Privacy

Arok has no server holding your data: nothing to send your accounts to, nothing to sync them with. Your accounts, transactions, and balances are stored only in this app (IndexedDB) and never leave your device, whether or not any AI feature is turned on. What you type in the entry bar never leaves your device either (since October 2026): Arok reads it on the phone, using your own account and category names and any extra words you add under "Also called", with no request, no API key and no network, so it works offline. The names it suggests while you type come from the same place. Until October 2026, with AI set up, the entry bar could send the sentence plus your account and category names (never balances, never history) to the AI provider you chose; that path was removed, not switched off. AI is now used for two things only, each off until you turn it on: reading a photo, and Riri. Both are described below, with what each sends. On the Android app there is also a model on the phone itself: Google's (Gemini Nano, reached through Google's ML Kit library inside the app), shown as Phone model in Settings → AI → Models & keys on a phone that can run it. Since typing stopped asking any AI it reads nothing of yours, and it cannot read a photo. Where it says the model is not on the phone yet, Get it there asks Android to download it from Google; that download carries nothing of yours. Asking the phone whether its model is ready is itself a use of Google's library, whose own data disclosure says it sends Google usage counts (identifiers for the installation, timings, settings), never anything you typed, so Arok asks only where the answer is shown (Models & keys and the AI page), never when the app starts, and keeps the last answer on the phone, outside your backups. The Android app also asks Google Play whether a newer Arok is out, each time you open Arok or come back to it, whatever your AI settings. That is Google's in-app update library, asking the Play Store app on the phone. Google's own data disclosure for it says it sends Google the phone's details, the app's version and which parts of the app are installed, only to tell whether there is an update, and that Google does not share them. It carries nothing you typed and none of your records. A new install starts with all of that switched off. Setting Arok up asks nothing about AI: "Start fresh" lands you in the app as Arok Basic, with AI off, and you choose AI later in Settings → AI features → Set up AI, or never. Typing "coffee 120 gcash" fills in the amount, the account and the date on every plan, because that part runs on your own device and always has. Four things can still make a request on Basic, and none carries your records: logging an amount in another currency asks for that day's rate (a date and two currency codes, described below); in a browser, the microphone hands your voice to the browser's own speech service, and says so while it listens; opening AI setup or Models & keys asks Arok's own server whether Arok Plus is on sale, a request that carries nothing about you; and in the Android app, the update check with Google Play described above. (Until August 2026 this was the other way round: a new install arrived set to use AI, pointed at a provider you had no key for, so the first thing you typed produced an error about a missing key rather than a question about whether you wanted any of this.) If you choose to set AI up, Arok offers to connect OpenRouter and then shows you the models it is currently serving free. Free models carry the training condition described below, so the setup screen states it in full before you pick one, and the same notice appears wherever else a free model is chosen. After you pick a model, the flow ends by offering the Riri chat switch, with the same plain statement of what chat can send that Settings shows, before the buttons. Chat stays off unless you turn it on, there or later. The same guided setup can be rerun at any time from Settings → AI features → Set up AI, with the same disclosures in the same places. OpenRouter is different in kind from the other two, and you should know how before you pick it. Anthropic and Google run the models they serve, so their own terms are the ones that apply. OpenRouter runs none: it is a router that forwards your request to whichever company actually serves the model you selected. So what happens to what you send depends on that company's terms and on your own OpenRouter privacy setting, not on OpenRouter alone, and it can differ from one model to the next in the same list: some endpoints there train on what they receive, and the free ones commonly do. It applies just as much to any model you add yourself, which Settings lets you do for any of the three providers, since a model you typed in is one Arok has never seen either. Settings shows a warning next to the OpenRouter key field for this reason, and it matters most for Riri, which sends your ledger rather than one sentence. Arok can now tell you part of that, and can act on the rest. OpenRouter publishes no per-model "this one trains on you" flag. Arok checked, and it is in none of the model, endpoint or key listings its API offers. What OpenRouter does publish is the list of endpoints with a zero-data-retention policy, meaning nothing is stored and so nothing can be trained on. Arok reads that list on Settings → AI → Models & keys and marks each of your OpenRouter models with it. Read the two states as written, because they are not opposites: a marked model has a route that keeps nothing, while an unmarked one only means no such route is listed, and it is not a finding that the model trains on you. The list is read fresh each time and never stored, so what you see is the policy as it stands today rather than one recorded weeks ago; if it cannot be reached, nothing is shown rather than a guess. The switch beside it is the part that binds: turning on Keep OpenRouter off training providers adds a single instruction to every request Arok sends there, asking OpenRouter to use only providers that do not collect what you receive, and OpenRouter refuses the request outright rather than routing it anyway if none qualifies. That is a real protection with a real cost: free models require the opposite permission, so most of them stop working while it is on. It is off by default, which is OpenRouter's own default rather than a choice Arok made for you. Nothing about it changes what is in a request, only who may be given it. An Arok licence covers paid OpenRouter models but never free ones, and the reason is about consent rather than money: a free endpoint requires the account holding it to permit training on what is sent, and on a licence the account is Arok's, and that is not a permission Arok will give on your behalf. Free models stay available with your own key, where the choice and the daily allowance are both yours. On a licence, Arok always asks OpenRouter to avoid providers that train on what you send. The Keep OpenRouter off training providers switch below is a choice about your OWN key, where the account is yours and the trade (a request that fails when no provider qualifies) is yours to take. On a licence the account is Arok's, so that is not a permission Arok will give on your behalf: the instruction goes with every licensed request whatever the switch says, and the relay sets it again on arrival.

