Privacy policy

In short

• Quilleaf is a money ledger that lives on your device. We run no server that receives your ledger, your bank SMS or your backups. There is no Quilleaf account.
• Bank SMS are read on your phone, only to add your transactions, and never leave it. They are not uploaded, shared, sold or used for advertising.
• The Android app goes online for only two things: backups to your own Google Drive, if you turn that on, and asking Google Play whether an update is available.
• Drive backups are encrypted on your phone if you set a backup password. Without one, they are readable files in your Drive, and the app tells you so.
• No ads. No analytics. No crash reporting. No tracking. Nothing is sold or shared.
• Our website and web app are delivered through Cloudflare. Our own server keeps no access logs and sets no cookies.
• You can delete everything at any time. Here’s how.

Who we are and what this covers

Quilleaf was earlier called Passbook. It is made by an independent developer in India, who is responsible for the app, the web app, this website and this policy. “Quilleaf”, “we” and “us” mean that developer. You can reach us at support@quilleaf.com, which is also the address for privacy questions and complaints.

This policy covers:

• the Quilleaf Android app, both its standard edition and its SMS edition (package name app.passbook, which comes from the earlier name),
• the Quilleaf web app at app.quilleaf.com, and
• this website, quilleaf.com.

You may still see the name Passbook inside the app, in file names and in your Google Drive. It’s the same product, and this policy applies to it.

What we collect

Nothing that tells us about you or your money. Quilleaf has no sign-up and no server of ours that your data goes to. We can’t see your ledger, your bank SMS or your backups, and we don’t have copies of them.

Only two other parties ever handle anything:

• Google, when you use Google features: Drive backup and the Google sign-in that connects it, and Google Play’s update check. Details below.
• Cloudflare, which delivers quilleaf.com and app.quilleaf.com to your browser. Details below.

What the Android app keeps on your phone

Everything below is in the app’s private storage on your phone. Other apps can’t read it.

Settings → Privacy in the app shows what is stored and how big it is.

Bank SMS

This section explains exactly what SMS data Quilleaf accesses, why, and what happens to it.

Why Quilleaf reads SMS

Filling in your ledger from bank SMS is Quilleaf’s main feature. When a bank, card or wallet SMS tells you money came in or went out, Quilleaf adds that entry to the right account for you. It also turns bill, EMI and auto-debit notices into reminders.

SMS reading is off until you turn it on. It is used for nothing else.

Standard edition: Notification access

The standard edition has no SMS permission. It reads new bank SMS from the notification your messages app shows, once you turn on Quilleaf’s Notification access in Android settings.

• Android sends a notification-access app the notifications of every app. Quilleaf ignores all of them except notifications from SMS apps: your default SMS app, and common messaging apps such as Google Messages, Samsung Messages, Truecaller and Microsoft SMS Organizer.
• From those, it reads the sender and the text of each message.
• Messages from your saved contacts and from phone numbers are skipped. Quilleaf tells contacts apart by how your messages app labels the sender. It never opens your contacts list itself.
• It can’t read older messages in your inbox, or messages whose notification never appeared.
• When you turn SMS reading off in Quilleaf, it stops receiving notifications. You can also take Notification access away in Android settings at any time.

SMS edition: SMS permission

The SMS edition asks for two Android permissions, Receive SMS and Read SMS, after a screen that explains what they’re for and only once you agree.

• Receive SMS lets Quilleaf read each new SMS as it arrives.
• Read SMS lets it read the SMS inbox on your phone. It reads the sender, text and time of inbox messages: to catch up on messages that came while the app wasn’t running (each time you open it), and to import past messages when you ask for it (from the day you turn it on, or the last 3 months, a year, or everything).
• Quilleaf never sends SMS, and doesn’t read your sent messages.

What happens to each message (both editions)

Every message is processed only on your phone.

