Overview
Tang La ("the app", "we", "our") is a personal budgeting and loan-tracking app for Android, developed by an independent developer (Cat Studio). This policy applies to everyone who installs the app from Google Play.
The short version: Tang La is built around a local, on-device database. There is no Tang La account, no Tang La server, and no Tang La backend that your transactions, balances, or notification content ever gets sent to. Every feature below that reaches the internet is optional, off by default or requires you to explicitly turn it on, and is described here in full.
Your Data Stays On Your Phone
Everything you enter or the app records — accounts, transactions, budgets, categories, tags, recurring rules, loan details, notification history — is stored in a local database file inside the app's private storage on your device. It is never uploaded anywhere unless you explicitly use one of the optional features described in sections 4–6.
Uninstalling the app deletes this database along with everything in it, unless you've made a backup first (see sections 4 and 5).
Notification Access
Tang La can automatically log a transaction when your bank or e-wallet app sends you a notification — for example, "Payment successful, ฿150.00" — so you don't have to type it in by hand. This requires Android's Notification Listener permission, one of the more sensitive permissions an app can request, so we want to be precise about what it does.
You choose which apps to listen to. Notification access is off for every app until you explicitly select it in Settings → Notifications. Nothing is read from apps you haven't selected.
Everything is processed on your device. The text of a selected app's notification is matched against patterns you configure (or the app suggests), entirely on-device, to pull out an amount, a category, and an account. The result becomes a normal transaction in your local database — the same as if you'd typed it in yourself.
Notification text is never uploaded. It is not sent to us, to the notification's own app, or to any third party. It's kept in your local notification history purely so you can review or correct how a transaction was created — you can delete this history at any time from within the app.
Non-money notifications are filtered out before anything is stored: an app is only listened to if you selected it, and a notification is only kept if it looks like it's about money (contains a digit and one of your configured keywords) and isn't excluded by your own filter words.
A related permission, "query all installed apps," is used only to show you the list of apps you can choose from in that settings screen — it doesn't read any data from those apps.
Optional Google Drive Backup
If you turn this on (Settings → Backup), Tang La can save an encrypted copy of your database to a folder in your own Google Drive, either on demand or automatically on a schedule you set. This is entirely opt-in and off by default.
Signing in uses Google's standard OAuth sign-in flow. To exchange the sign-in code for an access token without embedding a secret key inside the app itself, this step passes through a small relay server we operate (a Cloudflare Worker acting purely as an OAuth relay). That relay only ever sees short-lived authorization tokens — it never sees your backup file, your transactions, or any financial data. Once authorized, your backup file is uploaded directly from your device to the Google Drive API, straight into a folder in your own Drive account, using Google's own servers.
You can disconnect Google Drive at any time from the same settings screen, which stops future backups and revokes the app's access. Files already uploaded to your Drive are yours — deleting or managing them is done through Google Drive itself, the same as any other file you own there.
Manual Backup Files
You can export your data to a file at any time, independent of Google Drive. Export files are encrypted before being written to your device, so a file that ends up copied, synced, or shared somewhere isn't readable by simply opening it in a text or file viewer. Where that file goes afterward — a cloud drive, a messaging app, a USB cable — is entirely up to you; we have no visibility into it.
Optional Local API Server
Tang La includes an optional local server (Settings → External Connection, off by default) that lets a tool you control — a phone automation shortcut, a script on the same device or Wi-Fi network — create transactions without opening the app. It requires a secret access token to use, and you choose whether it's reachable only from this device or from other devices on your own local network. It never phones out to the internet on its own; it only answers requests you or your own tools send to it.
Purchase Verification (Premium Version)
The premium version of Tang La occasionally checks (at most once per app launch) whether this specific install was actually purchased through Google Play, to guard against a tampered or redistributed copy of the app. This doesn't apply to the free version at all — it has no paid features to lock in the first place.
The check uses Google's Play Integrity API: your device generates an integrity token through Google Play Services itself (not something Tang La builds), which is then sent to the same small relay server we already run for the Google Drive sign-in flow (section 4) — a different endpoint, unrelated to that flow, with no Google account sign-in involved — to be decoded and read directly from Google.