Saving a licence key asks OpenRouter which models it currently serves, so Arok can set one up for you rather than leaving you to find one. That request is the same public model list the setup screen already reads: it carries no key, no licence and nothing about you or your ledger, and it is the only thing that happens when you save the key. What it sets up is GPT-6 Luna, a model made by OpenAI, which OpenRouter serves through OpenAI or Microsoft Azure (since 2026-10-02; before that, OpenRouter's auto router, which picked a model per request). An install still on the auto router reads the same public list once when Arok next opens, and moves. Nothing about what is sent changes, since the payload is the same either way, and your Keep OpenRouter off training providers preference still travels with every request. You can switch to a specific model at any time in Settings → AI → Models & keys. You can connect OpenRouter without copying a key (Settings → AI → Models & keys → Connect OpenRouter): you are sent to OpenRouter, sign in and authorise there, and are returned with a key Arok stores encrypted like any other. Your OpenRouter password is never seen by Arok, because it is typed on OpenRouter's own site, and the exchange that turns the authorisation into a key happens from this app straight to OpenRouter, with no server of Arok's in the path. If you use an Arok licence instead of your own API key (Settings → AI features → How AI requests are paid for), that last sentence changes, and here is exactly how: the same requests, carrying the same things and nothing more, go via a small relay Arok runs, which adds Arok's own provider key, counts your monthly usage against your plan, and passes the request through. A licence goes to OpenRouter and nowhere else, where it used to be able to reach Anthropic and Google directly as well, and since August 2026 it does not. That matters to you for a reason worth stating plainly rather than burying: OpenRouter is a router, so the paragraph above about it applies in full here too: what happens to what you send depends on whichever company actually serves the model you picked, and on the OpenRouter privacy setting of the account making the request, which on a licence is Arok's rather than yours. If you would rather that account be yours, use your own OpenRouter key; if you would rather send to Anthropic or Google directly, their own keys still work exactly as they always have and are unaffected by any of this. The relay never logs or stores what you send or what comes back. What it keeps is your licence key with the plan it was bought on and when it runs out, a running total of what the current period's requests cost, and, for a purchase, the payment provider's checkout reference so the link you land on after paying can hand you your key. A purchase is made through PayMongo, on its own pages; the relay asks PayMongo whether that checkout was paid (by its reference, never anything about you or your money) and mints the key. In the Android app from Google Play, a purchase goes through Google Play instead, because Google requires it to: the payment happens on Google's own sheet, so your card details and your Google account never reach Arok, and what the app sends the relay afterwards is the purchase receipt Google hands it, which is a code naming the purchase and nothing about you. The relay asks Google whether that receipt is a live subscription and mints the key the same way. It keeps the order number Google reports for that purchase beside the key, so a request to delete it can find the record. It asks again each time you open the app, which is how a renewal extends your key and how a reinstall gets it back. The usage meter in Settings reads that same running total back, again identified only by the key. Nothing else on this page changes with the mode: every opt-in below means what it says under either one, and what each feature may send is identical whichever way it is paid for. If you additionally opt into Riri chat feature, its scope is wider by design: the AI writes its own read-only queries against a temporary local copy of your ledger to answer your questions, so it can see amounts, dates, and notes while that feature is on, including, since it kept getting totals wrong without them, which entries cancel which (a correction you made to an automated posting, and the posting it undid). And, so it can answer questions about what you pay every month, that copy also includes the things you have set to happen on a schedule: your automations, one-tap templates and installment plans (including whatever you named them, such as a subscription's name), how you have grouped your accounts and the other names you gave your accounts and categories (since October 2026, so "UB CC" finds your Unionbank card and "kuryente" finds Electricity), the bills you are reminded about and when they fall due, and any monthly budget you have set along with how this month is going against it, plus each account's balance and your net worth over time, worked out on your device from those same entries. But that traffic still goes straight from this app to your own API key, never through us. Riri's "Copy log" button is the one place Arok hands your data to something outside itself at your request: it puts the whole conversation (the questions, the queries the AI wrote, the rows they returned, and the answers) on your device's clipboard, so it carries real amounts, notes, dates, and account names. Arok does not send that anywhere; what happens to it next is entirely down to where you paste it, and worth a thought, since on most platforms the clipboard is readable by other installed apps and on some it syncs to your other devices. Quick entry can also take a photo, and Riri can be asked about one, and the two share a single switch (Settings → AI features → Photos, off by default). It used to be two, one per feature, and they were the same question asked twice: what makes a photo different from anything else this app sends is that you choose what is in the frame, and a real receipt can carry the last digits of a card, a shop's address, or whoever was standing behind you. That is as true of a statement screenshot as of a till receipt, so it is one decision, not two. None of it is anything Arok asks for or stores, and nothing of the photo is kept afterwards.