• OTPs, messages from people (phone numbers and contacts), offers and promotions, failed transactions and everything else that isn’t a bank transaction are skipped. Nothing of them is stored.
• Transaction alerts and balance alerts from banks, card issuers and wallets are stored in a separate private database on your phone. Each record has the sender ID (like “AX-HDFCBK”), the text, when it arrived, and what Quilleaf read from it: the amount and currency, money in or out, the date, the account’s last digits, the bank, the merchant or payee, the balance or available credit limit it states, the bank’s reference number, which account and entry it went to, and a fingerprint of the text (a short SHA-256 hash) used to spot the same message twice.
• Bill, EMI and auto-debit notices become reminders with the payee, amount and due date, and a short note such as the minimum due. The notice itself isn’t stored.
• Text you share or paste into Quilleaf is read the same way. Text shared from another app is never added on its own: it waits for you to check it.

How long SMS text is kept

• The text of a bank SMS is deleted once the message is 90 days old. You can change this to 30 days, 1 year or forever in Settings → Privacy. The app applies this when you open it and once a day.
• Messages waiting for your review keep their text until you add or ignore them.
• After the text is deleted, only what was read from the message stays (as listed above, without the text), so the same message is never added twice.
• Deleted text is overwritten by SQLite in the database file, not just marked as free.
• You can delete the text of every message right away (Settings → Privacy → Delete message text now), or every SMS record and the activity log (Delete all SMS data). Turning SMS reading off also offers to delete them.

Where SMS data never goes

Bank SMS records are never uploaded, shared, sold, or used for advertising. They are never part of Google Drive backups, Android’s own backup, exported .db files or the web app.

The entries and reminders made from them are part of your ledger, just like entries you type in. So they are in your backups and exports, along with the rest of your ledger.

They leave your phone only in files you export yourself. Export everything includes them only if you tick “Include bank SMS text”. The SMS activity log export always lists what Quilleaf read from each message, such as the sender, amounts, balances and the bank’s reference numbers, and has the message text only if you tick “Include the message text”. What you do with those files is up to you.

Android permissions

Quilleaf does not ask for your location, contacts, camera, microphone, phone calls, files or advertising ID.

When Quilleaf goes online

Android app

1. Google Drive backup, if you turn it on. The app sends to Google Drive (googleapis.com):
   • the backup file: your ledger database, encrypted if you’ve set a backup password;
   • its name, with the date (for example “passbook-2026-10-10.db.enc”);
   • labels on the file: the date, the random install ID, and your phone’s model name (for example “Pixel 8”), so backups from different phones are kept apart.

   It also asks Drive for your Google account’s email address, to show which account is connected. It lists, downloads and deletes only the backup files it created. When you turn Drive off with “Also delete” ticked, or erase all data with Drive ticked, it deletes those files and asks Google to remove Quilleaf’s access to your account (oauth2.googleapis.com).

2. Google sign-in, to connect Drive. This goes through Google Play services on your phone. Quilleaf asks only for the drive.file permission, which lets it see the files it creates and nothing else in your Drive. Google handles the sign-in. Quilleaf never sees your Google password.
3. Google Play update check. Each time you open the app or come back to it, it asks the Google Play Store app on your phone whether a newer version is available. Nothing from your ledger is part of this. If you installed Quilleaf from our website, Google Play reports that there’s no update.

That’s all. The app contacts no other server.

Google’s own privacy policy applies to your Google account, your Drive and Google Play.

Web app

app.quilleaf.com loads from our server through Cloudflare. After that, your data stays in your browser and is never sent to us.

The web app’s code includes Google sign-in and a Google Drive backup, but they are not switched on at app.quilleaf.com, so the web app contacts no Google service. If we switch them on, we’ll update this policy before we do.

