This policy explains how CatTech Enterprise ("we", "us") handles personal data in the MyPurrse Android app (com.cattech.mypurrse) and on https://mypurrse.com. It is written for people in Malaysia, Singapore, the Philippines and Brunei, where MyPurrse is offered, and is meant to meet Google Play's privacy policy rules, Malaysia's Personal Data Protection Act 2010, Singapore's Personal Data Protection Act 2012, the Philippines' Data Privacy Act of 2012 and Brunei's personal data protection law.
Contact: cattech.enterprise@gmail.com · Baca dasar ini dalam Bahasa Melayu
Who we are
MyPurrse is operated by CatTech Enterprise, an SSM-registered sole proprietorship in Malaysia. The public developer name on Google Play is CatTech Enterprise. The app is listed at Google Play (coming soon). Our registration number and address are on the business information page.
We have appointed a Data Protection Officer for Malaysia, Singapore, the Philippines and Brunei. Reach them at cattech.enterprise@gmail.com (subject "Privacy") for any question or request about your personal data.
What MyPurrse does
MyPurrse reads payment notifications from banking and e-wallet apps you choose, sends that text to our self-hosted API for AI classification, and saves income, expense and transfer notes in your main currency (anything foreign or unclear waits for you to check). On every plan, notes are written to a Google Sheet in your own Google Drive; our servers never store your transactions. They keep your sign-in, plan, the account names and apps you chose (with any card digits you add), usage counts, and error reports.
MyPurrse never connects to your bank, e-wallet, or card account, never asks for your online banking login, and cannot move money. It only reads the payment alerts that the apps you choose already show on your phone.
Data we process
Google account
When you sign in with Google we receive your Google user id and email so we can create a MyPurrse account and issue a session. We store a refresh token on our server so the app can stay signed in.
Google Drive and Sheets
If you connect Drive, the app asks for access to the files it creates in your Drive only (it cannot see anything else there). Those files belong to you. We create a MyPurrse folder and monthly sheets such as "MyPurrse yyyy-MM", and optional receipt photos under MyPurrse/Receipts. This is where your transactions are kept on every plan. CatTech does not copy transaction rows into our database.
Notification text
After you grant Android notification access and pick apps to watch, MyPurrse reads the title and body of those notifications. That text can include amounts, merchant names, and other payment details. We send it to our API so a language-model provider can classify it (income, expense, transfer, or ignored). We do not read notifications from apps you did not select, and we do not read your other apps' private screens. If you pick a messages app for a bank that alerts by SMS, only texts that mention money (an amount with a currency or a payment word) are sent; every other text stays on your phone.
Receipt scans
If you scan a receipt, the photo is read on your phone. Only the extracted text is sent to our API. If you keep receipt photos on, the image is saved in your Drive, not on our server.
Your accounts, alert apps, and usage
We store the account names you create (for example "Maybank Savings" or "Cash"), the Android package names of the apps you chose to read alerts from, the last 4 digits of any card or account number you add to an account (never a full number; the app uses them to record an alert to the right account), whether a card is debit or credit and whether an account is personal or business, your plan, and how many auto-reads and receipt scans you have used each day. This applies your plan's allowances; the app shows what is left as a percentage. For each AI read we also log its size in tokens, what it cost us, how long it took and whether it worked, never the text itself, so we can keep plans affordable.
Google Play purchases
If you subscribe in the app, Google Play tells us the product id, purchase token, and whether the plan is active. Payments are handled by Google. We do not see your full card number.
Website purchases (Stripe)
If you buy a plan on mypurrse.com, you sign in with Google on the website so we can match the payment to your MyPurrse account. Stripe processes the payment and handles your card or bank details under its own privacy policy; we never receive them. Stripe tells us your Stripe customer and subscription ids, which plan you bought, whether it is active or cancelled, and when the paid period ends. Stripe may email you receipts and renewal reminders.
Optional "Help improve MyPurrse"
This is off unless you choose it: the app asks once during setup, and the switch is in Den, Privacy. If you opt in, we keep a masked copy of what was sent to the model, what it answered, and what we did with it, for up to 180 days, so we can improve accuracy. Emails, one-time codes, and long number sequences are masked first. Turning it off stops new samples. You can delete kept samples in the app at any time.
Error reports
When the app crashes or something fails, it sends us an error report so we can fix it: the technical error details (stack trace), where in the app it happened, the app version, Android version, and phone model, linked to your MyPurrse account if you are signed in. Our server logs its own errors the same way. Emails, one-time codes, and long number sequences are masked before reports are stored. Error reports are not meant to contain your transactions or notification text.
Setup progress
While a new install is set up, the app tells our server once which setup steps it reached (for example “signed in”, “allowed alert access”, “first payment saved”) and the app version. Nothing else goes with it: no account, email, device id, or sign-in token. We keep only how many installs reached each step on each day, so we can see where people get stuck.
Merchant category memory (Pro and Max)
If you correct a category, we may remember that merchant for your account so later payments can be labelled the same way across your devices.
Budgets, debts and loans
Budgets and the debts and loans you add (who you pay, the instalment, how many are left) stay on your phone and in its Google backup. They are never sent to our server.
How we use data
- To sign you in and keep your session.
- To classify alerts and receipts you ask us to read.
- To save notes to your Google Sheet and show them in the app.
- To apply plan allowances and restore Play subscriptions.