You are asked at the camera, not only in Settings. Both cameras are on screen wherever the model you are using can read a photo, and the first tap opens a sheet that says what would be sent and waits: Send photo is what turns it on, Not now leaves it exactly as it was. Tapping a camera sends nothing by itself. The switch in Settings is the same decision, and is where it can be taken back.

With it on, the camera on the entry bar sends that photo, shrunk on your device first but still the picture you took, to the AI provider and model you picked for receipt photos, under Settings → AI → Models & keys; until you pick one, that is the model AI setup chose for you (never the Phone model, which cannot read a photo), and the row on that page names it. What comes back fills in an editable draft: the total, the merchant, the date. It is sent once per tap, never automatically, and nothing posts until you confirm the sheet it opens.

On Riri's side, and only once Riri itself is on, you can attach a picture (a receipt, a statement, a screenshot) to a question, and that image is sent, shrunk on your device first, to the chat model you picked, along with the question you asked. (If you have set an optional "careful answers" model, which is a setting for your own API key rather than for an Arok licence, and tap Answer again under an answer, that one re-asked turn, the same question and its photo if it carried one, goes to that second model you picked instead; nothing else changes about what is sent.) Be aware of what a photo can carry that a typed question cannot: a card number along the bottom of a receipt, a home address on a statement, or whoever happened to be standing in the frame. It is sent once, with the one question you attached it to, and is not carried over to the rest of the conversation; as everywhere else, anything it drafts still opens a sheet for you to confirm. You can also switch off individual things Riri is allowed to do (Settings → AI features → What it is allowed to do): drafting transactions, suggesting category cleanups, retagging in bulk, and asking you which account you meant. Switching one off is not cosmetic: that capability is not offered to the model at all, so it cannot propose it, and its card disappears from Riri's own list of what it can do. Reading your data has no switch, because answering a question is querying your ledger; if you would rather it did not read your data, turn Riri itself off at the top of that panel, which is what that switch is for. You can give Riri standing instructions of your own (Settings → AI features → Your own instructions), and anything you write there is sent to the AI provider with every single question you ask it, not only the questions it seems relevant to. That is the point of the feature: it is how you tell Riri things about your own money that Arok has no field for ("MP2 is a government savings programme, not a fund"), or how you want answers written. It is worth knowing because free text is the one place you might put something you never meant to tell Arok at all, and unlike a question you send once, this rides along on all of them. It is capped in length, it is added to Arok's own instructions rather than replacing them, and the whole prompt, Arok's part and yours, is readable in that same panel. It is stored with your ledger rather than as a device setting, so it travels in your backups, in the clear if you export one without a passphrase, the same as the ledger beside it. You can dictate a question instead of typing it, and this one works differently from everything else on this page: Arok sends no audio anywhere at all. What comes back is text in the question box for you to read and edit. Nothing is sent to an AI provider until you tap send, and then it is the text, never the audio. It is off until you tap the button, and nothing listens in the background.