Google Drive backup (Android)

• Off until you connect it in Settings → Backups.
• Backups go to a folder called “Passbook backups” (from Quilleaf’s earlier name) in your own Google Drive.
• The app keeps your phone’s 10 most recent daily backups there and deletes older ones. It uploads when you leave the app and once a day, whenever your data has changed.
• Without a backup password, Drive backups are not encrypted. Google, and anyone who gets into your Google account, could read them. The app warns you when you connect Drive and labels these backups “Not encrypted”.
• Bank SMS records are never in them.
• Backups stay in your Drive after you uninstall the app, until you delete them.

Backup password and encryption

• When you set a backup password, Google Drive backups and exported backup files are encrypted on your phone before they leave it, using AES-256-GCM.
• The key is made from your password with PBKDF2-HMAC-SHA256, 310,000 iterations and a random 16-byte salt. Every file gets a fresh random 12-byte nonce.
• Your password must have at least 8 characters. It is never sent anywhere and never stored. So that automatic backups don’t need it each time, the key made from it is kept on your phone, itself encrypted with a key held in the Android Keystore. That Keystore key can’t be copied to another phone, so on a new phone you type the password again.
• If you forget the password, nobody can open those backups, including us.
• While a password is set, the app never uploads an unencrypted backup. If it can’t use the saved key, it pauses Drive backups until you type the password again.
• The daily copies on your phone are not encrypted by Quilleaf. They sit in the app’s private storage.

Exports and files you make

Exports are files you save yourself, wherever you choose. Anyone who gets an unencrypted export can read it.

• Export .db (Android): your ledger database. Encrypted when a backup password is set.
• Export everything (Android, Settings → Privacy): a .zip with every table as CSV and JSON, plus the database. Bank SMS records are in it only if you tick “Include bank SMS text”. With a backup password set, it’s encrypted unless you untick “Lock it with my backup password”. Without a password, it isn’t encrypted.
• SMS activity log (Android): a CSV that is never encrypted. It always lists what was read from each message (sender, amounts, balances, reference numbers). Message text is left out unless you tick “Include the message text”.
• Web app: “Export .db” and “Export everything” are not encrypted. “Export encrypted” uses a password you type.
• Hide amounts doesn’t apply to exports. They always have the real figures.

Android’s own backup

Android has its own backup system, separate from Quilleaf’s backups.

• Backup to your Google account: off. You can turn it on in Settings → Privacy. Even then, Quilleaf’s data goes only when Android encrypts that backup end to end with your screen lock (Android 9 or newer).
• Phone-to-phone transfer: on. When you set up a new phone from this one, with a cable or over Wi-Fi, your ledger and settings come along (Android 9 or newer). You can turn this off in Settings → Privacy. The copied settings include your connected Drive account’s email address and the encrypted backup key, which the new phone can’t use.
• On Android 8, neither includes your ledger.
• Bank SMS records, Quilleaf’s own daily copies and the random install ID are never included.
• Versions of the app before 0.14.0 were part of the Google account backup. A copy made then can stay in your Google account until that device backup is deleted. Here’s how.

Notifications, app lock and the screen

• Notifications. When your phone is set to hide sensitive notification content on the lock screen, Quilleaf’s notifications show there as a private version with no amount, merchant or account, such as “New bank message read” or “Bills due soon”. With Hide amounts on, amounts are left out of notifications altogether.
• App lock. App lock uses Android’s own fingerprint, face or screen-lock prompt. Quilleaf never sees or stores your fingerprint, face or PIN. By default it locks again after a minute in the background.
• Secure screen. This keeps Quilleaf out of screenshots, screen recordings and the Recents preview. It’s on while app lock is on, unless you change it in Settings → Privacy.

The web app (app.quilleaf.com)

• Your ledger is a database file in your browser’s storage (IndexedDB), on that device only.
• A few preferences sit in the browser’s local storage: your currency, Hide amounts, the account you used last, whether you’ve seen the tour, and that you’re using it without signing in.
• When you import a file, the data it replaced is kept in the browser so you can undo the import. It stays until you import again, undo it, delete that copy, or erase everything.
• Excel and .db files you import are read inside your browser. They are not uploaded.
• The web app sets no cookies.
• Settings → Privacy in the web app shows what is stored. Settings → Erase everything deletes it.

