Security Standards

Security Policy

PP Expense
Operated by Publicity Poster
Website: https://expense.ppapps.in/
Contact: [email protected]

Last Updated: September 5, 2026

At Publicity Poster, we take the security and privacy of PP Expense users seriously. PP Expense is designed as a privacy-first, offline-first personal finance application, with an architecture intended to keep core financial information under the user's control.

This Security Policy explains the security practices, safeguards, limitations, and responsibilities associated with PP Expense.

This policy should be read together with our Privacy Policy, Terms of Service, and Data Deletion Policy.

1. Security Philosophy

PP Expense is designed around the principle of data minimization and local-first processing.

The core application is designed to allow users to manage their financial records locally on their device without requiring mandatory online account access for basic expense-management functionality.

Where online functionality is used, such as Google Sign-In, Google Drive backup, subscriptions, advertisements, or support services, information may be transmitted to or processed by the relevant service providers as described in our Privacy Policy.

2. Local Data Storage

Core PP Expense financial records may be stored locally on the user's device.

Depending on the features used, locally stored information may include:

• Expenses;
• Income;
• Transactions;
• Transfers;
• Budgets;
• Categories;
• Tags;
• Payment methods;
• Notes;
• Financial summaries; and
• Other information created within the App.

Local storage reduces the need to transmit ordinary financial records to a remote server simply to use the core functionality of the App.

However, local storage does not eliminate all security risks associated with the user's device.

3. Data Isolation

PP Expense is designed to maintain financial information within the App's local data environment.

We aim to prevent ordinary PP Expense financial records from being unnecessarily exposed to unrelated applications or services.

The effectiveness of application-level isolation also depends on the security mechanisms provided by the Android operating system and the security state of the user's device.

4. Offline-First Architecture

PP Expense's core functionality is designed to operate offline.

This architecture helps reduce unnecessary network transmission of ordinary financial records.

An internet connection may nevertheless be required for optional or online-dependent functionality, including:

• Google Sign-In;
• Google Drive backup and restore;
• Subscription and payment verification;
• Advertisements;
• Support submissions;
• Certain diagnostics or analytics functionality; and
• Other third-party or server-dependent services.

Offline operation should not be interpreted as a guarantee that no information can ever leave the device.

5. Network Security

When PP Expense transmits information over networks where encrypted communication is supported and applicable, we use secure communication mechanisms such as HTTPS/TLS.

These mechanisms are intended to protect information from unauthorized interception during transmission.

However, no internet transmission method can be guaranteed to be completely secure.

The security of third-party services and networks outside our control is governed by the relevant provider's own security practices.

6. Google Sign-In Security

PP Expense may provide optional Google Sign-In.

Authentication is handled through Google's authentication infrastructure rather than requiring PP Expense to receive your Google account password.

We aim to request only the Google account information and permissions reasonably necessary to provide the applicable functionality.

Your Google account remains protected by Google's own security systems and account-security controls.

You should use appropriate security measures for your Google Account, including strong account credentials and available multi-factor authentication.

7. Google Drive Backup Security

PP Expense may provide an optional Google Drive backup and restore feature.

When you authorize Google Drive access:

• PP Expense accesses only the information and resources permitted by the authorization you provide;
• Backup data may contain your PP Expense financial records;
• The backup is stored within your Google Drive environment;
• Google Drive security and availability are also relevant to the protection of that backup; and
• You are responsible for protecting your Google Account and Google Drive account.

We recommend maintaining appropriate security on the Google Account used for PP Expense backups.

8. Backup Security

Backups can provide protection against device failure or accidental data loss, but they also create additional copies of information.

Users should therefore:

• Protect their Google Account;
• Avoid sharing backup files unnecessarily;
• Store exported files securely;
• Avoid uploading financial exports to untrusted services;
• Delete old backups that are no longer required; and
• Verify backups before relying on them for recovery.

A backup is only as secure as the account, device, storage location, and access controls protecting it.