Where the recognition happens depends on which Arok you are using, and the two answers are genuinely different, so the app says which one is true while it is listening rather than giving you the comfortable one.

Reporting one of Riri's answers sends a count, not the answer. Every reply carries a Report control. Picking a reason sends three things to Arok: which reason, which AI model answered, and which version of the app you are running. Not the question, not the answer, not anything from your ledger, because there is no box to type in, so there is nothing that could carry them by accident. What is stored is a tally, not a record of your report: "on this day, N people flagged this model for this reason". Nobody can look up what you reported, because nothing is kept per report. If you want to say more, the same screen offers an email, and what goes in it is yours to write. To stop the same person filing thousands, a scrambled, unreadable form of your network address is counted for a day and then never used again. It is never stored next to your report, and it cannot be turned back into an address. The same guard sits on starting a purchase, in the same form and for the same reason: a count against a scrambled address, kept for a day, never stored beside what was bought.

Riri can read Arok's own help pages, and that adds nothing about you. When you ask how a feature works, it looks the question up in the same help articles you can read under Settings → Help, and the article it found travels back to the AI provider so it can answer from it. Those articles are text Arok wrote about itself: identical on every install, the same for everybody, and containing nothing about your accounts, your figures or anything you typed. The question you asked was already going to the provider; this changes what comes back to it, not what is taken from you.

The usage page keeps a local count, not a transcript. Settings → AI features → Usage totals what AI requests have cost by reading each reply's own token report. What it stores is counts and prices, never the question, the answer, or anything from your ledger. It stays on this device, is never sent anywhere, and is trimmed after 180 days.

Arok asks a public exchange-rate service for the day's rate, and it is the one outbound call in the app that has nothing to do with AI. It goes to Frankfurter (frankfurter.dev), needs no account and no key, and the request says only a date and two currency codes, and nothing about you, your ledger, or what the figure is for. It happens when you log a transaction in a currency other than the one your ledger is kept in, and when a screen has a dollar cost to restate in pesos: the usage page, and the eval lab if you have used it. Nothing is asked for on a screen with nothing to convert. The rate an entry was converted at is kept on that entry, in your records on this device, so you can see what it was; no other rate is stored. With no connection, an entry sends nothing and asks you for the rate instead (since October 2026; until then it waited for a connection): you type it, or tap the rate your last entry in that currency used, which Arok reads from your own records and never fills in for you. If the service cannot be reached, the entry asks you the same way, and a screen restating a dollar cost simply leaves that figure out.

Choosing your ledger's currency (Settings → Preferences) changes one of those two codes and nothing else. It sends no extra request, discloses nothing new, and the currency you picked never leaves the browser, because it is a label on your own figures, stored beside them.

