Privacy policy

Ví Ơi is a personal ledger for logging transactions, watching a monthly plan, and looking back at what you spent. This notice explains how Ví Ơi handles your data in version 1.2 on Android (Google Play) and iPhone (App Store). Where the two versions differ, the section says so. It is the policy for the Ví Ơi app and does not replace the ODERYN website privacy notice.

In short: Ví Ơi has no account, and ODERYN runs no server for the app. Your ledger stays on your phone. Data leaves the phone only for features you use: device backups, a Google Drive backup you connect, coin prices and public address lookups, U.S. stock prices from Finnhub if you add your own key, the AI assistant with your own key, Plus purchases through the app store, and content you choose to share.

Data stored on the device

Transactions, categories, wallets and balances you record, budgets and category limits, payday, lending and borrowing, recurring entries, savings goals, watched coin addresses and their history, stocks and coins in your portfolio, language, reminder times and other settings are stored in the app’s private storage on your phone. On Android this is the app’s Room database; on iPhone it is a file in the app’s own container, protected by iOS data protection.

Secrets are kept apart and only on this phone. On Android, AI keys and the Google Drive sign-in and backup password are encrypted with a non-exportable Android Keystore key, and the app-lock PIN is kept only as a salted hash. On iPhone, all of these are Keychain items limited to this device. None of them is included in device backups or .vioi files.

If you add the home-screen widget, it shows today’s spending, the budget left and, if you choose, the Bitcoin price to anyone who can see your home screen.

There is no account, and ODERYN does not receive or sync your ledger. ODERYN cannot see your book.

Device backups and changing phones

Android: from version 1.2, Ví Ơi takes part in Android’s own backup. The ledger database and the main settings file are copied to your Google account backup only when that backup is end-to-end encrypted with your screen lock, and to a new phone in a direct device-to-device transfer. On Android 8, Ví Ơi stays out of Google backup. You can turn backup off in Android Settings.

iPhone: the ledger file and app settings are part of your iPhone’s iCloud or computer backup, under Apple’s backup settings.

Not carried by these backups: the app-lock PIN, AI keys, and the Google Drive sign-in and backup password (on Android also Plus status and permission for alert hints). After restoring, you set these up again on the new phone; Plus comes back from Google Play or the App Store.

Encrypted backup files (.vioi)

You can save the whole ledger, including watched coin addresses, as a .vioi file and open it on another phone. The file is compressed and encrypted on your phone (AES-256-GCM) with a key derived from a password you choose. You decide where it goes: Files, a cloud drive, email or a chat app. ODERYN does not receive these files and cannot open them; without your password nobody can, and a forgotten password cannot be recovered. A .vioi file does not contain AI keys, the app-lock PIN, the Drive sign-in or Plus status.

Google Drive backup (optional, Plus)

Availability depends on the installed platform and build. Google Drive automatic backup is not configured in the current iPhone candidate; local encrypted .vioi backup and restore remain available. The following describes Drive handling only in a build where the connection is available and you enable it.

If you connect Google Drive, Ví Ơi uses Google sign-in only to get access to Drive, with the drive.appdata permission. That permission covers only the app’s own hidden folder (appDataFolder) in your Drive; Ví Ơi cannot see your other Drive files, and signing in with Google does not create a Ví Ơi account.

Each backup is encrypted on the phone with your backup password before upload, so Drive holds only encrypted files. The phone talks to Google directly; nothing passes through ODERYN. Ví Ơi keeps the newest five backups and can make one every day if you turn on automatic backup. Making new Drive backups needs Plus; restoring is always free. Google’s privacy policy applies to your Google account and Drive.

When you disconnect, access is revoked and you can choose to delete Ví Ơi’s backups from Drive. You can also delete the app’s hidden data in Google Drive settings under Manage apps.

Coins and prices (watch-only)

Ví Ơi can show coin prices and follow wallets in watch-only mode. It never asks for private keys or recovery (seed) phrases, cannot send coins, and does not connect to exchange accounts.

