This Privacy Policy explains how Odit — the Android app published on
Google Play under package name com.robi.odit and its companion web
dashboard at odit.et (together, "the Service") — collects, uses, stores, and safeguards your information,
with particular attention to the SMS banking data that powers the Service. If you do
not agree with this policy, please do not use the Service.
For any questions about this policy or to exercise the rights described in Section 8, contact us at support@odit.et.
When you create an account, we collect:
The core of the Service involves reading SMS messages from your Android device and syncing them to our servers. The app applies on-device filtering before any data is transmitted, so personal messages never leave your phone (see Section 3). Syncing happens automatically via a recurring background worker that runs roughly once an hour — there is no real-time push, so newly received messages typically appear in your account within an hour rather than instantly. You can disable automatic syncing in the app and switch to on-demand uploads instead, and you can preview and deselect individual senders before each upload. For each synced message, we collect:
Important: Messages from Ethiopian phone numbers (09/07/+251 prefixes) are always excluded on-device and never transmitted to our servers. Only messages from non-personal sources — such as bank short codes, service alerts, and institutional senders — are synced. Only messages from recognized banking addresses are processed for financial data extraction on our servers.
When you connect a device, we collect:
ANDROID_ID — a per-device, per-app-signing-key value provided by the Android OS. It is stable across reinstalls of our app on the same device but cannot be used to track you across other apps from different developers, and it is reset if you factory-reset the device;When you access the web dashboard, we may collect:
The Android app includes an optional receipt scanner that uses your device camera to capture paper receipts. Text recognition runs on-device using Google ML Kit; the recognized text never leaves your phone unless you proceed to AI-assisted categorization.
If your plan includes AI receipt extraction, choosing to extract a captured receipt uploads the receipt image and its on-device OCR text to our servers for parsing (amount, merchant, line items, suggested category). Receipt extraction is a per-capture user action; receipts are never uploaded automatically. On the free plan, captured receipts remain entirely on-device.
The Odit Android app applies strict on-device filtering before any SMS data is transmitted to our servers. Personal messages never leave your phone.
Messages from Ethiopian phone numbers are always excluded from the sync. Messages from senders matching the following patterns are filtered out on-device and never leave your phone:
In addition to personal numbers, the following are always discarded on-device before any upload:
This means only messages from non-personal sources — such as bank short codes, service alerts, and institutional senders — are synced. Personal SMS conversations between Ethiopian phone numbers never reach our servers.
Only messages from non-personal senders pass through the filter. This includes:
Of the synced messages, only those from recognized banking addresses are processed for financial data extraction. All other synced messages are stored but not parsed.
Before each sync, the app shows you a preview of which senders it intends to upload and lets you deselect individual senders. Deselected senders are excluded from the upload alongside the on-device filters above; this choice is remembered for future syncs.
If a banking institution sends messages from a standard Ethiopian phone number rather than a short code, those messages will be excluded by the filter and will not appear in your dashboard. This is an intentional privacy-first design choice.
The Odit Android app declares the following permissions. Most are requested at install time; the asterisked ones require a runtime prompt that you must approve:
We use the information we collect to:
We do not sell, rent, or trade your personal information or SMS data to third parties.
We use the following named third-party processors to operate the Service. Each processor receives only the data described and is contractually or by terms-of-use bound to use it solely for the stated purpose:
We may disclose your information if required by law or in response to valid legal process (e.g. a court order or government agency request).
If Odit is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
We implement technical and organizational security measures to protect your data, including:
However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
We retain your data for as long as your account is active. Specifically:
When you request account deletion (in the Android app or on the web dashboard), your account is scheduled for deletion with a 30-day grace period. During the grace period:
After 30 days, a daily purge job hard-deletes the account row, every device owned by it, all synced SMS data (parsed messages, raw export batches, extracted financial data), wallets, participants, goals, recurring transactions, manual entries, categories, category rules, notifications, and authentication sessions. Anonymous, scrubbed telemetry already emitted to third-party log processors persists for the remainder of their retention window described above, after which it is purged automatically.
You have the right to:
To exercise these rights, contact us at support@odit.et.
We use session cookies for authentication and user preferences. We may use analytics tools to understand how the Service is used. You can configure your browser to refuse cookies, though some features of the Service may not function properly without them.
The Service may contain links to third-party websites. We have no control over and assume no responsibility for the content or privacy practices of those sites.
The Service is not intended for children under 13. We do not knowingly collect information from children under 13. If you become aware that a child has provided us with personal information, please contact us.
Your information may be transferred to and stored on servers outside your country of residence. We take reasonable steps to ensure your data is treated securely and in accordance with this policy regardless of where it is processed.
We may update this policy from time to time. When we make material changes, we will notify you through the Service and update the "Last updated" date. Material changes to how your SMS data is handled will require you to re-accept the updated policy before continuing to use the Service.
If you have any questions about this Privacy Policy, how your data is handled, or to exercise any of the rights described in Section 8, contact us by email at support@odit.et.
This policy applies to the Odit Android app
(package name com.robi.odit) published on Google Play and the Odit web
dashboard at odit.et.