1. Introduction

Vyaya ("we", "our", or "us") is a personal finance tracking application. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application.

2. Information We Collect

Information you provide:

Name and email address (for account creation)
Financial data including transactions, accounts, budgets, and debts
Profile photo (optional)
Feedback on AI advisor answers (optional) — your rating, an optional comment, and the question and answer it refers to
Issue reports and feedback you send from the app (optional) — your message, with your name and email so we can reply

Information collected automatically:

The days you open the app and how often, your app version and your phone's operating-system version
The state of your app settings — notification permission, daily reminders, Auto-Capture, Add automatically and balance lock — so we can support you and understand which features are used
Your approximate location (city, state and country), recorded once, the first time you use the app, from your internet connection. We do not use GPS, and we do not store your IP address.
App usage statistics via Firebase Analytics — the screens you open, session length, and a few actions (that you exported or imported data and how many rows, how you rated an advisor answer, which announcement you opened), never amounts, merchant names, account names or email addresses
Reminder settings, if you enable reminders: your chosen reminder times, your device's timezone, whether daily reminders are on, a device identifier and a push notification token — stored on our servers so reminders and our announcements can be delivered (see section 9)
Announcements: which of our announcement notifications you opened
Invites: if you joined with a friend's invite link or code, which friend invited you. To make sure each invited friend is a different person on a different phone, we record an identifier for your phone — stored only in a scrambled one-way form (a hash) that cannot be turned back into the identifier

Stored only on your device, never transmitted to us:

Bank transaction alerts captured by the optional Auto-Capture feature, if you enable it (see section 5)
Your recent conversation with the financial advisor, kept for 24 hours so you can pick it up again
Your SIM's country, read on the phone only to suggest your currency when you first set up the app
The figures shown on the Quick add home-screen widget, if you place it (hidden while balance lock is on)

3. Camera, Photos and Microphone

Vyaya does not ask for camera permission: to scan a receipt it opens your phone's own camera app, and you can also pick a photo from your gallery or share one into Vyaya from another app. Usually only the text read from the photo is sent to our AI provider (see section 4). If the app can read almost no text from it, the photo itself is sent to our AI provider (OpenAI) to read instead. Receipt photos are not stored by Vyaya.

Microphone permission is used only when you tap the microphone to speak a question to the financial advisor. Your phone's speech-recognition service (on most phones, Google's) turns the speech into text and may process the audio on its own servers; Vyaya receives only the text, which is sent like a typed question.

4. On-Device Data Processing

Before any receipt data is sent to our AI provider, the app performs on-device text recognition (OCR). Sensitive information including phone numbers, UPI IDs, bank account numbers, IFSC codes, email addresses, GST numbers, and transaction reference numbers are automatically stripped from the text. Only the remaining cleaned text is sent to our AI provider (OpenAI) — with any message the sending app attached to a shared receipt, and the names of your categories and accounts so it can suggest where the expense belongs. It returns the amount, merchant, date and a suggested category and account for you to check before saving. When almost no text can be read, the photo is sent instead (see section 3).

5. Notification Access and Auto-Capture (Android)

Auto-Capture Transactions is optional, Android-only, and OFF by default. It is enabled only after you consent inside the app and separately grant Notification access in your Android settings.

WHAT IS READ

Android delivers every posted notification to any app holding Notification access. Vyaya inspects each notification's title and text in memory, on your device, purely to apply a filter. A notification is retained only if it contains a currency amount, a money-movement word (such as debited, credited or paid), and identifies a bank you have added as an account in Vyaya. Notifications failing any of these tests — personal messages, chats, one-time passwords, promotions, and alerts from banks you do not track — are discarded at once and are never stored. Notifications from common chat and email apps (such as WhatsApp, Telegram, Signal, Messenger, Instagram, Slack, Gmail and Outlook) are not examined at all.

WHAT IS STORED, AND WHERE

For a retained bank alert only, the app keeps what it needs to offer you the transaction: the amount, whether money went out or came in, the payee, the account it matched and the time. The notification's own wording — its title and text — is not kept. These details are written to the app's private storage on your device, limited to the 100 most recent alerts waiting for you, and removed once you have added or dismissed the alert. A list of your account names is also kept on the device so an alert can be matched to the correct account. Signing out or deleting your account clears what is stored.

WHAT IS TRANSMITTED

Notification content is parsed entirely on your device by the app itself. Its text is never sent to our servers, never sent to our AI providers, never shared with third parties, and never used to train any model. To suggest a category, the app may look up the payee's name among your own earlier transactions in your account; that lookup saves nothing. A payment is saved to your account only when you add it — with Add on the alert itself, or in the app — or, if you switch on Add automatically, when the app saves a recognised payment for you (each one can be undone) while anything uncertain still waits for your review. It is saved as transaction details, never as notification text.