This website

• quilleaf.com is a set of plain pages. Everything on them, fonts included, loads from quilleaf.com itself. There are no third-party scripts, fonts, analytics, embeds or trackers, and we set no cookies.
• Cloudflare. quilleaf.com and app.quilleaf.com are delivered through Cloudflare. Cloudflare decrypts and re-encrypts each connection on its way to you, so it can see the requests and the pages themselves (never your ledger, which isn’t sent). To deliver and protect the sites, it processes each visitor’s IP address and request details, such as the page asked for, the time and the browser. It may set strictly necessary security cookies, and it may ask your browser to report failed connections to the sites back to Cloudflare (Network Error Logging). Cloudflare’s privacy policy applies to that processing.
• Our server keeps no access logs. We keep no record of who visits or what they download.
• Email. If you write to us, we get your email address and what you write. We use it only to reply. Mail to support@quilleaf.com is carried by Cloudflare Email Routing to a Gmail mailbox, so Cloudflare and Google handle it under their own privacy policies.

No ads, no analytics, no selling, no sharing

• Quilleaf contains no advertising, analytics, crash-reporting or tracking code, and builds no profile of you.
• We don’t sell, rent, trade or share your data. We don’t have it to begin with.
• The only outside services involved are Google, for the Google features you choose to use, and Cloudflare, for delivering our sites.

Security

• Your data stays in the app’s private storage, or in your browser’s storage for the web app.
• Deleted SMS text, and deleted data in the web app, is overwritten by SQLite in the database file, not just marked as free.
• Backups and exports can be encrypted with your backup password, as described above. Connections to Google Drive use HTTPS.
• App lock and the secure screen keep prying eyes out.

No system is perfect. Keep your phone’s screen lock on, keep Android up to date, and set a backup password if you use Google Drive.

How long things are kept

Deleting your data

Android app

• Everything: Settings → Privacy → Erase all data, then type DELETE. This deletes your ledger, bank SMS records, the daily copies, your settings and the backup key, and the app starts fresh. If Google Drive is connected, you can also tick the box to delete Quilleaf’s backups in your Drive and remove its access to your Google account.
• Bank SMS only: Settings → Privacy → Delete message text now, or Delete all SMS data. Entries already in your ledger stay.
• Uninstalling the app deletes everything it stored on your phone.

Google Drive

• In the app: Settings → Backups → Turn off, with “Also delete Passbook’s backups from my Drive” ticked.
• Or in Google Drive: delete the “Passbook backups” folder. You can remove Quilleaf’s access from your Google Account’s list of third-party apps with account access.

Android’s backup in your Google account

If you turned it on, or an older version of the app was backed up there, delete this phone’s backup in Google One → Storage → Backups, or at drive.google.com → Storage → Backups. Note that this removes your other apps’ backup from that phone too.

Web app

Settings → Erase everything deletes everything Quilleaf keeps in that browser. Clearing the site’s data in your browser does the same.

Files you exported

These are yours. They stay until you delete them.

Your choices

Your data is in your hands, not ours. You can see all of it in the app, export all of it, correct anything by editing it, and delete any or all of it, as described above. Every optional feature, SMS reading, Google Drive backup and Android’s backups among them, can be turned off at any time.

Questions, requests or complaints about privacy: write to support@quilleaf.com.

Children

Quilleaf is meant for adults managing their own money. It isn’t directed at children, and we don’t knowingly collect data from children, or from anyone else.

Changes to this policy

When this policy changes, we’ll publish the new version on this page with a new effective date. If Quilleaf is ever going to send data anywhere it doesn’t today, this page will say so before that version is released.

Contact

Email support@quilleaf.com with any question about this policy or your data.