Pendi

Privacy policy

This policy covers the Pendi Android application. It is written to match what the app actually does; every claim below is grounded in the shipped behavior.

Version 2. Effective date: October 9, 2026. Last updated: October 9, 2026. Data controller: Elkin Eduardo Cardoso Leyton, independent developer, Colombia. Address: Carrera 4c Bis #39-24, Ibagué, Tolima, 730006, Colombia. Phone: +573134681880. Contact: [email protected].

The short version

Your data lives on your device and the app works without you signing in. Sharing a space with your family syncs that space's content through Google Firebase, and you can separately turn on a backup of your Personal space, which uploads it to the same place. Neither happens unless you ask for it. Bank notifications are read on your device, and nothing is read at all until you grant notification access; once you do, the app your phone uses for SMS and the messaging and mail apps named in the app's own list start active as channels and pass on only what carries an amount and a money word, the bank and wallet apps found installed from a recognised store start active under that same rule until one tap widens them, and an app identified only by what it can do rather than by name, or installed from somewhere other than a recognised store, stays listed and off until you switch it on; every source can be switched off, one by one or all at once. The AI assistant is offered during setup and is active once you accept it there, after which a reduced fragment of a captured notification can leave the phone without you tapping anything each time; personal and sensitive data never leaves the phone, only minimized masked fragments do, and you can turn the assistant off at any time. Nothing is sold, there are no ads, and no advertising identifiers are collected.

Who is responsible for your data

Pendi is developed and published by Elkin Eduardo Cardoso Leyton, a natural person working as an independent developer in Ibagué, Colombia. There is no company behind it. He is the data controller for the processing described in this policy, the same one for anyone using Pendi from any country, and he has no offices in other countries. His address is Carrera 4c Bis #39-24, Ibagué, Tolima, 730006, Colombia, and his phone is +573134681880. The route for any question or request about your data is [email protected], the same address shown on Support and on Delete your account.

Pendi is published from Colombia, so Colombian data-protection law applies to your personal data: Ley 1581 de 2012 and Decreto 1377 de 2013. If you live in Brazil, Brazil's data-protection law applies as well, and the section “If you live in Brazil”, below, says what it adds.

What we use your data for, and on what basis

Each use has its reason. The ones that rest on your consent are switched on by you and off whenever you like; the rest are what it takes to give you what you asked for.

None of these uses is for advertising, and we neither sell nor rent data.

Data stored on your device

Tasks, lists, budgets, accounts, movements, categories, people, reminders and settings are stored locally in the app's private storage. Backups are user-initiated, encrypted, and saved where you choose. Uninstalling the app deletes its local data.

Transaction detection (notification access)

If you enable detection, the app reads system notifications from the sources that are active, to recognize payment notifications and turn them into movements you confirm. Which sources start active depends on how the app identifies each one, and on whether you have ever chosen sources yourself. On a phone where you have not, the app your phone uses for SMS and the messaging and mail apps named in the app's own list start active; on a phone where you have, that same change is offered to you as one tap instead of being made for you. Those are CHANNELS: they carry somebody else's message and hold no free pass, so a notification from one of them is only ever processed when it carries both an amount and a money word, and an ordinary text or mail is discarded without being stored. The bank and wallet apps the app finds installed from a recognised store start active as well, held to that same money rule, until one tap widens that row to the rest of its notifications, including the ones with no figure. Any other app the list names, found installed from a recognised store, starts active under the money rule too. An app identified only by what it can do rather than by name, and any app installed from somewhere other than a recognised store, are listed and off until you switch them on, as is the rest of the list. A bank or wallet app the list names and you switch on yourself is read whether or not its notifications look like money, because that is what you asked for by turning it on. Every source can be switched off, one by one or all at once. Reading and interpreting happen on your device, and the full text of the notification never leaves the phone.

Here is what can leave it. Once you accept the assistant during setup, and while it is on, the app sends a reduced fragment of the notification to ask for the category of the expense, and it does so on its own, without you tapping anything, as soon as the capture reaches the inbox. Before that fragment goes out, the phone removes email addresses, masked account or card tails, and any run of four digits or more, so account numbers and card numbers do not leave. What travels is that cleaned text: whole when it is 280 characters or less, and when it is longer, only the piece around the merchant; and on the category question the amount is masked to its shape ($###.###) instead of being sent, because that answer never needed the real figure. Your category names travel with it as the list of options to choose from, ordered from the one you use most, and that ordering is itself information about what you spend on. You can disable any source, or detection entirely, at any time.