9. App Lock

PP Expense may provide an App Lock feature intended to help prevent unauthorized access to the App when someone has physical access to your device.

App Lock is an additional security layer and should not be considered a complete security solution.

Your device's own:

• Screen lock;
• PIN;
• Password;
• Biometric authentication;
• Encryption; and
• Operating-system security

remain important.

We strongly recommend using a secure device lock.

10. Device Security

The security of locally stored PP Expense information depends partly on the security of your Android device.

We recommend that users:

• Keep Android and security updates current;
• Use a strong screen lock;
• Enable biometric protection where appropriate;
• Avoid installing applications from untrusted sources;
• Avoid using rooted or compromised devices for sensitive financial information;
• Do not share device credentials;
• Protect their Google Account; and
• Install PP Expense only from trusted distribution channels.

We cannot guarantee the security of information on a device that has been compromised, rooted, infected with malware, or otherwise operated outside normal security controls.

11. Encryption

PP Expense uses security measures intended to protect data during applicable network transmission.

The App's local data protection also depends on the security capabilities of the Android operating system and device.

We do not represent that every item of locally stored information is independently encrypted by PP Expense using a separate encryption layer.

Therefore, users should not interpret this policy as a guarantee that every local database record, backup, export, or cached file is separately encrypted.

12. Access Controls

We aim to restrict access to information handled by PP Expense to people, systems, and service providers that require access for legitimate operational purposes.

Access may be necessary for purposes such as:

• Providing support;
• Maintaining the service;
• Processing subscriptions;
• Resolving technical problems;
• Preventing fraud or abuse;
• Maintaining security; or
• Complying with legal obligations.

Access is intended to be limited to what is reasonably necessary for the applicable purpose.

13. Third-Party Service Security

PP Expense may rely on third-party infrastructure and services, including:

• Google;
• Google Sign-In;
• Google Drive;
• Google AdMob;
• Razorpay;
• Hosting providers;
• Security services;
• Analytics/diagnostics providers; and
• Other infrastructure providers.

These providers maintain their own security practices and controls.

We select and use third-party services based on the requirements of the relevant functionality, but we cannot guarantee the security practices, availability, or infrastructure of an independent third-party provider.

14. Payment Security

PP Expense may use Razorpay for subscription payment processing.

Payment credentials such as card information, CVV, UPI PIN, or banking authentication credentials should not be provided to PP Expense through ordinary support channels.

Payment processing is performed through the applicable payment infrastructure.

Users should never send payment credentials to us by:

• Email;
• Support tickets;
• Chat;
• Screenshots;
• Social media; or
• Other communication channels.

If someone claiming to represent PP Expense requests such information, do not provide it.

15. Advertising Security

The free version of PP Expense may display advertisements through services such as Google AdMob.

Advertising services may process certain technical, device, advertising, and interaction information according to their own policies and applicable settings.

We do not intentionally provide your PP Expense financial transaction records to advertisers for advertising purposes.

Advertising-related processing is described further in our Privacy Policy.

16. Analytics and Diagnostics

PP Expense may provide an Analytics & Diagnostics setting.

Where this functionality is enabled and the configured service transmits diagnostic information, such information may include limited technical information such as:

• App version;
• Android/device information;
• Crash information;
• Performance information;
• Technical events; and
• Other diagnostic information necessary to identify and resolve problems.

We do not intend for ordinary financial transaction records to be included in analytics or diagnostic information.

The exact information transmitted depends on the services and configuration implemented in the applicable version of PP Expense.

17. Google User Data Protection

Google account and Google Drive information is used to provide the functionality for which you authorize access.

We do not intend to use Google user data obtained through Google Sign-In or Google Drive for unrelated advertising purposes.

We do not sell Google user data.

We do not intentionally use Google Drive content or Google account data to build advertising profiles.

Google user data is handled according to applicable Google API requirements and our Privacy Policy.