Prices and exchange rates come from Coinbase and CoinGecko. These requests contain only coin symbols and currency codes; you can choose which source is tried first. While a coin’s detail screen is open, the app may follow Coinbase’s public live price feed. U.S. stock prices come only from Finnhub, and only if you add your own key (see Portfolio and stock prices below).

When you add a public address, the app looks up its balance and movements at public blockchain services: mempool.space and blockstream.info for Bitcoin, TronGrid for USDT on TRON, and Blockscout for Ethereum. If you add an extended public key (xpub/zpub), it stays on the phone: the app derives the addresses on the phone and looks those addresses up. You can set your own Esplora server for Bitcoin; the public servers remain as a fallback if it does not answer.

Only public addresses, coin symbols and currency codes are sent. Like any website, these services see your IP address together with what is requested, so they could link an address to your connection; their own privacy policies apply. Lookups run while you use these screens and, in the background, only if you turn on price alerts, movement notices or the widget’s Bitcoin price. Addresses, labels and movements are stored on the phone and included in backups.

Portfolio and stock prices (optional)

You can list stocks and coins you own as assets in Ví Ơi to see what they are worth. This is for tracking only: Ví Ơi does not connect to or sign in to a broker or exchange, and cannot buy, sell or place orders.

Holdings are saved only after you type them or check the rows read from a screenshot. Each holding (ticker, quantity, average cost, price and when it was saved) is stored only on your phone and in your own backups (device backups and .vioi files). If you pick a screenshot from your broker app, it is read on the phone with on-device text recognition (ML Kit on Android, Apple Vision on iPhone); the image is not uploaded and is not kept.

Korean and Vietnamese stock prices are never fetched; you type them yourself. Coins in the portfolio use the coin prices described above.

U.S. stock quotes are fetched only if you enter your own Finnhub API key and agree. The phone then sends the key and the U.S. tickers you hold (or the sample ticker AAPL when you check a new key while holding no U.S. stocks) directly to Finnhub (finnhub.io) over HTTPS, during U.S. regular trading hours, at most every 15 minutes, while the app is open. Quantities, amounts and your ledger are not sent. Like any website, Finnhub sees your IP address; Finnhub’s own privacy policy applies. Nothing passes through ODERYN.

The Finnhub key is stored encrypted on this phone (Android Keystore or the iPhone Keychain) and is never included in device backups or .vioi files. You can remove it in the app at any time; this stops U.S. quotes but does not delete requests Finnhub has already received.

Optional AI assistant

You can use Ví Ơi without enabling AI or providing an API key. Default quick entry, receipt reading and insights use rules on the device. If you add your own API key and turn the assistant on, the app sends requests directly over HTTPS from your phone to the provider you choose: Claude (Anthropic), OpenAI, Google Gemini, Groq (Llama models), Meta (Muse Spark model) or an OpenAI-compatible service you configure. Nothing passes through ODERYN. The assistant stays off until you turn it on; the AI screen shows what is sent and to whom, and the app asks for your agreement before it saves a key or turns the assistant on.

For quick entry, a request contains the sentence you enter, category and wallet names and IDs, and the current date. Your sentence may contain amounts or personal information you choose to enter. For monthly insights, a request contains income, spending, budgets, category figures and previous-month averages, outstanding lending and borrowing totals, and the response language. The monthly coach (Plus) also sends the total of recurring bills and savings-goal progress as numbers; goal, wallet and people’s names are not sent. Connection testing sends a short test request. Your API key is sent to that service for authentication; its saved copy stays in Android Keystore or the iPhone Keychain.

The app does not automatically attach your full transaction history, receipt photos or bank-notification content to AI requests. If you paste such information into an input sentence, the text you enter is sent. Do not enter OTPs, bank passwords or full card details.

Processing and retention of AI requests follow the selected provider’s terms and your account settings there. The free tiers of some providers (marked in the app, for example Google Gemini and Groq) may use what you send to improve their services; read their terms first. With Meta, the app uses the Muse Spark model without connecting your personal Muse agent, and only the Standard option, for which Meta says this data is not used for training; the Contributor option, which allows training on prompts and replies, is not used. Any charges are billed by the provider to your own key. You can turn AI off or remove the key in the app; this does not delete requests the provider has already received.

