Overview
Tang La ("the app", "we", "our") is a personal budgeting and loan-tracking app for Android, developed by an independent developer (Meow Meow Studio). This policy applies to everyone who installs the app from Google Play.
The short version: Tang La is built around a local, on-device database. There is no Tang La account, no Tang La server, and no Tang La backend that your transactions, balances, or notification content ever gets sent to. Every feature below that reaches the internet is optional, off by default or requires you to explicitly turn it on, and is described here in full.
Your Data Stays On Your Phone
Everything you enter or the app records — accounts, transactions, budgets, categories, tags, recurring rules, loan details, notification history, savings goals, investments you track, the names and debts of friends you track, your PromptPay ID — is stored in a local database file inside the app's private storage on your device. It is never uploaded anywhere unless you explicitly use one of the optional features described in sections 4–6.
If you attach a receipt photo to a transaction (using your camera or picking an existing photo), the image is copied into the app's private storage on your device and referenced by that transaction. Receipt photos never leave your device — they are not uploaded and are not included in the manual backup files described in section 5.
If you share a summary or savings-goal progress image, it is made on your device and handed to the app you pick through your phone's share sheet. We never receive it, and you can hide the amounts on it before sharing.
Uninstalling the app deletes this database along with everything in it, unless you've made a backup first (see sections 4 and 5).
Notification Access
Tang La can automatically log a transaction when a notification from your bank or e-wallet app appears on your phone — for example, "Payment successful, ฿150.00" — so you don't have to type it in by hand. Tang La reads only the text of that notification: it doesn't connect to your bank account and can't access your bank app's data or inner workings. This requires Android's Notification Listener permission, one of the more sensitive permissions an app can request, so we want to be precise about what it does.
You choose which apps to listen to. Notification access is off for every app until you explicitly select it in Settings → Notifications. Nothing is read from apps you haven't selected.
One switch turns the whole thing off. Settings → Notifications has a single toggle for automatic capture. Turning it off stops all notification reading, removes the persistent "listening" notification, and clears the on-device holding area described below — you don't have to go into Android's own system settings to do it.
Everything is processed on your device. The text of a selected app's notification is matched against patterns you configure (or the app suggests), entirely on-device, to pull out an amount, a category, and an account. The result becomes a normal transaction in your local database — the same as if you'd typed it in yourself.
Notification text is never uploaded. It is not sent to us, to the notification's own app, or to any third party. It's kept in your local notification history purely so you can review or correct how a transaction was created — you can delete this history at any time from within the app.
Nothing is lost if the app isn't running. Because a notification only arrives once, a notification from a selected app that looks like it's about money is written to a small holding area on your device the moment it's posted — even if Tang La has been closed or stopped by the system. Each entry there is processed and then deleted; it is stored only on your device and never uploaded.
Non-money notifications are filtered out before anything is stored: an app is only listened to if you selected it, and a notification is only kept if it looks like it's about money and isn't excluded by your own filter words.
To show you the list of apps to choose from in that settings screen, Tang La can see which of your installed apps have a launcher icon — it doesn't read any data from those apps.
Optional Google Drive Backup (Premium)
Google Drive backup is a Premium feature — until you unlock Premium in the app it stays off, and nothing is sent to Google Drive.
If you turn this on (Settings → Backup), Tang La can save an encrypted copy of your database to a folder in your own Google Drive, either on demand or automatically on a schedule you set. This is entirely opt-in and off by default.
Signing in uses Google's standard OAuth sign-in flow. To exchange the sign-in code for an access token without embedding a secret key inside the app itself, this step passes through a small relay server we operate (a Cloudflare Worker acting purely as an OAuth relay). During sign-in, and again whenever the app refreshes its access, that relay handles your sign-in tokens and the email address of your Google account. It passes them straight through and doesn't keep them beyond the few moments the sign-in takes — it never sees your backup file, your transactions, or any financial data. Once authorized, your backup file is uploaded directly from your device to the Google Drive API, straight into a folder in your own Drive account, using Google's own servers.
While you use Google Drive backup, the app also asks Google — through Firebase App Check — to confirm that a request to our relay really comes from the genuine Tang La app, so the relay can't be used by other software. This sends Google a short confirmation from Google Play (on Android) or Apple (on iOS) together with basic details about your device: its model, brand and operating system version. It happens only while you use Drive backup, never otherwise, and it carries none of your financial data. Google handles it under its own privacy policy (see section 13).
You can disconnect Google Drive at any time from the same settings screen, which stops future backups and revokes the app's access. Files already uploaded to your Drive are yours — deleting or managing them is done through Google Drive itself, the same as any other file you own there.