Optional account and shared spaces

The app can operate a lightweight anonymous session (no email, no password) to enable its managed AI tier and shared content. If you share a space with family members, the content of that shared space (its tasks, lists, budgets and movements) syncs through Google Firebase (Firestore) so members see the same data. Your Personal space is not uploaded unless you turn on Settings > Account > Back up the Personal space. When you do, its content is uploaded to Firestore under your own account, where only that account can read it, and it stays there until you delete the account. Google's infrastructure processes this data as our provider; we do not sell it or use it for advertising.

AI features

There are two tiers. They are used to suggest the category of an expense, parse what you dictate by voice, and help you create a rule.

Pendi AI (managed). The reduced fragments described above travel to a service of our own hosted on Cloudflare Workers, which passes them to the language model that processes them. Requests carry a daily quota, we do not use them to train models, and they carry no account or card numbers.

Bring your own key (Gemini). If you connect a Gemini API key of your own, the fragment goes straight from your device to Google, under the agreement you hold with Google for that key. We do not receive that fragment, we never see your key in our services, and the key is stored encrypted on the device, protected by the Android keystore. Note that Google's Gemini API terms say that with a key that has no billing, Google may use what you send to improve its products and people on its team may read it, and they ask that no personal data be sent that way. If that matters to you, use a key with billing turned on, after checking Google's terms, or the managed tier.

Who processes the managed tier's fragments

This is the processor the managed tier routes to, with the company and the jurisdiction it operates from. It can process your fragments outside Colombia.

Which processor serves the requests is decided server-side and can change without a new app release, which is why this list, and not the app's screens, is where it is kept current; if a change alters what this policy says, we announce it in the app's changelog first.

Who else receives data, which countries it travels to, and under what safeguard

Besides the assistant's processors, these third parties receive data when you use the feature that needs them, each with the jurisdiction it operates from.

Google, with Firebase, and Cloudflare process it as processors: only on our behalf and on our instructions, under their data-processing terms. Google Play handles your payment under its own terms, as the store you buy from. The United States may protect your data differently from the law of your country; that is why fragments leave minimized, and why the app asks for your authorization before sending them abroad and tells you before uploading a space or your backup to the cloud.

What each law asks before your data leaves the country, and how we meet it: in Colombia, Argentina, Costa Rica, Ecuador, Nicaragua, Panama, the Dominican Republic and Uruguay, your express authorization, on the AI help screen and on the notice for shared spaces and the backup; in Mexico, Google and Cloudflare are processors and there is no transfer; in Peru, and in Paraguay once its law takes effect, what is needed to give you the service you asked for, or your express authorization.

In El Salvador, the law asks that the country receiving your data protect it at least as well as the law does. Your data goes to Google and Cloudflare, United States companies, which process it as processors under their data-processing terms.

What is sent, on each of the three paths

The assistant makes three kinds of request, and what leaves the phone is different on each. Personal and sensitive data never leaves the phone; what travels is minimized and masked. Your family's names are replaced with opaque tokens before any request is built, and email addresses, card tails and any run of four digits or more are stripped.

The weekly summary is not one of them: it is computed on your phone and asks the AI for nothing, so nothing leaves the phone for it.

When it starts, and how to stop it

A fresh install starts on Pendi AI rather than on no assistant at all, so the managed tier is the one selected for you, and the app asks you to authorize the transfer during first-run setup, on a screen that shows what would be sent and states that it can be processed outside Colombia. The assistant is active once you accept it there. If you decline, or leave setup without accepting, nothing is sent: the request stops on the phone, no session is created, and the app keeps working on its own rules. If you are updating from an earlier version of the app, you do not walk that setup screen again, and an answer you gave to an older version of this disclosure does not carry over to a changed one: it reads as no answer at all, the assistant stays silent, and the question is put to you again either when a feature next needs it or from the Settings > AI row you open yourself. Once you accept, the app signs in anonymously to Firebase (no email, no password) so the requests can be attributed to a quota. You can withdraw that authorization, or turn the assistant off, under Settings > AI; with it off detection keeps working with the app's local rules, the rest of the app is fully functional, and the other things this policy describes (sync, backup, push registration) are unaffected because they were never part of the assistant.

Voice dictation

Dictation runs on your device. The audio is handled by Android's own speech recognizer and the app never records it to a file, never stores it and never uploads it. Pendi asks for the offline pack first, and when your phone does not have one for that language the recognizer answers over the network instead, the same way your keyboard's microphone does: the audio goes to your phone's speech provider under their terms, and never to us. Pendi does not receive that audio and has no agreement with that provider: the provider processes it, under the agreement you hold with it on your phone. Under Settings > Voice you can ask Pendi to start with the online recognizer and skip the offline attempt.

