One finance model. Two permission boundaries.

Public and private Android flavors share the financial-control product. Only the trusted-tester private build includes opt-in capture of new incoming bank SMS messages.

Public

Play-safe by construction.

App ID com.musab.niqdah.
No RECEIVE_SMS or READ_SMS permission.
No incoming SMS receiver.
No notification-listener or accessibility capture.
Manual bank-message paste and email-text paste remain available.
Automated forwarding uses a private address, not mailbox access.

Private

Explicit, opt-in new-SMS capture.

App ID com.musab.niqdah.private.
RECEIVE_SMS can react only to new incoming messages.
No READ_SMS historical inbox scan.
User selects allowed bank senders and can deny or revoke permission.
Captured messages create pending drafts for review, never automatic transactions.
Distribution is limited to trusted testers.

An APK label is not a privacy guarantee.

The enforceable boundary is in each flavor’s manifest, source set, receiver registration, permission behavior, and automated tests.

Testing options Privacy model