18. Data Minimization

We aim to collect, access, and process only information reasonably necessary to provide the relevant feature or service.

For example:

• Core offline expense tracking does not require mandatory online account access;
• Google Sign-In is used for account-related functionality;
• Google Drive access is used for backup and restore functionality;
• Payment information is processed through the applicable payment provider; and
• Advertising/diagnostic information is handled according to the applicable advertising or diagnostics functionality.

19. Security Monitoring

We may use reasonable technical and organizational measures to identify and respond to:

• Security issues;
• Unauthorized access attempts;
• Abuse;
• Fraud;
• Application vulnerabilities;
• Service disruptions; and
• Other security-related events.

Security measures may evolve as PP Expense and the underlying technology change.

20. Vulnerability Reporting

If you believe you have discovered a security vulnerability affecting PP Expense, we encourage responsible disclosure.

Please contact:

[email protected]

Subject:

Security Vulnerability Report – PP Expense

Please provide:

• A clear description of the vulnerability;
• Steps required to reproduce the issue;
• Affected App version, where known;
• Device/Android version, where relevant;
• Potential security impact; and
• Any supporting technical information that can help us investigate.

Please do not include:

• Passwords;
• OTPs;
• UPI PINs;
• Card numbers;
• CVV;
• Private encryption keys; or
• Other unnecessary sensitive information.

21. Responsible Disclosure

If you discover a potential vulnerability, please allow us a reasonable opportunity to investigate and address it before publicly disclosing technical details.

We appreciate responsible security research that:

• Avoids accessing information belonging to other users;
• Avoids intentionally disrupting services;
• Avoids deleting or modifying other users' data;
• Avoids social engineering of employees or users;
• Avoids excessive automated requests; and
• Avoids actions that could cause harm.

We may review security reports on a case-by-case basis.

Unless expressly authorized in writing, nothing in this policy grants permission to conduct penetration testing or security testing against our infrastructure.

22. Security Incidents

If we become aware of a security incident affecting information under our control, we will assess the incident and take reasonable steps appropriate to the circumstances.

Where notification is required by applicable law, we will provide notifications to the relevant users, authorities, or other parties as required.

Our response may include:

1. Investigating the incident;
2. Containing the issue;
3. Taking corrective measures;
4. Assessing affected information;
5. Working with relevant service providers;
6. Implementing additional safeguards; and
7. Providing legally required notifications.

23. No Absolute Security Guarantee

Although we take security seriously and implement reasonable safeguards, no application, database, device, cloud service, network, or electronic transmission system can be guaranteed to be completely secure.

Accordingly, we cannot guarantee that PP Expense will be completely immune from:

• Hacking;
• Malware;
• Unauthorized access;
• Data loss;
• Device compromise;
• Service vulnerabilities;
• Network attacks;
• Third-party security incidents; or
• Other unforeseen security threats.

24. User Security Responsibilities

Security is a shared responsibility.

You are responsible for:

• Securing your device;
• Maintaining your Google Account security;
• Protecting your account credentials;
• Using App Lock where appropriate;
• Maintaining secure backups;
• Protecting exported files;
• Installing updates;
• Avoiding malicious applications;
• Avoiding suspicious links;
• Keeping payment credentials private; and
• Reporting suspected security issues promptly.

We are not responsible for security problems caused solely by your failure to maintain reasonable security of your own devices or accounts.

25. Lost or Stolen Devices

If your device is lost or stolen, someone with access to the unlocked device may potentially access information stored locally in PP Expense.

We strongly recommend:

• Using a secure device lock;
• Enabling App Lock where available;
• Using Android's device-location/security features;
• Remotely securing or wiping the device where appropriate; and
• Protecting your Google Account.

PP Expense cannot remotely secure or erase every copy of locally stored information solely because a device is lost or stolen.

26. Rooted, Modified, or Compromised Devices

Security protections may be weakened on devices that are:

• Rooted;
• Bootloader-unlocked;
• Running modified firmware;
• Running unofficial Android builds;
• Infected with malware; or
• Otherwise altered from standard security configurations.

