Where do my data live?

On the phone. The app works entirely offline. What reaches the cloud reaches it because you switched sync on (Premium) — and then it is stored by Google Firebase, attachments in a data centre in Europe.

On the lock screen, “Forgot PIN?” › “Use recovery code”, with the code you were given when the PIN was set. If a Google account was signed in when the PIN was created, “Sign in with Google” with that same account also works. Either way the PIN is removed and the app opens; a new one can be set in Settings.

Does deleting my account delete everything?

Yes: the ZeniCash account, the book and the receipt files in the cloud, the list of devices, the invite codes, and the data on the device. It cannot be undone, and it is refused while the account is inside a shared space — leave the space first.

Yes, on every plan: Settings › Backup & Restore.

I forgot the password of a backup.

Then that backup cannot be opened: the app keeps no copy of the password and has no way to recover it. A new backup can be made at any time, with a password or without one.

← Help

PIN lock, backups, and deleting your account

Free

Financial records deserve a lock, a spare key and a copy. ZeniCash keeps the data on the phone unless you decide otherwise, locks the app with a PIN and a recovery code, and lets you take a backup file wherever you like.

PIN and recovery code

Settings › Security › App Lock. The PIN has 4 digits, typed twice; then the app shows a recovery code to keep somewhere safe — it is the way back in if the PIN is forgotten. If a Google account is signed in at that moment, it is kept as a second way back.

The PIN is asked when the app opens and when it comes back after a few seconds away; the camera and the file picker of a form do not count as leaving. A wrong PIN shakes the dots; after 5 wrong PINs in a row the keypad gives way to Recover access. From the lock screen, Forgot PIN? offers Use recovery code and, when there was a Google account, Sign in with Google — which only checks that it is the same account and never changes the account signed in to the app. A wrong code says so under the field and leaves the box open. Recovering removes the PIN. From version 1.7.7 recovering goes straight back to the app, without the PIN screen showing again on the way, and says PIN removed. Set a new one in Settings if you want. With Sign in with Google, a waiting circle takes the keypad’s place from the moment Google is asked until it answers; another account brings the keypad back with This Google account doesn't match the recovery account., and closing Google’s window brings it back with no message.

With the PIN on, Change PIN / Password and Generate a new recovery code appear. From version 1.7.4 changing the PIN, and switching App Lock off, first ask for the current one. Switching it off deletes the PIN and its code. The PIN is kept on each phone and does not travel with sync.

While a PIN is set, the app covers itself with its logo whenever it leaves the screen, so the recent-apps view does not show its content. On Android versions before 13 the system also refuses screenshots of the app; from Android 13 on, and on the iPhone, screenshots are not blocked.

What leaves the phone, and when

Nothing, until you switch on cloud sync (Premium) in Settings › Cloud Sync, with a Google or Apple account. Sync is never switched on by itself.
Signing in does not empty the phone: from version 1.7.4 a book created on this phone and never synced is kept on the first sign-in — see A new phone and sync.
Receipt reading happens on the phone. Only the optional AI reading — which asks for consent — sends an image, and it is not stored.
Usage analytics stay off until you allow them.

Backup and restore

Settings › Backup & Restore. Free.

Create Backup makes one .zip file with the whole book and the receipt files that are on this phone (those only in the cloud are not in it), then Share File or Save to device. Without a password the file is not encrypted: keep it somewhere safe.
From version 1.7.5 Create Backup first opens a box with Protect with a password, off by default. Left off, the backup is the same .zip as before. Switched on, the password is typed twice — Password and Repeat the password — under the warning Without the password, this backup cannot be opened. There is no way to recover it. The file is then encrypted (AES-256), still with a .zip name, and takes a few seconds longer to make. The password is kept nowhere — not on the phone, not in the file, not in the cloud.
Restore Backup reads a .zip (or an old .db) and replaces everything on the phone — the app asks first. Premium is not carried by the file: the app asks the store again.
From version 1.7.5, once a protected backup is picked, the app asks for the password it was created with. A wrong one says Wrong password under the field and changes nothing; another can be typed, or Cancel leaves the phone as it was. Backups without a password, including every one made before version 1.7.5, restore as before, with nothing asked. A protected backup opens only on version 1.7.5 or later.
From version 1.7.4 a backup made under another ZeniCash account is refused, with nothing changed. On a phone signed in to sync, the restore box says what follows: sync is paused, so the book stays exactly as the backup left it, and Cloud Sync shows Paused after restoring a backup. Tap to resume. Resuming, with a confirmation, merges the records in the cloud back into this book.
From version 1.7.4 the file carries only this phone's current book. When other ZeniCash accounts have been used on the same phone, the books they left set aside on it are not in the backup; restoring a file leaves those books on the phone, and from a file made by an earlier version the other accounts' books it carried are left out.

It is the copy that does not depend on any phone — sync keeps devices consistent, it is not a backup; see Moving to a new phone.

Deleting your account

Settings › Cloud Sync › Delete account. It is refused at once while the account is inside a shared space: Leave the shared space first, then delete the account, so the other members' book is untouched. Otherwise the box says what goes — the ZeniCash account, the data in the cloud and the data on this device — and, with Premium, that the subscription is billed by the store and is cancelled there, not by deleting the account. If the sign-in is not recent, the app asks to sign in again with the same Google or Apple account before anything is deleted; cancelling leaves everything as it was. From version 1.7.4 the deletion also takes the receipt files in the cloud, the list of devices and the invite codes, and the PIN on this phone. It cannot be undone. The account's other phones are told the account was deleted and choose between keeping their data offline and erasing it.

A device that is simply no longer wanted can instead be removed in Cloud Sync › Synced devices: from version 1.7.4 that signs it out, and what is on it stays there.

Questions

Where do my data live?: On the phone. The app works entirely offline. What reaches the cloud reaches it because you switched sync on (Premium) — and then it is stored by Google Firebase, attachments in a data centre in Europe.
I forgot the PIN.: On the lock screen, “Forgot PIN?” › “Use recovery code”, with the code you were given when the PIN was set. If a Google account was signed in when the PIN was created, “Sign in with Google” with that same account also works. Either way the PIN is removed and the app opens; a new one can be set in Settings.
Does deleting my account delete everything?: Yes: the ZeniCash account, the book and the receipt files in the cloud, the list of devices, the invite codes, and the data on the device. It cannot be undone, and it is refused while the account is inside a shared space — leave the space first.
Is the backup free?: Yes, on every plan: Settings › Backup & Restore.
I forgot the password of a backup.: Then that backup cannot be opened: the app keeps no copy of the password and has no way to recover it. A new backup can be made at any time, with a password or without one.

Related guides

Checked against ZeniCash 1.5.0 on 2026-09-10. Where a feature is Premium, it says so.