CLEAR ABOUT YOUR DATA, TOO

Privacy & preview terms.

Effective 19 October 2026. This notice describes the Pesa Ledger Android public beta and this website.

Your transaction ledger

SMS access is optional. With permission, the Android app scans your inbox on the device and stores recognized transaction details in its private local database. It does not upload or store raw SMS bodies on the server. Pasting messages works without SMS permission. Recipient names, phone or account details, transaction IDs and private notes remain on your device. Signing in does not upload or synchronize the ledger.

Each person should use their own phone or Android device profile. A ledger is local to an app installation, not a cloud account: changing AI accounts on the same device does not switch or erase that device’s ledger. Notifications may show spending summaries according to your Android lock-screen settings.

Accounts & security

AI accounts store a username, a randomly generated user ID, a salted scrypt password hash, creation time, session token hashes and expirations. Passwords are never stored in plain text. Web sessions use Secure, HttpOnly, SameSite cookies; Android sessions are encrypted on the device using Android Keystore. The model key stays in Azure Key Vault and is not distributed with the app.

Authentication limits use a keyed hash of the network address and hashed username. Usage counters track account and shared allowances. This data is stored in Azure Table Storage; it is not a transaction database. Azure hosting may also produce operational logs, such as requests, response codes, timestamps and network addresses. Account and AI request bodies are not deliberately logged by the app backend.

Optional AI insights

Only when you confirm Generate, the app sends the selected reporting dates, currency and category totals, known fees, transaction counts and unknown-fee counts to the backend. The backend sends validated aggregates to Azure OpenAI to create an explanation. It does not send raw SMS, recipient names, transaction IDs, phone numbers, account numbers or private notes. Reports are returned to your phone and are not saved as a server-side report history.

The model deployment uses Azure Global Standard processing, which can process requests outside the Azure resource’s region. Requests set store: false; this does not promise zero provider retention. Azure’s applicable service and data-handling terms apply.

Cookies & third parties

This site uses an essential account-session cookie only. It uses no advertising trackers, third-party fonts or marketing analytics. Azure hosts the site, identity storage and model service. No mobile money operator is connected directly to the app; the app is not endorsed by those operators.

Your controls

• Revoke SMS or notification permission in Android Settings.
• Delete local transactions from the Android app’s Settings.
• Export CSV or a JSON backup. Exported files include personal transaction details and are not encrypted by the app; choose private storage.
• Sign out to revoke the current AI session. Sessions expire after 30 days.
• Delete your account from the website account page by confirming your password. This removes the user record and associated sessions. Usage counters contain an opaque user ID or a keyed hash and may remain as operational records. Deleting an account does not delete your phone’s ledger, SMS or exported backups.

Uninstalling the app removes its local data. Back up your ledger before uninstalling or changing devices. Automatic Android cloud backup is disabled. Password recovery is not available in this beta.

Preview terms

Pesa Ledger is a public beta, provided for personal expense tracking. It recognizes a limited set of outgoing message formats for M-Pesa Kenya, MTN MoMo Rwanda and Airtel Money Rwanda. It may miss or misinterpret transactions. Incoming money and reversals are not yet reconciled automatically. All imports initially count as expenses; you can edit or exclude records.

AI explanations can contain errors and are not financial advice. Review your records and your provider’s statements. KES and RWF are reported separately without exchange-rate conversion. Android controls installation and can restrict SMS access or background delivery.

AI use is limited to 10 requests per account per UTC day and 100 requests across the service per day, with additional short-term rate limits. Attempts can consume an allowance even when a provider request fails. These limits may change with capacity. Registering does not create a promise of unlimited or uninterrupted AI access. Local reports remain usable without AI.

Use the service only for your own authorized data. Do not share credentials, automate account creation, bypass usage limits, or submit other people’s private information. The app cannot send money and never needs your mobile money PIN or OTP.