SAYM Privacy Policy
Published 3 September 2026 · Effective 3 September 2026
TerryWi (the “Provider”) establishes and discloses this Privacy Policy as follows, in order to protect users’ personal information and to handle related grievances promptly and smoothly. SAYM is a personal budgeting app that reads card/bank payment messages and app notifications and records them automatically.
Article 1 (Purposes of Collection and Use)
The Provider processes the minimum personal information for the following purposes. The personal information processed is not used for any purpose other than the following, and if the purpose of use changes, the Provider will take necessary measures such as obtaining separate consent.
- Providing core features: All budgeting record features of SAYM (the “Service”) — envelope (category) budgeting, automatic recording of payment messages/notifications, spending/income reports, etc. — are stored only on the user’s device, and the Provider does not separately collect or retain personal information for this purpose.
- Automatic recognition of payment messages/notifications: Only where the user has granted permission, the content of card/bank payment messages (SMS/RCS) and notifications from card and payment apps is analyzed on the device only to automatically enter the amount, merchant and payment method.
- User identification and backup/restore: Identifying the user via Google sign-in, and providing backup and restore of records via the user’s own Google Drive.
- Improving auto-input recognition rules: Only when the user personally uses “Auto-input feedback” to report a recognition failure, the message/notification text selected by the user is received and used to improve recognition rules (patterns).
- Advertising: Securing operating funds through banner advertising via Google AdMob.
Article 2 (Items Collected and Method of Collection)
Items collected
- [When signing in, optional] Google account information: Email address and Google account identifier, collected via Google Sign-In (OAuth). All features can be used without limitation without signing in; sign-in is required only to use the Google Drive backup/restore feature.
- [When SMS/notification access is granted, processed on device] Payment message and app notification content: Card approval/cancellation messages (SMS/RCS), bank deposit/withdrawal messages, and payment notifications from card, easy-payment and bank apps. This information is analyzed only on the user’s device and converted into transaction records; neither the original text nor the analysis result is transmitted to the Provider’s servers or any third party. All features are available via manual entry without granting the permission, which can be revoked at any time in system settings.
- [Created by the user or recorded automatically while using the app, stored locally on the device] Budgeting usage records: Transaction details (amount, merchant name, category, memo, date/time), envelope allocation amounts, registered categories/payment methods, expected income, theme and other app settings. This information is kept only in the device’s storage (SQLite) and is not transmitted to the Provider’s servers (the Provider does not operate its own separate server).
- [When using the backup feature] Google Drive backup data: The entire local record above is stored in JSON form in the app-specific storage area (appDataFolder) within the user’s own Google Drive. This area is a private area that even the user cannot open directly from the Google Drive app screen, and no third party, including the Provider, can access this data.
- [When submitting auto-input feedback, sent by the user] Original message/notification text: Only where the user selects and sends a message/notification that failed recognition via “Auto-input feedback” in the app, the original text and its occurrence time and source app are transmitted to the recognition-rule improvement server (Supabase). Because this text may include payment-related content, the user can check for sensitive content before sending. The Provider does not collect or use this data for the purpose of personal identification, and deletes it after the rule improvement work is complete.
- [Collected automatically via the advertising SDK] Advertising identifier and device information: The Service displays banner ads via Google AdMob, and in this process the advertising identifier (Ad ID), device information, and diagnostic data related to ad impressions/clicks may be collected by Google. This is not information the Provider collects or retains directly, and it is processed in accordance with Google’s privacy policy.
Method of collection: Direct entry by the user during use of the Service, on-device automatic recognition via message/notification access granted by the user, Google account linking (OAuth), improvement-request submissions run by the user, and automatic collection via the advertising SDK.
Article 3 (Processing and Retention Period)
- Google sign-in information: Immediately disconnected and destroyed when the user runs “Sign out” or “Delete account.”
- Locally stored records and payment message/notification analysis results: Destroyed immediately when the user runs “Reset records” in the app or removes the app. As it is not separately retained on the Provider’s servers, the user can delete it completely on their own. The original message/notification text is not permanently stored on the device and is destroyed after processing within the minimum scope needed for recognition.
- Google Drive backup data: Deleted immediately when the user runs “Reset backup” or “Delete account.” Unless otherwise arranged, only the single latest backup is kept in the user’s own Drive.
- Original text sent via auto-input feedback: Deleted when the rule improvement work is complete; the user may request immediate deletion at any time via the contact email.