Under Settings > Voice there is one switch, “Improve Pendi with my dictations”, and it is off unless you turn it on. With it on, two things happen together. Your dictations are kept on the phone with what the app understood from them, which is what lets a misreading be reproduced and fixed. And the TEXT the recognizer produced, together with the language it was spoken in, is queued and sent to us so the parser can be improved with real phrasing instead of invented examples. Nothing else travels with it: not the audio, not what the app parsed out of the sentence, not where it was saved. The upload waits for a network, so being offline delays it and never loses it, and it is attributed to your account the same way the feedback channel is.

Turning the switch off stops the sharing, deletes the dictations kept on the phone, and discards anything still waiting to be sent. It does not delete what already arrived; write to the contact address above for that. The setting is deliberately left out of backup files, so restoring a backup onto a new phone never turns sharing on for you.

Contacts

Only if you use the contact import feature, and only at the moment you pick a contact, the app reads that entry's name, phone number and photo to create a person in your space. The photo needs the Contacts permission and the app asks for it right there; the name and the phone number are imported without any permission at all. There is no background contacts access and no bulk read of your address book. If you later save that person into a shared space, their name, phone number and any email you typed sync to Firestore with the rest of the space, and the photo stays on your device.

Link previews

When you save a link in a link list, the app tries to show you its preview, and to do that your phone may connect directly, without going through us, to the link's server and to every server the link redirects to. If the link is a YouTube or TikTok link, it also asks that platform for the title and thumbnail (www.youtube.com/oembed and www.tiktok.com/oembed) and downloads the thumbnail from the server the platform names. Those servers see the link's address and your phone's IP address, as when you open a link in a browser, and handle them under their own policies. We receive none of this.

Notification formats you share

After you create a rule for a notification the app did not recognise, the app may offer to share that format so Pendi can learn it. It is optional, never on by default, and before sending it shows you exactly what leaves: the message template, with amounts, names, digits and dates replaced by placeholders, the app it came from and the shape of your rule. It is kept in our service together with your account identifier, to count how many different people shared the same format. If you delete your account, that identifier is replaced by a random one that does not lead to you, and the template stays, because it no longer says anything about you.

Shop details from your receipts

When you read a receipt that prints a company form (such as S.A.S. or LTDA) and a company tax ID that checks out against its check digit, Pendi sends its own service the public details that company printed on it (name, legal name, tax ID, address, city and phone) to build a shared directory of shops; if either is missing, nothing of the shop leaves the phone. It sends nothing of what you bought, no amount and no photo. The app is built never to send a shop that belongs to a person; if a misread of the paper still makes one pass for a company, correcting the shop in the app removes it from Pendi's directory, and no shop in the directory is shared with anyone while a single install of the app has reported it. The report travels with your sign-in, like every AI help request: the service uses it to check the request and notes that a report of yours arrived, without the shop. The shop directory keeps the shop without your account and, so that your report is not counted twice in one week, a one-way mark that changes every week, with every shop and with every place; the week is counted in universal time and the report names the week of its mark; the service keeps the report only when that is the current or the previous week, and that mark is deleted after the week ends: normally within the following eight days, at the latest a few days later if the daily task fails, and the database's backup keeps it up to 30 days more; the shop's record stays. The company's details stay if you delete your account, your data or the app.

The shop's record stays in the directory until a correction from the app deletes it. The weekly contributor mark is deleted after its week.

Crash reporting

Production builds send anonymous crash reports (stack traces, device model, OS version) through Firebase Crashlytics so defects can be fixed. Crash reports contain no financial content and no notification text. Google documents that Crashlytics keeps crash stack traces and the associated identifiers for 90 days, and then starts removing them from live and backup systems. You can read that in Privacy and Security in Firebase.

The Firebase Analytics library travels inside the app because it is the companion piece Crashlytics ships with, but its collection is off in the app's manifest, the advertising-identifier permissions it would otherwise contribute are stripped from the build, and the app logs no analytics events. In other words: no usage metrics and no app-instance identifier are collected. Crashlytics is a separate product and it does work: the crash reports described in the paragraph above are sent.

What we never do

Data deletion

Local data: use Settings > Account > Erase the data on this device, which erases everything the app keeps on that phone in one action and signs you out first so nothing downloads again, or uninstall the app, which does the same. You can also still delete in parts: the captured text under Settings > Movement detection, the sample data, and the contents of the Vault. Shared-space data: a space you own is erased with everything in it when you delete it in the app or delete your account; what you added to someone else's space stays there (see How long we keep your data). Turning the Personal-space backup off stops further uploads but does not remove what is already there; deleting your account does. Anonymous session data and AI quota counters: request deletion by email and include your space identifier from Settings. We answer deletion requests at the contact address above. The complete account deletion steps are on Delete your account.