Camera and photos: QR codes, receipts and screenshots

The camera is used only when you choose to scan a QR code (a payment QR such as VietQR, or a coin address) or photograph a receipt (receipt capture, photo selection and on-device OCR are free). You can also pick one photo through the system photo picker; Ví Ơi does not get access to your photo library. For the portfolio, you can pick a screenshot from your broker app the same way; on iPhone this needs no photo-library permission.

Recognition runs on the phone. Android uses Google’s ML Kit through Google Play services: the QR scanner is Google’s own screen, so Ví Ơi has no camera permission, and the receipt photo is taken by your camera app. iPhone uses Apple’s Vision framework after you allow camera access. Images are not uploaded to ODERYN or to an AI provider and are not kept; a receipt photo is deleted once its text has been read. Only what you confirm (amount, date, note) is saved as an entry. For a broker screenshot, only the holdings you check and confirm are saved; the image itself is not saved or uploaded.

App lock

You can lock Ví Ơi with a PIN or with your phone’s own unlock: fingerprint or face unlock on Android, Face ID or Touch ID on iPhone, or the device passcode. Android or iOS performs the check and tells Ví Ơi only whether it succeeded; Ví Ơi never receives fingerprint, face or other biometric data. The PIN is stored only as a salted hash on this phone and is not backed up. On Android the app can also hide its content in the recent-apps screen.

Ví Ơi Plus purchases

Purchase availability and prices depend on the installed build and the store. A free Plus test preview does not require a purchase. The following explains data handling when store purchases are enabled.

Ví Ơi Plus is sold as a one-time (lifetime) purchase or a yearly subscription, through Google Play on Android and the App Store on iPhone. Google or Apple handles payment and keeps its own purchase records under its privacy policy; ODERYN never receives your card or bank details. The store tells the app on your phone whether you own Plus; the app checks that answer on the device and keeps it locally so Plus works offline. There is no ODERYN server and no account. ODERYN sees only the sales reports the stores give developers. You manage or cancel a subscription in Google Play or in your Apple ID settings.

Reminders from Ví Ơi

If you allow notifications, Ví Ơi may show notifications created on your phone: a daily reminder to log your spending, up to 4 times a day at times you choose (off until you turn it on, and skipped when you have already logged since the previous reminder), entries waiting for review, a budget warning around 80% or when the month’s plan is used up, a weekly summary, debts coming due, price alerts you set, and movements on watched addresses.

They are scheduled on the device. ODERYN runs no push-notification server and sends no marketing messages. You turn each reminder on or off and set the time in Settings. These are Ví Ơi’s own notices, not bank or e-wallet alerts.

Hints from bank alerts and bank texts

When you link an Android bank source to a wallet, you may enter an account number for matching. The app converts it to a keyed fingerprint with Android Keystore and does not retain the number or its last four digits. The key is not exported. Links, fingerprints and capture history stay on the phone and are included in full backups you create; restored links stay disabled until you confirm them again. An unidentified account waits for a wallet choice. Imported bank transactions require your review and are not automatically confirmed. Deleting a transaction clears its financial content from capture history while retaining opaque deduplication identifiers; deleting all data also removes those identifiers.

The separate SMS beta, identified by .smsbeta, reads only after you request an import and grant permission. Each request checks at most 500 inbox messages from the last 30 days against the selected financial senders. It does not send or delete SMS. This is separate from the standard Google Play build, which does not request SMS-reading permission.

Android: if you turn on hints from notifications and grant the matching Android permission, Ví Ơi may read new alerts from financial sources you select, to recognise amount and type.

Android notification access is broader than the list you pick. The app filters by package and ignores other sources. Processing happens on the device. Raw alert text is not stored and is not sent to ODERYN servers. A suggested entry is written to the book only after you confirm it.