Manual Backup Files
You can export your data to a file at any time, independent of Google Drive. Export files are encrypted before being written to your device — but not with a password only you know, so a forgotten password can never lock you out of your own backup. That's enough to keep a file from being read at a glance if it ends up somewhere unexpected, not a vault — keep your export files somewhere you trust. Where a file goes after you export it — a cloud drive, a messaging app, a USB cable — is entirely up to you; we have no visibility into it.
Optional Local API Server
Tang La includes an optional local server (Settings → External Connection, off by default) that lets a tool you control — a script on the same device or Wi-Fi network, or the companion web manager below — sign in with a username and password you set, then create, edit, view and delete transactions and manage your categories, accounts, tags, budgets and recurring items, and update the prices of the stocks or funds you hold, without opening the app. You choose whether it's reachable only from this device or from other devices on your own local network. When you allow other devices, the app also announces its address on your local network so those devices can reach it by a fixed name instead of a numeric address; that announcement stays on your network and carries nothing personal. The username and password are stored only on your device — the password never as readable text — and never sent anywhere. Signing in returns a short-lived session token used only for that session and only between your tool/browser and your own device. It never phones out to the internet on its own; it only answers requests you or your own tools send to it.
The connection is encrypted with a TLS certificate the app generates on your own device (self-signed) — a browser or tool connecting to it for the first time will see a warning that the certificate isn't trusted, which is normal for a self-signed certificate and doesn't indicate a security problem. We publish a companion page on the web for this — the "Tang La web manager" (tangla-manage.meowmeow-studio.com) for the sign-in described above. It runs entirely in your own browser, with no server in between — it connects straight to your own device's server. No data passes through this page or is ever kept by us.
Separately, Tang La can open a pre-filled "add transaction" screen
from a tangla://add link (also off by default,
Settings → External Connection) — for example from a phone
shortcut or an NFC tag. That only ever fills in the form for you
to review and save; it never reads or sends any of your data.
Premium Purchase (In-App Purchase)
Premium is a one-time in-app purchase handled entirely by Google Play (Android) or the Apple App Store (iOS). Tang La never sees or stores your card or other payment details.
The app asks the store whether your store account owns Premium and gets back a single answer: "owns it" or "doesn't." It then remembers that answer on your device so Premium keeps working offline. No server of ours is involved in this, and nothing about your purchase is sent to us. You can use "Restore purchases" in the app to get Premium back on a new device or after reinstalling.
On Android the app also checks with Google Play from time to time at launch that you still own Premium (for example, after a refund). If that check can't complete for any reason (e.g. no internet connection), the app simply keeps things as they were instead of locking features unnecessarily.
Advertising (Free Tier)
The free tier of Tang La shows ads, served through Google AdMob, to help support keeping the app free to use. Once you unlock Premium, the app stops requesting and showing ads.
AdMob may collect and use your device's advertising ID, device and app information (such as device model and OS version), and ad-interaction data (such as impressions and clicks) to serve and measure ads. Depending on your region and consent choices, ads may be personalized (interest-based) or non-personalized.
If you're in the European Economic Area or the United Kingdom, a Google-provided consent form is shown before any ad loads, letting you choose how your data is used; you can reopen and change that choice later. Outside those regions this form isn't shown.
Whatever AdMob collects is entirely separate from your financial data — it never has access to your transactions, balances, or notification history stored in your local database.
Ad-serving is governed by Google's advertising policies. You can manage personalized-ad settings at any time through your device's Google Settings → Ads.
Email Auto-Capture (Premium)
Email auto-capture is a Premium feature — nothing happens until you unlock Premium and connect a mailbox yourself (Settings → Email Auto Capture). It's a second way to log transactions automatically, alongside notification access (section 3).
If you connect a Gmail or Outlook mailbox, Tang La checks it periodically for alert emails from supported banks and logs a transaction from each one. It only asks your email provider for messages from those banks' sender addresses — it doesn't read the rest of your mailbox — and it never changes, moves, or deletes anything in it.
You connect with an App Password that you create with your email provider — never your main account password. The app connects straight from your phone to your provider's mail server over an encrypted connection; no server of ours is in the middle. The App Password is stored securely on your device and is never sent to us or anywhere else. Email content is processed entirely on your device: the text of a matched email is kept in your on-device notification history, the same as a notification's (section 3), and is never uploaded or included in backup files. Phrases you teach the app from an email are likewise kept only on your device.
You can disconnect a mailbox at any time from the same screen, which stops syncing immediately and deletes the stored App Password from your device. You can also revoke the App Password from your email provider's account settings.
App Lock
You can lock the app with a PIN (4 to 8 digits) and, optionally, biometric unlock. Biometric unlock is handled entirely by Android's own authentication system — your fingerprint or face data is never seen, stored, or processed by Tang La; the app only receives a yes/no result. The PIN is stored securely on your device, checked on the device, and never leaves it or is sent anywhere.
