See where the money actually went, without handing your statements to an advertising business.
PennyRush is a personal finance tracker with a native Android app, a companion web app, and one Supabase backend. Statement files and receipt images are read for the fields you choose to save and then dropped. What is stored is the entry itself: amount, date, merchant, note, type, category.
|
|
|
|
|
Captured from the app running on a physical device, with the status and navigation bars cropped out, against a test account whose most recent activity is a couple of months old. That is why the merchant ranking is absent and Insights reads "No activity yet".
The claim is narrow enough to keep:
- CSV import parses the file in your browser. The raw statement is never uploaded to storage.
- Receipt scan reads the image to fill in the entry for you to check. The entry is saved; the image is not kept afterwards.
- No advertising SDKs, no paid analytics SDKs, no tracking pixels, and none of your data is sold.
- Export everything as CSV whenever you want it, and delete your account and its data from either client.
The one host the app talks to is its own Supabase project, plus Google for sign-in. Full policy: privacy.signalizeai.org/pennyrush.
web/: Next.js App Router companion app with authentication, activity dashboard, manual entries, CSV import, privacy/terms pages, and export/delete controls.android/: Kotlin + Jetpack Compose app with Home, Activity, Plan, Insights, Account, manual entry, import, receipt scan, budgets/goals, alerts, export, and delete controls.shared/: Shared TypeScript contract types for web and Supabase functions.supabase/: Local-only schema/functions workspace. It is intentionally ignored so linked project state and secrets are not pushed.docs/: Architecture, database, privacy, Play Store listing, and release checklist material.
npm install
npm run web:devCreate .env.local from .env.example:
NEXT_PUBLIC_SUPABASE_URL=...
NEXT_PUBLIC_SUPABASE_ANON_KEY=...
PENNYRUSH_SUPABASE_URL=...
PENNYRUSH_SUPABASE_ANON_KEY=...Android local build:
cd android
./gradlew :app:assembleDebugRelease verification:
npm audit
npm run web:test
npm run web:lint
npm run web:typecheck
npm run web:build
cd android
./gradlew :app:compileDebugKotlin
./gradlew :feature:home:testDebugUnitTest :app:assembleDebug :app:assembleRelease :app:bundleReleaseSupabase service-role and AI provider secrets must be configured only in secure server-side environments, never in client apps:
supabase secrets set GROQ_API_KEY=...
supabase secrets set GEMINI_API_KEY=...
supabase secrets set SUPABASE_SERVICE_ROLE_KEY=...PennyRush does not use Supabase Storage in v1. Files selected for statement import or receipt scan are:
- Read into memory.
- Parsed into structured candidate transactions.
- Discarded by the client flow after extraction.
- Never written to disk, object storage, analytics, or logs.
Current categorization and insight helpers are rules-based. If server-side AI is enabled later, clients must never receive model API keys and payloads must stay minimized.
Use docs/release-checklist.md before shipping. GitHub Actions verifies web and Android changes on push/PR and can build release artifacts when production Supabase and Android signing secrets are configured.
See CONTRIBUTING.md, SECURITY.md, and CODE_OF_CONDUCT.md.
PennyRush is licensed under the MIT License.