You can turn the feature off in the app and revoke access in Android Settings at any time. This consent does not travel to a new phone with a backup. The Google Play version of Ví Ơi does not read SMS.

iPhone: Ví Ơi cannot read your messages or other apps’ notifications. If you set up a message automation in Apple’s Shortcuts app yourself, that automation passes the text of a bank message to Ví Ơi’s “Record a bank message” action. Ví Ơi reads that text on the phone and saves only the amount, type, merchant or sender and time, as an entry waiting for you to check (with a short note naming the merchant and bank, and a hash of the text so the same message is not added twice). The message text itself is not kept and is sent nowhere, including to ODERYN or an AI provider. You can remove the automation in Shortcuts at any time, and the entries stop.

Optional on-device voice entry (Android)

Ví Ơi requests microphone permission only after you tap Start in the voice dialog. It uses Android's on-device recognition service on Android 12 or later when the phone and selected language support it. If unavailable, use the keyboard; the app does not automatically switch to online recognition.

The app does not create audio files, log audio or recognized sentences, or send the recognized sentence to the optional AI feature. The sentence stays in memory for editing and draft creation; only details you confirm when saving enter the ledger. Cancelling or closing the dialog discards it. Leaving the app while it is listening or processing stops the session. The language choice is remembered. You can revoke microphone permission in Android settings.

What Ví Ơi does not ask for

Ví Ơi does not ask for bank passwords, OTPs, full card numbers, bank logins, or coin private keys and recovery phrases. It does not use location or contacts. The optional Android voice feature uses the microphone only as described in the voice-entry section. It does not access your photo library (apart from a single photo you pick yourself, as described above).

Ví Ơi is not a bank, e-wallet, exchange or payment service and does not show a real bank-account balance.

Export and import

You can export transactions to CSV and import from CSV; with Plus you can also create Excel and PDF reports. These files sit outside the app’s private storage and, unlike .vioi files, are not encrypted by Ví Ơi. You choose where to keep them and who you share them with.

Sharing, feedback and support

Apart from the features described above, content leaves the device only when you choose to share it or send it to support.

Ví Ơi does not sell personal data, does not sync your ledger to ODERYN and does not send data for advertising. Feedback drafts (Android) stay on the device.

If you use Share or email support, only the content you choose to send leaves the device, to the app or service you pick. What happens next depends on that service. Content already sent is not recalled when you delete data on the phone.

Ads, analytics and tracking

Ví Ơi has no third-party ads and no analytics, crash-reporting or ad-tracking SDK, and it does not track you across other apps or websites. The Android version uses Google components for Play purchases, scanning and Google sign-in (Google Play Billing and Google Play services), which Google provides under its own terms. If this changes, this policy, the Google Play Data safety section and the App Store privacy details will be updated before the related release.

Security

App data is kept in the app’s private area under Android’s or iOS’s protections, secrets are held in Android Keystore or the iPhone Keychain, every network request uses HTTPS, and backup files are encrypted with your password. No electronic storage is perfectly safe. Use a screen lock, keep the system updated, choose a strong backup password and keep copies in a place you trust.

Keeping and deleting data

Local data stays on the device until you delete an entry, choose “Delete all data” in Ví Ơi, or uninstall the app.

“Delete all data” also removes locally saved AI settings and keys, portfolio holdings and the Finnhub key, and turns off automatic Drive backup. It does not remove copies outside the app: device backups (follow your Google or Apple backup settings), .vioi, CSV, Excel or PDF files you saved, Ví Ơi backups in Google Drive (delete them when you disconnect Drive in the app, or in Google Drive settings under Manage apps), messages you sent, or requests already received by an AI provider, Finnhub, or a blockchain or price service. For data you sent to another service, use that service’s controls or contact its support.

On iPhone, iOS may keep the app’s Keychain items (such as an AI key or the Finnhub key) after the app is deleted. If you install Ví Ơi again, it removes them on its first launch, so an old AI key, Drive sign-in or PIN is not reused.

Children

Ví Ơi is made for adults managing personal spending and is not directed at children.

Changes to this policy

We may update this policy when features or data handling change. The effective date at the top of the page will change when a material update is published.

Contact

• Developer: ODERYN
• App: Ví Ơi – Sổ thu chi
• Support email: oderynstudio@gmail.com
• Website: oderyn.com