If you use an OpenRouter model that is free, Arok asks OpenRouter how much of today's free allowance you have left, and shows it under your OpenRouter key on Settings → AI → Models & keys. Free models are capped by the number of requests a day rather than by cost, so a spend total cannot show you where you stand; this is what does. The request sends your OpenRouter key and nothing else (no ledger data, no question, not even which model you were using), and it goes to OpenRouter, which already holds that key. If it cannot be reached, Arok falls back to counting the requests this device itself made, and says on screen that the figure is a floor rather than the whole, since the same key used on another device spends the same allowance. Nothing here is sent if you have no OpenRouter key saved.

Arok reads OpenRouter's public zero-data-retention list when you open Models & keys, to mark which of your models have a route that stores nothing. This one is unusual in a way worth naming: it sends nothing whatsoever, no key, no model id, not even a hint of which models you have, because the list is public, identical for everybody, and fetched whole. It is used and discarded, never stored. If it cannot be reached, the marks are simply absent.

Arok can appear in your phone's share sheet, and sharing into it sends nothing out. If you install Arok to your home screen, other apps can share a file to it: a transactions CSV from a bank app or an email attachment lands on the import screen with the file already loaded, and a photo lands in the entry bar's receipt reading. Both are the same paths you can already reach by hand, and sharing changes only how the file gets there. The file is handed straight to the app on your own device: it is held for the one moment it takes to open the right screen, and deleted as soon as that screen has it. Nothing about a shared file is uploaded, and nothing about it is kept once you have finished with it.

A shared photo is the one case where sharing can lead to something leaving, and only on the opt-in you have already made: reading a receipt into a transaction is the Photos feature (Settings → AI features), which is off unless you turned it on, either there or at a camera that asked. With it off, a shared photo lands on a screen that says so and does nothing else: it is not read, and it is not sent. With it on, it still waits for one tap on Read shared photo, because a web page can start a share too. Then the photo goes to the model you chose exactly as it would if you had taken it with the camera button, and whatever comes back is a draft you confirm. A shared CSV never involves AI at all: it is read by the same offline parser the file picker uses, on your device, whatever your AI settings are.

Photos you add to an account, a bill or a scheduled transaction stay on your device. Arok cuts each one down to a small square when you save it and keeps it with the rest of your data. It goes into your backups, and in the clear in an unencrypted one, like everything else there. It is never sent to an AI provider or anywhere else, and Riri cannot see it.

Your name, if you add one, stays on your device too. Home uses it to say hello. It goes into your backups with your other settings, and it is never sent to an AI provider or anywhere else.

Exported backups are encrypted with a passphrase only you know, unless you turn that off. The export offers an unencrypted backup for anyone who would rather not have a passphrase to forget, off by default, chosen per export and never remembered. An unencrypted backup is your whole ledger in a plain file: anything that can read it (a shared computer, a cloud sync, whatever backs up your downloads folder) can read every account, balance and transaction in it. What it does NOT carry is any stored secret: your provider API keys, your Arok licence and the automatic-copy passphrase are left out of an unencrypted file, and so is the key that opens them, so restoring one means pasting those in again. The app names those files …-unencrypted.mtbackup so you can tell them apart without opening them. The CSV export on the Log is the other unencrypted file it will write: an ordinary spreadsheet saved wherever your browser saves downloads, because a file you can't open anywhere else isn't the point of it. It is written locally and sent nowhere, but, like an unencrypted backup, anything that can read your downloads folder can read it, so treat it the way you would any other exported statement. CSV import reads a file you choose and never uploads it. Note also that the on-device ledger itself is stored in plaintext (the app lock, a PIN or in the Android app your phone's own lock, protects the app's UI and your API key, not the local database), so device-level security still matters if your device is shared or lost. In short: on the free paths and on your own key, nobody but you and your own AI provider account ever sees your financial data, because there is no one else in the loop; and on an Arok licence the one addition to that loop is our relay, which passes requests on without logging or storing them and is the only part of Arok that runs on a server at all.

Deleting any of it has its own page: Deleting your data. It says what you can erase yourself, which is everything on your device and needs no request; the little that is kept off it, which is a licence record and its spend counter and only exists if you bought a pass; and the two things nobody here can remove for you, which are the payment record and whatever your own AI provider still holds.