ESM Privacy Policy
The short version. ESM keeps your subscription list on your phone. There is no ESM account, no ESM login and no ESM server, so we never see what you track, what you pay, or the notes you write. The only copy that ever leaves your device is a backup you switch on yourself, and it goes to your own Google Drive, where we cannot read it.
This policy explains what ESM handles, what stays on your device, and the few things that reach other companies. It is written to be read, not skimmed past.
1. Who we are
ESM is published by Fit4U, a sole trader based in Pakistan, and Fit4U is the data controller for the limited information described below.
Privacy questions and data requests: fit4u.apps@gmail.com
2. The important part: there is no ESM server
Most subscription trackers ask to connect to your bank or your email inbox. ESM does not, and cannot. You type in the subscriptions you already pay for elsewhere, and ESM stores them in its own private storage on your phone.
That has a consequence worth stating plainly: we hold no database of users and no copy of your data. We cannot look up your account, because there is no account. We cannot export your subscriptions on request, because we have never had them.
3. What you enter, and where it is kept
Stored in ESM's private storage on your device, readable by ESM and not by other apps:
- the service name, an optional catalogue reference, and a category
- the price, as an amount and a currency, plus the price history you record
- the billing cycle (monthly, quarterly, yearly, or a custom interval) and the next renewal date
- the status (active, paused, ended) and how far ahead you want reminding
- an optional payment method label — free text you type, such as "the card ending 1234". ESM never validates it, never verifies it and never transmits it. Please do not type a full card number: nothing in ESM needs one
- optional notes
- free trial details: the type of trial, the date it ends, the price that starts afterwards, and whether you told ESM you kept it
- the package name of an app already on your phone, when you add a subscription by picking that app — used only to draw its icon
Also stored on the device, as app preferences: your display currency, theme, date format, reminder switches, whether cloud backup is on and when it last succeeded or failed, whether you have finished onboarding, your Premium status, any temporary analytics unlock, and a cached table of currency exchange rates.
Retention: for as long as ESM is installed. Delete a subscription and it is gone. Uninstall the app and the database and preferences go with it.
3.1 Reading an invoice from a picture or a PDF
Instead of typing a subscription in, you can hand ESM a receipt — a photo, a screenshot, a PDF, a page scanned with the camera, or a file shared to ESM from another app. ESM reads the words on it and fills the add form in for you to check and save.
The reading happens on your phone. There is no upload, no cloud service and no server involved. Text recognition runs as an on-device Google Play services component; the parser that decides which words are the price, the date and the service is ordinary code inside the app.
What happens to the file you choose:
- ESM is given the one file you pick, by Android's own photo picker or file picker. It does not browse your gallery or your storage, and it takes no lasting permission to reopen the file later
- where a file cannot be read where it sits, ESM copies it into its own temporary cache for the read and deletes that copy immediately afterwards, including when the read fails
- ESM keeps no copy of the picture or the PDF. A rendered image of the first page or two is held in memory only, so that the review screen can show you which line each field was read from, and it is gone when you leave that screen
- the only things kept are the values you accept in the form and save — the same fields as any subscription you type in yourself
Scanning with the camera. The scan option opens a Google Play services screen that uses the camera and hands ESM back the scanned page. ESM does not hold the camera permission itself and receives no photograph other than that page; while that screen is open, Google's own privacy policy applies to it.
What is reported. If you have allowed analytics, ESM records that an invoice was read, from which source, how it turned out, and how many fields were filled — as counts and categories. Nothing recognised on the document is ever part of that: not the service, not the amount, not a single word of the text.
4. What ESM does not do
- No ESM account, no sign-up, no password, no email address collected by us
- No connection to any bank, card or financial institution. ESM has no billing feed and no access to real transactions — every figure it shows is one you typed
- No selling of personal information, and no sharing of it for cross-context behavioural advertising, as those terms are defined by US state privacy laws
- No sharing of your subscription list, prices or notes with anyone
- No uploading of the pictures, screenshots or PDFs you hand it, and no copy of them kept
- No location collection, precise or approximate
- No trackers or SDKs beyond the Google services named in section 6
- No profiling or automated decision-making with legal or similarly significant effects
5. What happens before you agree
If you are in the EEA, the UK or Switzerland, ESM shows a Google-certified consent form before any advertising loads. Until you answer it, ESM starts no advertising SDK and collects no analytics or crash data at all — both are switched off in the app itself and are only enabled if your choice allows it.
One request does happen before you answer, and it is fair to name it: ESM asks Google for its own settings, so it knows how to behave. That request carries an identifier for this installation and nothing about you — see section 6.6.
You can reopen those choices at any time from Settings → Privacy options.