How long we keep your data

Your rights over your data

You hold these rights from any country where you use Pendi, and the same person handles them through the same route. If you live in Latin America, the legal deadlines and the authority you complain to are your country's, in its section below; from any other country, they are Colombia's. You can:

There is a single route for all of it: write to [email protected] from the address you use with Pendi, or include your space identifier from Settings. Queries, complaints and deletion requests all go there. Exercising a right costs you nothing.

Response time. We answer any request within five business days of receiving it. If a complaint needs more time to be resolved, within those five days we tell you why and by what date, and that date never goes past the maximum your country's law sets.

If you live in Colombia

Ley 1581 de 2012 and Decreto 1377 de 2013 apply. Our five business days are shorter than the law's, and these are the law's maximums: a query (consulta) is answered within ten business days, and if we cannot, we tell you why and by what date, and answer within five more business days at most. A complaint (reclamo) is handled within fifteen business days, and if we cannot, we tell you why and by what date, and handle it within eight more business days at most. If you believe a request was not handled properly, you can file a complaint with the Superintendencia de Industria y Comercio, Colombia's personal-data protection authority. The databases this policy describes stay in force while Pendi is offered, and each item is kept for the time How long we keep your data states.

If you live elsewhere in Latin America

We give you what your country's data-protection law asks for, as if Pendi were there. This list names that law and where you can complain; where your law gives you more than this policy, your law applies.

This section is a summary. For users in Colombia the governing text is the Spanish version of this policy, Política de privacidad, because that is the language the law is written and enforced in.

If you live in Brazil

This section is for people using Pendi from Brazil, and it adds to everything above without taking anything away. Because Pendi is offered to people in Brazil, Brazil's Lei Geral de Proteção de Dados Pessoais (Lei 13.709 de 2018, LGPD) and the Marco Civil da Internet (Lei 12.965 de 2014) also apply to your data. The controller is Elkin Eduardo Cardoso Leyton, named above, at Carrera 4c Bis #39-24, Ibagué, Tolima, 730006, Colombia.

Contact channel

As a small processing agent, the controller is not required to appoint an encarregado pelo tratamento de dados pessoais (data protection officer) (Resolução CD/ANPD 2 de 2022, arts. 2, I, and 11). The channel for reaching him is [email protected] (art. 11, § 1): that is where your requests and complaints go, and the communications of the Agência Nacional de Proteção de Dados (ANPD).

What for, and on what legal basis

Your rights

You can ask us to: confirm whether we process data about you; give you access to it; correct what is incomplete, inaccurate or out of date; anonymise, block or delete what is unnecessary or not processed lawfully; port it to another provider; delete what we process with your consent; tell you whom we share it with, which is the list under “Who processes the managed tier's fragments” and “Who else receives data, which countries it travels to, and under what safeguard”; tell you that you may refuse consent and what happens if you do, which is nothing: Pendi works fully without the assistant and without sharing your dictations; and revoke your consent. All of it is free and goes through the same address.

Confirmation or access in simplified form is given immediately; the full statement, with the data's origin, the criteria and the purpose, within 15 days of your request. Where our processing rests on your consent or on the service you asked for, you can ask for a complete electronic copy. In the app you can already export your movements to a CSV file, save an encrypted backup wherever you like and delete your account; what sits on our servers we send you by email in an open-format file.

If you believe a request was not handled properly, you can petition the ANPD at gov.br/anpd, or the consumer-protection bodies.

Data leaving Brazil

Children and adolescents

Pendi is made for adults, not for children or adolescents to use on their own. If you add a child or an adolescent to a space, do it as their mother, father or legal guardian, and only with what the space needs, such as their name. That data is processed in their best interest and for what the space does for your family, nothing else.

Children

The app is a family organization tool intended for adults and is not directed at children under 13. If you are a minor, use it with the authorization of your mother, father or legal guardian, who gives it on your behalf. When an adult adds a minor as a person in their space, they do so as that minor's representative: the name and phone number are used only so the family can organize itself, the photo stays on the phone, and the adult can delete them at any time.

Changes

Every change to this policy, large or small, carries its version and date at the top of the page, and we announce it in the app's changelog before it takes effect. If a change touches what you authorized, such as what leaves the phone, to whom or to which country, the app asks for your authorization again before applying it.

Questions about your privacy? Write to [email protected], visit Support or Delete account.