What comes back is a single answer: "purchased" or "not purchased." This token contains no personal data, no Google account information, and no financial data whatsoever — it's purely a technical attestation from Google's own systems. If the check can't complete for any reason (e.g. no internet connection), the app is treated as still working normally rather than locking features unnecessarily.
Advertising (Free Version)
The free version of Tang La shows ads, served through Google AdMob, to help support keeping the app free to use.
AdMob may collect and use your device's advertising ID, device and app information (such as device model and OS version), and ad-interaction data (such as impressions and clicks) to serve and measure ads. Depending on your region and consent choices, ads may be personalized (interest-based) or non-personalized.
Whatever AdMob collects is entirely separate from your financial data — it never has access to your transactions, balances, or notification history stored in your local database.
Ad-serving is governed by Google's advertising policies. You can manage personalized-ad settings at any time through your device's Google Settings → Ads.
App Lock
If you enable the app lock (PIN or biometric), unlocking is handled entirely by Android's own authentication system on your device. Your fingerprint, face data, or PIN is never seen, stored, or processed by Tang La itself — the app only receives a yes/no result from the operating system.
Permissions We Ask For
Here's every Android permission Tang La requests, and specifically why:
| Permission | Why |
|---|---|
| Notification access | Reads notifications from apps you select, to log transactions automatically. See section 3. |
| Post notifications | Lets the app show you its own reminders (budget alerts, bills due) and the required "running in background" notice. |
| Query all packages | Populates the app-picker list in Settings so you can choose which apps to allow notification access from. |
| Foreground service | Keeps notification listening and scheduled tasks (recurring bills, backups) running reliably while the app isn't in the foreground. |
| Receive boot completed | Restarts that background service after your phone reboots, so notification capture doesn't silently stop working. |
| Ignore battery optimizations | Lets you optionally exempt the app from aggressive battery management that could otherwise kill notification listening. You can decline this prompt. |
| Internet | Used only by the optional features in sections 4 and 6, by the premium version's purchase verification (section 7), to serve ads in the free version (section 8), and to load the app's typefaces the first time you open it. |
| Advertising ID | Used by Google AdMob, free version only, to show and measure ads. Never linked to your financial data. See section 8. |
What We Don't Do
- ✓ No analytics, tracking, or crash-reporting SDKs.
- ✓ No account required to use the app.
- ✓ We do not sell, rent, or share your financial data with anyone.
- ✓ No server of ours ever stores your transactions, balances, or notification text.
- ✓ Nothing you enter into the app — transactions, balances, notification text — is ever shared with our ad partner.
Sharing With Third Parties
We don't share your financial data with third parties. The only services Tang La ever communicates with are ones you explicitly choose to use (or, for ads, that support the free version, or for the premium version, that verify your purchase), and only for what's described above:
- Google Drive — only if you turn on Drive backup (section 4), for storing your own encrypted backup in your own Drive account.
- Our OAuth relay — only during Drive sign-in, to exchange a login code for an access token. It never touches your financial data.
- Google Play Integrity API / our own relay — premium version only, to confirm the app was actually purchased through Google Play. Never touches your financial data or Google account. See section 7.
- Google AdMob — free version only, to serve and measure ads. See section 8 for exactly what it collects.
- Google Fonts — to download the app's typefaces the first time it runs, the same as most modern apps and websites.
Google's own use of data from its services (Drive, AdMob, Fonts) is governed by Google's Privacy Policy, not this one.
Keeping & Deleting Your Data
Your data lives on your device for as long as you keep the app installed. You're always in control of it:
- Delete individual transactions, accounts, or your notification history any time from within the app.
- Uninstalling the app permanently deletes its local database.
- Disconnecting Google Drive (section 4) stops future backups; existing backup files in your Drive are managed and deleted through Google Drive itself.
Children's Privacy
Tang La is a personal finance tool intended for general audiences and is not directed at children. We do not knowingly collect data from children, and given the app collects no data on our servers in the first place, there is no server-side data to hold or delete. Ads (section 8) are served under Google's standard, non-child-directed treatment.
Changes to This Policy
If this policy changes, we'll update the "Last updated" date at the top of this page. Meaningful changes — anything that changes what data the app accesses or how it's used — will also be noted in the app's own update notes on Google Play.
Contact Us
Questions about this policy or how Tang La handles your data are welcome any time.