6. What is collected automatically, and by whom
6.1 Google Play Billing (Google LLC)
Used to sell and verify Premium, and to show prices in your own currency. Google handles the payment; ESM never sees or stores card details, bank details or billing addresses. ESM receives only a purchase token and whether Premium is active. Google's own privacy policy governs the transaction.
6.2 Backup to your own Google Drive — optional, off by default
If you turn on cloud backup, ESM asks you to authorise access to your Google account using the drive.appdata scope and nothing else. That scope writes to a hidden application folder inside your Drive.
What this means in practice: ESM cannot see, list or open any other file in your Drive. The backup contains your subscription data, it lives in your Google account rather than ours, and we have no access to it. While the feature is on, ESM refreshes the backup periodically in the background. You can withdraw access at any time in your Google Account permissions, and turning the feature off stops any further copies.
6.3 Google AdMob (Google LLC)
Free users see banner, native, interstitial and rewarded ads. Ads may use device identifiers (including the Android advertising ID), general device and app information, and your IP address to select and measure advertising — personalised advertising only where you have consented. Premium subscribers see no ads at all.
How Google uses data from apps that use its services is described here. You can reset or delete your advertising ID in Settings → Privacy → Ads on your device.
6.4 Firebase Analytics (Google LLC) — only with consent
ESM reports a fixed, closed list of about 21 events, and every value attached to them is a category, a yes/no, or a bucket. Concretely, ESM reports things like: which screen was opened; each onboarding step reached; that a subscription was added, along with its billing cycle, category, how it was entered and whether it is a trial; each step of the add flow; that the upgrade screen was opened, a plan chosen, checkout started, and whether a purchase completed or failed; that a backup succeeded or failed, with a coarse reason; that a reminder was opened; that the free limit was reached; and that a rewarded unlock was offered or earned.
What is deliberately excluded, and cannot be sent even by accident: service names, amounts, currencies, renewal dates, notes, payment labels, and any free text you type. The reporting is tied to a Google-generated app instance identifier, not to your name, your email, or any ESM account.
6.5 Firebase Crashlytics (Google LLC) — only with consent
If ESM crashes, it reports the technical stack trace, an identifier for that crash, and device state such as model, operating system version, available memory and whether the app was in the foreground. No subscription content is written into crash reports.
A crash report also carries a short description of the state the app was in, because a stack trace on its own rarely says when the app breaks. That description is limited to these seven values and nothing else:
- How many subscriptions you track, as a range — one of "0", "1-2", "3-6", "7", or "8+". Never the exact number.
- Which plan you are on — free, or which Premium plan.
- Whether backup to your Google Drive is switched on — the switch only, never the contents.
- Whether renewal reminders are switched on.
- Your theme — system, light or dark.
- Your display currency — the three-letter code, such as "USD".
- Whether you have turned on "Show currency code".
The count is reported as a range rather than a number on purpose: an exact figure would make an installation more identifiable while telling us less than the range does. None of these values can name a service, an amount, a renewal date or anything you have typed — the part of the app that assembles them has no way to express any of those.
These are attributes of an anonymous crash report. ESM does not attach a user identifier, a support code, or any other identifier of its own to crash reports.
6.6 Firebase Remote Config (Google LLC)
When ESM starts, it asks Google for its own settings — which features are switched on, how often an ad may appear, whether a new version is worth telling you about, and when the app may offer you Premium without being asked. This is the app asking how to behave, not a report about you: the request carries an identifier for this installation and nothing else. No subscription data, no advertising identifier, and nothing you have typed.
One of those settings decides when ESM shows you its own upgrade offer without you tapping anything — for example once you have added a few subscriptions, or once you have reached the limit of the free version. The rule comes from Google's servers; the decision about whether it applies to you is made entirely on your device, from how many subscriptions you track and whether you already have Premium. Neither of those facts is sent anywhere in order to make it, and every such offer can be dismissed.
This one request is not gated on the advertising consent form, and that is deliberate. Tying it to consent meant that declining advertising also switched off everything else we can control remotely — including the prompt that tells you a new version is available, which you might need most. Everything in sections 6.3 to 6.5 stays consent-gated: no advertising is requested, no analytics event is sent and no crash report is uploaded until you have answered.
6.7 Exchange rates (open.er-api.com)
If you track subscriptions in more than one currency, ESM fetches a table of exchange rates. The request contains only a base currency code — no personal data and nothing about your subscriptions. Like any network request it does reveal your device's IP address to that provider, and the result is cached on your device.
6.8 Notifications
Renewal reminders, trial-ending reminders, price alerts and the optional monthly summary are composed and scheduled entirely on your device. There is no push service and nothing is sent anywhere to produce them.
6.9 Apps already on your phone
When adding a subscription, ESM can suggest apps that are already installed. It uses only the list of apps that appear in your launcher — not the sensitive "query all packages" permission — and the matching happens in memory on the device. That list is never stored and never transmitted.