- Diagnostic information such as advertising identifiers: Follows Google’s relevant policies and retention periods.
Article 4 (Procedure and Method of Destruction)
- Procedure: When the user runs the in-app “Reset records,” “Reset backup” or “Delete account” features, they are processed immediately without any separate approval procedure.
- Method: Local device data is deleted immediately from device storage; Google Drive backup files are requested for deletion via the Google Drive API and destroyed so they cannot be recovered; improvement-request text is deleted from the rule improvement server.
Article 5 (User Rights and How to Exercise Them)
The user may exercise the following rights directly at any time from the in-app settings screen:
- Reset records (Settings > Records & backup): Delete all local records including transactions, envelope allocations, and detected messages/notifications
- Reset backup (Settings > Records & backup): Delete the backup file stored in Google Drive
- Sign out / Delete account (Settings > My info): Disconnect the Google sign-in link and delete Google Drive backup data (local records remaining on the device are kept and are deleted only by separately running “Reset records”)
- Revoke message/notification access: Can be revoked at any time in system settings (revoking stops only automatic recording; existing records and manual entry remain available)
Deletion of data sent via auto-input feedback and any other inquiries may be submitted to the support email (wwwtaekyu@gmail.com), and the Provider will act without delay. The Service is not directed at children under 14, and does not intentionally collect children’s personal information.
Article 6 (Security Measures)
- Technical measures: Budgeting records and payment message/notification analysis take place only within local device storage (SQLite) and on-device processing, and are not transmitted externally. Google account authentication uses Google’s standard OAuth; communication with Google Drive and the recognition-rule server is encrypted with TLS. Backup data is stored in an app-specific private area (appDataFolder) even within the user’s own Drive, blocking third-party access.
- Administrative measures: Personnel handling personal-information-related work are kept to a minimum.
Article 7 (Entrustment and Third-Party Provision)
The Provider does not operate its own separate server that stores users’ budgeting data. It uses the services of the businesses below for the following purposes, and information processed by each service follows that business’s privacy policy.
| Purpose | Service used | Information processed |
|---|
| User sign-in | Google Sign-In (Google LLC) | Email, account identifier |
| Record backup/restore | Google Drive API — appDataFolder (Google LLC) | All local records created by the user |
| Advertising | Google AdMob (Google LLC) | Advertising identifier, device information, diagnostic data |
| Storing auto-input feedback / remote delivery of recognition rules | Supabase (Supabase, Inc.) | Original message/notification text and occurrence time/source app sent by the user when submitting feedback (remote rule delivery is download-only and transmits no user information) |
Google Privacy Policy: https://policies.google.com/privacy
Supabase Privacy Policy: https://supabase.com/privacy
Article 8 (Regarding Message/Notification Access)
The Service uses the following permissions to record payment details automatically:
- SMS receive/read permissions (RECEIVE_SMS, READ_SMS, etc.): Used only to recognize payment messages from cards/banks and record them automatically in the budget. Not used for other purposes such as sending advertising/marketing messages, transmitting message content externally, or collecting contacts.
- Notification access (Notification Listener): Used only to read payment notifications from card, easy-payment and bank apps and record them automatically. Notification content of other apps unrelated to payments is not stored or transmitted.
Message/notification content read with the above permissions is analyzed only on the device and, except where the user personally runs “Auto-input feedback,” is not transmitted to any server. The user may revoke both permissions at any time in system settings, and can continue to use all budgeting features via manual entry even after revoking them.
Article 9 (Regarding Advertising)
The Service displays banner ads via Google AdMob. Information such as the advertising identifier may be collected for ad personalization, and the user may turn off ad personalization or reset the advertising identifier in device settings (Settings > Privacy > Ads). In regions where a separate consent procedure is required, such as the European Economic Area (EEA) and the UK, an additional consent procedure is presented via Google’s User Messaging Platform (UMP).
Article 10 (Personal Information Protection Officer)
- Business name (service provider): TerryWi
- Personal Information Protection Officer: TerryWi (representative)
- Support / inquiry email: wwwtaekyu@gmail.com
Users may contact the Personal Information Protection Officer regarding any personal-information matters, complaints or remedies arising while using the SAYM service.
Article 11 (Changes to this Privacy Policy)
This Privacy Policy applies from 3 September 2026. If there are additions, deletions or amendments, notice will be given through in-app announcements or this document from 7 days before the changes take effect.
Published: 3 September 2026
Effective: 3 September 2026
Contact: wwwtaekyu@gmail.com