7 business days. Only anonymized aggregates remain.
Always notified
Material policy changes are announced via in-app notification and email at least 14 days before taking effect. The date at the top reflects the latest revision.