Income trackers that do not ask for a bank login
You can track income without connecting a bank account, and for income specifically the manual version is often the better tool — not just the safer one. An income tracker needs about five facts from you, they change a few times a year, and typing them takes fifteen minutes. That is a small price for not handing your banking credentials to a third party.
What a bank-linked app is actually asking for
Two mechanisms are common, and they have different risk shapes. It is worth knowing which one you are being asked for.
Aggregator links. The app connects through a data aggregator that sits between it and your bank. In some markets this runs on official open-banking APIs with a token you can revoke; in others it still works by storing your online banking username and password and logging in as you. The distinction matters enormously and is almost never made visible in the signup flow. A revocable read-only token is a reasonable thing to grant. A stored password that can do anything you can do is not the same thing at all, and the screen looks identical.
Even the good version grants a standing right to read your full transaction history — every merchant, every amount, every date, often going back years. That is a detailed record of where you go, what you buy, who you pay, and when your habits changed. Ask what the app does with it beyond showing it to you, and whether the aggregator sells anonymised or de-identified data. "De-identified" transaction data is famously easy to re-identify.
SMS reading. Some apps parse bank notification texts instead. On Android this needs the SMS read permission, which is not scoped to your bank — it is every message on the phone. Two-factor codes, password resets, medical appointments, personal conversations. Google restricts this permission and requires a declared core use, but the permission itself remains all-or-nothing: you cannot grant "only messages from my bank". If parsing happens on a server rather than on the device, your messages are leaving the phone.
There is also a plain reliability problem. Parsers break when a bank changes its message wording, and they misread transfers between your own accounts as income. People discover this months later, when the totals stop making sense.
When manual entry is the better trade — and when it is not
The argument for automatic import is real: nobody wants to log 200 coffee purchases a month by hand. That argument is about expenses. Income does not have that shape.
Manual entry is the better trade when:
- You are tracking income, not spending. Four or five sources, changing a few times a year. The entire data set fits on one screen.
- You want to know what you have earned, not what has landed. An automatic feed can only see deposits. It cannot know that you are two weeks into a month you have already worked. A manual tracker that stores a rate can, because it knows the rate rather than waiting for the payment.
- Your income does not all pass through one account. Cash tips, a platform wallet, a foreign client paying into a second account — the aggregator sees a partial picture and quietly reports it as the whole picture.
- You want a number you understand. When you type it, you know what it means. Auto-categorised feeds produce totals nobody can quite explain, and an unexplainable number does not change behaviour.
Be honest about the other direction too. If you genuinely need every transaction categorised, if your income is hundreds of small irregular payments, or if you know you will not open an app to type anything, automatic import earns its risk. The trade only looks obvious for the case where the data is small and slow-changing — which income is.
What "stays on your device" actually means
Local-only storage is worth choosing, but it is worth understanding what you are choosing, because the marketing version of it skips the second half.
What you get:
- No account, so no password to be leaked in someone else's breach.
- No server holding your salary and no operator who can be compelled to hand it over.
- The app works with no network at all. You can leave it permanently offline and it loses nothing.
- Uninstalling actually deletes the data instead of leaving a copy somewhere you cannot see.
What you take on:
- Backup is yours. There is no server-side copy to restore from. If the phone is lost, stolen, dropped in water, or factory reset, the records are gone unless you exported a file.
- There is no sync. Two devices means two separate sets of records.
- There is no support recovery. Nobody can restore your data for you, because nobody else ever had it.
Android's own auto-backup helps but is not a plan. It is capped in size, can be switched off, may not fire before the phone dies, and is tied to the Google account — which is a cloud copy, if that was the thing you were avoiding. Treat it as a bonus, not as your backup.
Keeping your records when you change phones
The whole cost of local-only storage is concentrated in one habit. Build it and the downside mostly disappears.
- Export the moment setup is done. Not later. The first export is the one people skip and then regret, because it is also the one that proves export and restore actually work.
- Put the file somewhere that is not the phone. The Android file picker will happily save into Drive, Dropbox, or a folder that syncs to your computer. An export sitting in the phone's Downloads folder dies with the phone.
- Name it with the date.
inflowly-2026-03-14.json. When you need it you will want the most recent one, and you will not remember which that was. - Re-export when something changes. A new source, a raise, a client ending. Quarterly is fine for most people; the point is that the file is never more than a few months stale.
- Export before you migrate, and restore before you wipe the old phone. In that order. Confirm the numbers are right on the new device while the old one is still sitting there with the original data.
- Do not rely on the phone-to-phone transfer tool. Android's transfer covers many apps but not reliably all app data, and you find out which after the old phone is wiped.
One thing worth checking before you commit to any local-only app: open an export file and look at it. If it is readable JSON or CSV, your data is yours in a real sense — you can reconstruct it in a spreadsheet even if the app disappears from the store. If the export is an opaque blob only that app can read, you are locked in differently but you are still locked in.
Inflowly
Inflowly has no bank connection, no SMS permission, and no account. Every income source is entered by you and stored on the device; nothing is uploaded, which also means there is nothing to sync and nothing for anyone to request. Backup is an export-and-restore file through the standard Android file picker, so you choose where the file goes — Drive, another folder, a computer. Currency is a display setting rather than a live conversion, so the app has no reason to talk to a server at all. It is free and carries ads, but not on the income entry screen and not in the widget.