HOW TO TURN IT OFF

Switch Auto-Capture off in Vyaya settings, or revoke Notification access in your Android settings. Either stops all capture immediately; alerts already waiting stay until you add or dismiss them, sign out or uninstall. Uninstalling the app removes the locally stored capture data.

6. How We Use Your Information

To provide and maintain the app's features
To store your financial data securely via Supabase
To process receipts (their cleaned text, or the photo when no text can be read) and your advisor questions via AI for transaction parsing and financial guidance — an advisor question is sent with a summary of your finances (month totals, budgets, accounts and cards, debts, loans, savings goals, recurring payments and top merchants) and, when the question needs them, the matching transactions
To suggest transactions from bank notification alerts on your device, if you enable Auto-Capture (processed on your device only, never transmitted)
To send reminder notifications at your chosen times and occasional announcements about Vyaya, delivered through Firebase Cloud Messaging (you can turn notifications off in the app or in your phone's settings)
To understand which screens and features are used, through usage statistics that are not linked to your name or email
To see how many people use the app, which features they use, and roughly where our users are (city and country level) — so we know what to improve, where to make the app available, and which in-app notices, announcements and emails are relevant in your country
To show in-app notices about new features, and to avoid showing you one again after you have tried or closed it
To run invites: count the friends who joined with your link or code and unlock Goals when enough have joined. The friend who invited you sees your first name and last initial, and whether you have added your first transaction — never your amounts or anything else you record
To reply to your issue reports and feedback, and to email you: service emails (such as a welcome message, notices about your account or data, and policy or service changes) and occasional news about Vyaya — reply "unsubscribe" to a news email, or write to us, and we will stop sending them

7. Data Storage and Security

Your financial data is stored securely on Supabase servers with Row Level Security (RLS) — no other user can access your data. We access account data only to run and support the service, for example to answer a support request
We never sell your personal data to third parties

8. Biometric Security

If you enable biometric lock, authentication is handled entirely by your device's secure enclave. No biometric data is collected, stored, or transmitted by the app.

9. Third-Party Services

Our app integrates with:

Supabase — database and authentication (supabase.com/privacy)
OpenAI — AI provider for receipt scanning and the financial advisor chat. Cleaned receipt text (or the photo when no text can be read), your advisor questions and the financial summary needed to answer them are sent for processing. Under OpenAI's API terms this data is not used to train its models, and it may be kept for up to 30 days to detect abuse before it is deleted (openai.com/policies)
Cloudflare — runs the service that connects the app to our AI providers and sends reminders. Requests pass through it, and it determines your approximate location from your connection; your IP address is not stored (cloudflare.com/privacypolicy)
Firebase (Google) — Cloud Messaging, which delivers your reminders and our announcements to your device using a push token, and Analytics, which receives usage statistics (screens, session length and a few actions; never amounts, merchant names, account names or email addresses) (firebase.google.com/support/privacy)
Google — Sign-In, if you choose to sign in with Google; Gmail, which sends our emails; Google Sheets, where issue reports and feedback you send from the app are stored so we can reply; and Google Play, which tells the app which invite link it was installed from (policies.google.com/privacy)

Notification content captured by Auto-Capture is not shared with any third party, including the providers listed above.

10. Your Rights

You can at any time:

Access and export your data from the app
Delete your account and all associated data
Disable notifications from app settings
Turn off Auto-Capture, or revoke Notification access in your device settings
Remove your profile photo

11. Data Retention

Upon account deletion, all your data is permanently removed from our servers within 30 days. If you do not open Vyaya for 3 months, your financial data — transactions, accounts and balances, budgets, savings goals, recurring payments, debts, loans, import history and advisor feedback — is permanently removed. We email you at your account address 30 days before, and again a week before, and send a notification to your phone; opening the app once before the date in that email keeps everything. Your account itself (name, email, sign-in) stays, so you can sign in and start again. Locally stored data (preferences) is cleared immediately. The reminder settings and push token registered for a device are deleted when you sign out on that device, and with your account. Your app-usage records, device settings, approximate location, advisor feedback, invite records and the scrambled phone identifier are deleted with your account. Issue reports and feedback you sent are kept so we can follow up — email us to have them deleted. Captured notification details are stored only on your device, limited to the 100 most recent waiting for review, removed once you add or dismiss them, cleared when you sign out or delete your account, and removed entirely when you uninstall the app.

12. Children's Privacy

Vyaya is not intended for anyone under 18 years of age, and we do not knowingly collect data from them. If you believe someone under 18 has an account, write to us and we will delete it.

13. Changes to This Policy

We may update this policy. We will notify you of changes by updating the date at the top of this policy.

14. Contact Us

For privacy questions, contact us at:

support.vyaya@gmail.com