Permissions We Ask For
Here's every Android permission Tang La requests, and specifically why:
| Permission | Why |
|---|---|
| Notification access | Reads notifications from apps you select, to log transactions automatically. See section 3. |
| Post notifications | Lets the app show you its own reminders (budget alerts, bills due, savings goals) and the required "running in background" notice. |
| Schedule exact alarms | Lets the app's reminders go off at the exact minute instead of being delayed by the system. Optional: on newer Android it stays off until you switch it on, and without it reminders still work, they just may arrive a little late. |
| See installed apps | Tang La sees the list of apps that have a home-screen icon, to populate the app-picker in Settings where you choose which apps to allow notification access from. It does not request the broader "query all packages" permission and cannot see hidden or system apps. |
| Foreground service | Keeps notification listening and scheduled tasks (recurring bills, backups) running reliably while the app isn't in the foreground. |
| Receive boot completed | Restarts that background service after your phone reboots, so notification capture doesn't silently stop working. |
| Ignore battery optimizations | Lets you optionally exempt the app from aggressive battery management that could otherwise kill notification listening. You can decline this prompt. |
| Internet | Used only by the optional features in sections 4, 6 and 9, by the store when you buy or restore Premium (section 7), and to serve ads on the free tier (section 8). |
| Wi-Fi multicast | Only while the optional local API server (Premium) is set to allow other devices on your network: lets it announce its address so those devices can reach it by a fixed name. See section 6. |
| Advertising ID | Used by Google AdMob, only while the app shows ads (free tier), to show and measure ads. Never linked to your financial data. See section 8. |
| Camera | Only when you choose to take a photo of a receipt to attach to a transaction. The photo is stored on your device and never uploaded. See section 2. |
What We Don't Do
- ✓ No analytics, tracking, or crash-reporting SDKs. The only SDKs that contact Google on their own are AdMob on the free tier (section 8) and, only while you use Drive backup, Firebase App Check (section 4).
- ✓ No account required to use the app.
- ✓ We do not sell, rent, or share your financial data with anyone.
- ✓ No server of ours ever stores your transactions, balances, notification text, or email content.
- ✓ Nothing you enter into the app — transactions, balances, notification text — is ever shared with our ad partner.
Sharing With Third Parties
We don't share your financial data with third parties. The only services Tang La ever communicates with are ones you explicitly choose to use (or, for ads, that support the free tier, or, for Premium, the store that processes your purchase), and only for what's described above:
- Google Drive — Premium only, when you turn on Drive backup (section 4), for storing your own encrypted backup in your own Drive account.
- Our OAuth relay — only for Drive sign-in and keeping that sign-in working. It handles your sign-in tokens and Google account email in passing, without keeping them, and never touches your financial data.
- Google Firebase App Check — Premium only, while you use Drive backup (section 4), to confirm that requests to our relay come from the genuine app. Sends Google a confirmation from Google Play or Apple and basic device details (model, brand, operating system version); never any financial data.
- Your email provider (Gmail or Outlook) — Premium only, when you connect a mailbox for email auto-capture (section 9). The app talks to it directly, the same as any email app would.
- Google Play / Apple App Store — to process your Premium purchase and tell the app whether you own it. Handled by the store under its own terms; never touches your financial data, and we never receive your payment details. See section 7.
- Google AdMob — free tier only, to serve and measure ads. See section 8 for exactly what it collects.
Google's own use of data from its services (Drive, AdMob, Firebase) is governed by Google's Privacy Policy, not this one.
Keeping & Deleting Your Data
Your data lives on your device for as long as you keep the app installed. You're always in control of it:
- Delete individual transactions, accounts, or your notification history any time from within the app. Notification history is also cleared automatically after a while, sooner for notifications that already became a transaction.
- Disconnecting an email mailbox (section 9) stops syncing and removes its stored App Password from your device.
- Uninstalling the app permanently deletes its local database.
- Disconnecting Google Drive (section 4) stops future backups; existing backup files in your Drive are managed and deleted through Google Drive itself.
Children's Privacy
Tang La is a personal finance tool intended for general audiences and is not directed at children. We do not knowingly collect data from children, and given the app collects no data on our servers in the first place, there is no server-side data to hold or delete. Ads (section 8) are served under Google's standard, non-child-directed treatment.
Changes to This Policy
If this policy changes, we'll update the "Last updated" date at the top of this page. Meaningful changes — anything that changes what data the app accesses or how it's used — will also be noted in the app's own update notes on Google Play.
Contact Us
Questions about this policy or how Tang La handles your data are welcome any time.