- To find and fix crashes and errors.
- To see where people get stuck setting up the app (counts only).
- To improve classification, only if you opt in to Help improve MyPurrse.
- To answer support mail you send us.
We do not show ads in the app. We do not sell personal data. We do not use your payment alerts for advertising.
Where data lives
- Your Google account: identity, Drive folder, Sheets, optional receipt photos.
- Our VPS (currently in Singapore): user id, email, refresh tokens, account names, alert apps and card digits, usage counts, Play subscription state, optional AI samples, merchant corrections, error reports, daily counts of setup steps reached. No transactions.
- Language-model providers: alert or receipt text, for classification. Each alert goes to one provider at a time: currently Alibaba Cloud Model Studio (Qwen, Singapore region), and only when it is unavailable, OpenAI (United States), then Google Gemini. We do not store that text on our server unless you opted in to Help improve MyPurrse, with one exception below.
- Known promotions: when the AI finds an alert is not a payment (a bank’s promotion, an app’s news), we keep a fingerprint of it so the same broadcast is skipped for everyone without another AI read. Once two different users have received the identical alert, we also keep its text, masked (emails, codes and long numbers removed), because it is the sender’s broadcast rather than your own message. We never keep alerts that were read as payments this way.
Some processing happens outside your country: our server is in Singapore, and the model provider runs in its own regions. We use this because the app cannot classify alerts without that infrastructure, and we only work with providers bound to protect the data to a comparable standard.
Who we share with
- Google: Sign-In, Drive/Sheets (your account), Play Billing.
- Stripe: payments for plans bought on the website (your email, plan and payment details, which Stripe collects directly).
- Our language-model provider: notification or receipt text, to return a classification.
- Our hosting provider: the VPS that runs the API and database.
We may disclose data if required by law or to protect the service from abuse. We do not share data with data brokers.
How long we keep it
- Account names, alert apps, card digits, plan, and usage: while your MyPurrse account exists.
- Website purchase records (Stripe ids, plan, period): while your account exists, and afterwards as long as tax and accounting law requires.
- Refresh tokens: until you sign out, or until they expire and are cleaned up.
- Help improve samples: up to 180 days, or sooner if you delete them.
- Error reports: up to 90 days.
- Known promotions: dropped after 60 days unseen, and checked again by the AI at least every 30 days. Deleting your account removes the link to you; deleting your Help improve samples also removes promotion text kept only because you had opted in.
- AI read logs (size, cost, time, outcome; no text): up to 400 days. Deleting your account removes the link to you.
- Google Sheet rows and receipt photos: until you delete them in Drive. Signing out does not delete Drive files.
- Server backups: nightly dumps are kept on the VPS for about 14 days.
- Support email: as long as needed to handle your request.
Your choices
- Pick which apps MyPurrse reads alerts from, and change them any time in My accounts.
- Turn notification access off in Android settings. Tracking stops on that phone.
- Turn Help improve MyPurrse off, and delete kept samples, in Den, Privacy.
- Disconnect Google Drive in the app. Existing sheets stay in your Drive.
- Cancel a paid plan in Google Play, or under Manage billing on the Manage subscription page if you bought it on the website.
- Ask us to delete server-side account data. See Delete account.
Depending on where you live, the law gives you rights over the personal data we hold: to access it, correct it, have it deleted, withdraw consent, or limit how it is processed. Email cattech.enterprise@gmail.com from the Google address you use in the app and we will reply within the time your law requires. You may also complain to your data protection authority (for example the Personal Data Protection Department in Malaysia, the PDPC in Singapore, the National Privacy Commission in the Philippines, or AITI in Brunei).
Children
MyPurrse is a personal finance app. It is not directed at children under 18. We do not knowingly create accounts for children. If you believe we have, email us and we will delete the server record.
Security
The API is reached over HTTPS. Sessions use signed tokens. The language-model API key and database password stay on the server, not in the Android app. Notification text is truncated before it is sent. Your ledger stays in your Google account. No method is perfect. Please protect your Google account and your phone.
If a data breach affecting your personal data is likely to cause you significant harm, we will tell you and the relevant authority within the time your law requires (for example 72 hours to the regulator in Malaysia and the Philippines, 3 days in Singapore and Brunei), and explain what happened and what you can do.
Permissions the app uses
- Internet, to reach our API and Google.
- Notification access, only for apps you select.
- Post notifications, so MyPurrse can tell you what it filed.
- Battery-optimisation exceptions and boot restart, so capture can keep running.
- Optional camera or photos, only if you scan a receipt.
This website
The site at https://mypurrse.com is static. Most of it needs no account. It may store your companion-cat and light/dark choice in the browser (localStorage) so the page looks the same on the next visit. The plans and subscription pages (/plans/ and /account/) use Google sign-in and keeps a one-hour sign-in token in the browser tab (sessionStorage) until you close it or sign out. It also remembers the currency you pick on the plans page and whether the app is on Google Play yet, so the page doesn’t change after it loads. This site sets no cookies and runs no analytics or advertising trackers.
Changes
If we change this policy in a material way, we will update the date above and publish the new text at https://mypurrse.com/privacy. If in-app Help improve wording changes, older consent stops recording until you accept again.
Contact
CatTech Enterprise
Malaysia
cattech.enterprise@gmail.com
Registration details and address: business information
This policy is also available in Bahasa Melayu. If the two versions differ, the English version applies.