6.10 Export, import and system backup
You can export your data to a file and read it back in through Android's own file picker. The file goes wherever you choose; ESM does not upload it and does not browse your storage on its own.
Android offers apps an automatic backup of their data to your Google account, and to a new phone when you switch. ESM opts out of it. Your subscriptions and settings are excluded from both, so the only copy that ever leaves this device is one you asked for — an export you saved yourself, or the cloud backup if you switched it on. The practical consequence is worth knowing: moving to a new phone will not bring your subscriptions with it unless you exported them or had cloud backup running.
7. Permissions ESM asks for
| Permission | Why |
|---|---|
| Internet | Prices from Google Play, advertising, exchange rates, and your optional Drive backup |
| Notifications | Renewal and trial reminders |
| Run at startup | So scheduled reminders survive a restart |
ESM asks for no access to location, contacts, camera, microphone, SMS or call logs, and holds no permission over your photos or your files.
Two features do involve them, and both work without ESM being granted anything:
- Choosing a picture or a PDF — Android's own picker shows you your files and hands ESM only the one you choose. ESM cannot see the rest, and cannot open that one again later
- Scanning a page — the camera is used by a Google Play services screen, not by ESM, which receives only the finished scan (see section 3.1)
8. Legal bases (UK / EU GDPR)
| Purpose | Basis |
|---|---|
| Analytics, crash reporting, personalised advertising | Your consent, given through the consent form and withdrawable at any time in Settings → Privacy options |
| Providing Premium and verifying your purchase | Performance of a contract with you |
| Non-personalised advertising and basic app security | Our legitimate interest in funding and protecting a free app, balanced against the very limited data involved |
| Fetching the app's own settings, and telling you a new version exists | Our legitimate interest in the app working correctly and in reaching you with fixes — the request carries an installation identifier and no personal data |
9. International transfers
ESM sends nothing to a server of ours, because there isn't one. Where the Google services above process data outside your country, Google acts under its own transfer safeguards, including the European Commission's Standard Contractual Clauses. The exchange-rate provider receives only a currency code and your IP address.
10. Your rights
Depending on where you live, you have rights to access, correct, delete, restrict, port, or object to the processing of your personal data. ESM is unusual in how these are satisfied, so here is the honest version:
- Access and portability — everything ESM holds about you is on your phone, in the app. Settings → Export writes it all to a file you keep.
- Correction — edit or delete any subscription directly.
- Erasure — delete individual entries, or uninstall the app to remove everything on the device. If you turned on Drive backup, remove access in your Google Account and the backup stops.
- Withdrawing consent — Settings → Privacy options, which also stops analytics and crash reporting.
- Objection and restriction — since analytics, crash reporting and personalised advertising run only on consent, withdrawing it is the fastest route.
For anything the app itself cannot do, write to fit4u.apps@gmail.com and we will respond within 30 days. Please note we may be unable to identify "your" data at all, precisely because we never collected it. For the data Google holds as a result of the services above, use Google's own controls: Google Account — Data & privacy.
If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.
11. How to delete your data
- One subscription: open it and choose Delete.
- Everything on the device: uninstall ESM. The database and preferences are removed with it.
- Your Drive backup: turn off cloud backup in Settings, then remove ESM's access at Google Account — Third-party access, which discards the hidden app folder.
- Advertising identifier: reset or delete it in your device settings under Privacy → Ads.
There is nothing to request from us, because there is nothing held by us.
12. Children
ESM is a household budgeting tool for adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 13 (or under 16 where local law sets that age). If you believe a child has provided information through the app, contact us and we will help you remove it from the device.
13. US state privacy rights
If you live in California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, the following applies.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not collect financial account information of any kind. The categories that reach the third parties named above are limited to identifiers (an advertising ID and an app instance ID), internet activity (which screens and steps were used, in the closed form described in section 6.4), and diagnostics (crash reports). They are used to run and improve the app and to show advertising, and are retained under Google's retention schedules.
To exercise a right to know, delete, correct, or opt out, use the in-app controls in sections 10 and 11, or write to fit4u.apps@gmail.com. We will not discriminate against you for exercising any of these rights.
14. Security
Your data sits in ESM's private storage, which other apps cannot read, on a device protected by your own screen lock and Android's encryption. Every network request the app makes uses HTTPS. Because we keep no copy of your data, there is no server of ours to breach.
No method of storage or transmission is perfectly secure, and a device that is unlocked, rooted or compromised is outside what any app can protect.
15. Changes to this policy
If this policy changes in a way that affects you, we will update the date at the top and, for anything significant, say so in the app or in the release notes. Continuing to use ESM after a change means you accept the updated policy.
16. Contact
Fit4U — sole trader, Pakistan
fit4u.apps@gmail.com