DEV Community

daniel zheng
daniel zheng

Posted on

Designing Android expense drafts from NotificationListenerService without bank login

#android #privacy #productivity #fintech

Disclosure: I build Money Tracker (Android: Money Tracker-Expense & Budget; iOS: Money Tracker:Expense & Budget). I write as daniel zheng. This is a product/engineering note about a privacy-constrained draft pipeline — not a growth hack, not fake savings %, and not a claim of official bank partnerships.

Most expense apps tip toward one of two extremes: (1) open banking / account sync, or (2) pure manual entry that users abandon after three days. Money Tracker sits on a third path: local capture → draft → user confirm → ledger. No bank password. No silent statement pull.

On Android, one optional Premium path feeds that pipeline from NotificationListenerService: when another app posts a notification that looks like a payment, we propose a draft. The ledger stays empty until the person taps confirm.

Why notification drafts (and why not open banking)

Users already get “Paid ¥/₹/$…” banners from wallets and banks. Ignoring that signal wastes a moment when intent is freshest. Pulling full bank credentials “for convenience” is a different product — and a different threat model.

Constraints we keep explicit in product copy and UI:

  • No bank login / no account linking.
  • Notification text is a proposal, never an auto-write to history.
  • Users can blacklist apps.
  • iOS has no equivalent listener path; typing, voice, and receipt photo cover that platform.
  • The feature sits behind Premium on Android; free path still has voice AI + receipt OCR with the same confirm gate.

Pipeline (high level)

  1. Listener receives a notification from a package the user has not blacklisted.
  2. Heuristics / light parsing extract candidate amount, merchant-ish text, timestamp.
  3. We surface a draft card (or prompt), not a saved transaction.
  4. User edits category / note / amount if needed → Confirm → only then insert into local store.
  5. If they dismiss, nothing hits the ledger.

Failure modes we treat as expected, not edge cases: top-ups looking like spends, refunds, multi-currency strings, OCR-like OCR mistakes when the “source” is already OCR’d by another app. That is why confirm is load-bearing, not cosmetic.

Privacy posture for engineers

  • Prefer on-device processing where feasible; do not ship bank passwords through your expense app.
  • Treat notification payloads as sensitive: minimize retention of raw text after draft creation / reject.
  • Make revoke obvious: toggle off listener + blacklist.
  • Document Freemium honestly: ads on free; Premium removes ads / loosens AI quotas / unlocks bill import / app lock / Android smart notifications — whatever your store listing actually ships.

Who this design is for

Builders who want Android capture without becoming a mini-bank aggregator. Users who accept “AI or notification may be wrong; I confirm.” Skip if your ICP requires licensed multi-bank sync as the default path.

CTA

Product site (EN hub; locale paths for regional copy):

https://money.quhou123.com/?utm_source=devto&utm_medium=article&utm_campaign=offsite_w1

Android & iPhone; free with ads; optional yearly Premium; no bank login required. No Play Store deep link in this post.

Author: daniel zheng — indie developer of Money Tracker. Wallet/bank names in user-facing soft posts are daily habits, not official auto-integration claims.

Top comments (0)