We cannot guarantee the security of PP Expense data on compromised devices.

27. Data Deletion and Security

When eligible information is deleted from systems under our control, we take reasonable steps to remove it according to our applicable data-management procedures.

Information may temporarily remain in:

• Backups;
• Disaster-recovery systems;
• Security logs;
• Technical archives; or
• Other systems where immediate deletion is not technically feasible.

Such information will be handled according to applicable retention and security practices.

For more information, see:

Data Deletion Policy:
https://expense.ppapps.in/legal/data-deletion

Account Deletion Policy:
https://expense.ppapps.in/legal/account-deletion

28. Security of Backups and Exports

A major security risk can arise after information leaves the App.

If you export or back up financial information, you are responsible for protecting those copies.

Examples include:

• JSON backups;
• CSV exports;
• Screenshots;
• Downloaded files;
• Google Drive backups;
• Email attachments;
• Cloud-storage copies; and
• Files transferred to another device.

Do not share such files with untrusted individuals or services.

29. Security Updates

We may release updates intended to:

• Fix security vulnerabilities;
• Improve application security;
• Update dependencies;
• Improve authentication;
• Address bugs;
• Improve compatibility; or
• Strengthen existing safeguards.

We recommend keeping PP Expense updated through trusted distribution channels.

30. Third-Party Security Changes

The security and functionality of PP Expense may depend partly on third-party services.

If a third-party provider changes:

• Its APIs;
• Security mechanisms;
• Authentication methods;
• Infrastructure;
• Availability;
• Terms; or
• Other technical requirements,

we may need to modify or temporarily disable related PP Expense functionality.

31. Privacy and Security Are Related but Different

Security measures protect information against unauthorized access, loss, misuse, or compromise.

Privacy governs how information is collected, used, disclosed, stored, and deleted.

For information about how PP Expense processes personal information, please see:

Privacy Policy:
https://expense.ppapps.in/privacy-policy

32. Children's Security

PP Expense is not designed to knowingly collect personal information from children in violation of applicable law.

If a parent or legal guardian believes that information has been collected or handled improperly, they may contact:

[email protected]

We will review the matter and take appropriate action as required by applicable law.

33. Changes to This Security Policy

We may update this Security Policy when:

• Our security practices change;
• New security features are introduced;
• Third-party services change;
• Our technical architecture changes;
• New risks are identified;
• Applicable laws or standards change; or
• Operational requirements change.

The latest version will be published on this page with an updated “Last Updated” date.

34. Contact Us

For security questions, concerns, or vulnerability reports:

Publicity Poster
PP Expense
Email: [email protected]
Website: https://expense.ppapps.in/

Security Vulnerability Report

Subject: Security Vulnerability Report – PP Expense

Please provide enough technical information for us to investigate the issue while avoiding unnecessary personal or confidential information.

35. Security Summary

PP Expense follows a security approach centered around local-first data storage, limited online data transmission, controlled access, secure network communication where applicable, optional App Lock, and responsible use of third-party services.

We aim to:

• Keep core financial records local by default;
• Minimize unnecessary data transmission;
• Use secure network communication where applicable;
• Protect account-related access;
• Limit access to information where reasonably possible;
• Use reputable third-party infrastructure for required services;
• Provide security updates when appropriate;
• Support responsible vulnerability reporting; and
• Handle eligible deletion requests securely.

You should:

• Protect your device;
• Use a strong screen lock;
• Enable App Lock where appropriate;
• Protect your Google Account;
• Keep PP Expense and Android updated;
• Secure your backups and exports;
• Avoid rooted or compromised devices;
• Never share payment credentials; and
• Report suspected security vulnerabilities promptly.

No security system is completely immune from risk. By using PP Expense, you acknowledge that security involves both the safeguards provided by Publicity Poster and the security practices maintained by you, your device, and third-party services you choose to use.