Privacy Policy – Vauban app
Last updated: October 2026
This policy describes how the Vauban Android application (“the App”) handles your data. Vauban is built local-first: your financial data stays on your phone.
1. Developer and contact
The App is developed and maintained by Vablab. For any privacy question: contact@vablab.dev.
2. Local data and encryption
Budgets, transactions, merchants and their aliases, categories, notification content and settings are stored exclusively on your device. No server keeps your personal or financial data.
The local database is encrypted with SQLCipher; its secret is protected by Android Keystore. Anonymous counters of Pro offer views are also kept locally and are never transmitted.
Nothing leaves the device unless you export a backup, a CSV file or a diagnostic report yourself.
3. Sensitive permissions
- Notification access: detects payment confirmations from the banking apps you selected and extracts the amount. Notification content is never transmitted.
- Usage access: detects when Wallet or a risky shopping app comes to the foreground, to show a budget reminder. Your usage history is never shared.
- Display over other apps: shows that budget reminder, clearly identified and dismissible.
- Camera: used only, at your request, to read the QR codes of the Vauban Guard browser extension (Pro feature). Images are analysed on the device, never stored nor sent. The key linking the extension to the App stays on the device, protected by Android Keystore; no network is used between the browser and the phone.
4. Detection log and diagnostic reports
The “Help improve detection” option is off by default. When on, it keeps on the device an anonymised trace of misread notifications: only banking vocabulary is kept, amounts become # and merchants or names ▢. “Report a detection error” adds the anonymised wording of a transaction to this log.
This is only transmitted if you share a diagnostic report yourself (Settings › Export Diagnostics), to the recipient of your choice. That report, which you can read before sending, also contains the device model, Android version, technical logs and crash reports of the App.
5. Google Play purchases
No account is required. Payments are processed by Google Play: Vablab never sees your payment methods.
When you buy or restore Pro, the App sends Vauban’s billing service the package name, a random installation identifier, the product identifier, the purchase token and a Play Integrity proof. This service, hosted on Google Cloud in Europe, verifies them with Google Play, which then notifies it of renewals, cancellations and refunds. It keeps only a hash of the purchase token, its status and expiry, which you can erase at any time (see section 7).
It never receives your budgets, transactions, merchants, notification content, app list, name or email address.
6. Third-party sharing
We do not sell, rent or share any data. The App contains no advertising SDK and no analytics or tracking tool.
7. Retention and deletion
Your data stays on your phone as long as the App is installed. You can export it, or erase it with “Delete All Data” in Settings; uninstalling the App also deletes it.
To erase the purchase data kept by the billing service (purchase token hash, status, expiry and installation identifier): open the App, go to Settings, tap “Delete purchase data on the server” and confirm. Deletion is immediate and permanent. Your data on the phone and your Google Play purchases are not affected; the App then stops verifying your purchases on its own until you tap “Restore Purchases”.
Subscription cancellation and payment history are managed in Google Play.