Currenci

Privacy

The short version: the app collects nothing. The full policy, last updated in October 2026, is below.

Summary

CurrenciX does not collect, transmit, store, or share any personal data. The app has no account system, no analytics, no advertising SDK, and no crash-reporting service. Its network activity is fetching exchange rates from the providers you select, and, only if you scan receipts, a one-time download of the text reader's data (below).

Data collected by this app

None. The app does not collect any data whatsoever from users.

Permissions

The app requests these Android permissions:

  • android.permission.INTERNET — required to download exchange rates from the selected provider.
  • android.permission.ACCESS_NETWORK_STATE — lets the app check whether you're online before it asks for rates. It gives no access to network identifiers or traffic.
  • android.permission.USE_BIOMETRIC — only for the optional app lock (Settings → Security & privacy): it lets the app show the system's fingerprint, face or screen-lock prompt. The prompt is Android's; the app only learns whether you got through, never your fingerprint, face or PIN.
  • android.permission.POST_NOTIFICATIONS — only for rate alerts, and asked for only when you set your first one. Alerts are checked on your device against the rates the app already downloads; nothing about them leaves the phone.

The app does not request access to your location, contacts, camera, microphone, storage, phone state, or any other sensitive permission. To offer the local currency when you travel, it reads which country's mobile network the phone is on, which needs no permission; that stays on the phone and is only compared with your phone's region.

Network activity

For rates, the app makes outbound HTTPS requests only to the exchange rate provider you have selected in Settings and to the fallback provider set there (asked at the same time, in case the main one fails). The request contains:

  • The URL of the rates or history endpoint (publicly documented by each provider)
  • Your device's standard HTTP headers (User-Agent, Accept-Encoding, etc.)
  • For Open Exchangerates or AllRatesToday, your API key for that provider, in a request header

With Settings → Security & privacy → Private requests on, every request is sent the same way as everyone else's: a fixed app name instead of the usual software versions, and none of the cache identifiers a server could use to recognise your phone from one request to the next. Your IP address still reaches the provider, as with any connection.

No personally identifiable information is included in these requests. The providers' own privacy policies govern how they handle server-side access logs.

In the Google Play version, the first receipt scan downloads the text reader from Google Play, which handles that download under its own privacy policy. Reading receipts also needs text-recognition data, English and, if you choose, your app's language, a trip's language or others you add in Settings → Receipt languages, downloaded once from Tesseract's public repository on GitHub (raw.githubusercontent.com). Nothing is downloaded until you agree: the first scan names each download and its size, and your app's language is a separate choice you can decline. The request is for a fixed public file and carries nothing about you; the file is checked against a fingerprint built into the app before it's used.

Receipt photos are read entirely on your device and are never uploaded. A photo taken for a scan is deleted as soon as it has been read. The app has no camera permission: the photo comes from your camera app or the system photo picker.

A scanned receipt: milk, bread and bananas with their prices, ticked to add to the cart, with a note that it was read on the phone.
A receipt, read on the phone: the photo never leaves it.

Providers' privacy policies

Exchange rate settings: the data provider, a switch to show unreliable providers, auto-refresh and how often to refresh.
Where you pick the provider the app asks for rates.

Local storage

The following data is stored locally on your device, in the app's private storage. It is never transmitted to any server:

  • Cached exchange rates and rate history
  • Selected currencies, recent pairs and the last historical date
  • Starred (favourite) currencies
  • Settings (theme, fees, provider choices, keypad, quick-conversion amounts, receipt languages, app lock, screenshot blocking) and any API keys you entered, sealed with a key the phone's Keystore holds
  • Carts, trips (with their destinations and dates) and rate alerts
  • A small diagnostic log and records of the app's last few crashes

Nothing leaves the device unless you send it: a backup (with your API keys only when it has a password) or a cart export goes to a file you choose, and About this app → Report a problem shares the crash details (app and Android version, phone model, and where in the app's code it failed) only through the app you pick.

This data is cleared when you uninstall the app. It can also be cleared via Android Settings → Apps → CurrenciX → Clear Data.

The backup screen: export to a file, or import from a file.
Backups go to a file you choose.
The backup password prompt in the dark theme, saying the password didn't decrypt the file.
An encrypted backup opens only with its password.

Third-party libraries

CurrenciX does not include any third-party analytics, advertising, crash-reporting, or social-login SDK. The complete dependency list is public in the repository's app/build.gradle.kts file.

Children

The app does not knowingly collect any data from children or from any user, regardless of age.

Changes to this policy

If the privacy posture of the app ever changes materially, this page will be updated and the change will be noted in the release changelog.

Contact

For privacy questions or concerns, open an issue on the GitHub repository.