1. Introduction

Vyaya ("we", "our", or "us") is a personal finance tracking application. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application.

2. Information We Collect

Information you provide:

Name and email address (for account creation)
Financial data including transactions, accounts, budgets, and debts
Profile photo (optional)

Information collected automatically:

App usage data for improving user experience
Device information (model, OS version)
Biometric authentication status (stored locally, never transmitted)
App usage statistics via Firebase Analytics — screen views and session length only, never amounts, merchant names, account names or email addresses
Reminder settings, if you enable reminders: your chosen reminder times, your device's timezone, whether daily reminders are on, a device identifier and a push notification token — stored on our servers so reminders can be delivered (see section 9)

Stored only on your device, never transmitted to us:

Bank transaction alerts captured by the optional Auto-Capture feature, if you enable it (see section 5)

3. Camera and Photo Access

We request camera access solely for scanning receipts to auto-fill transaction details. Receipt images are processed by Vyaya's AI providers (OpenAI, Google) and are not retained by Vyaya or its providers after processing.

4. On-Device Data Processing

Before any receipt data is sent to our AI providers, the app performs on-device text recognition (OCR). Sensitive information including phone numbers, UPI IDs, bank account numbers, IFSC codes, email addresses, GST numbers, and transaction reference numbers are automatically stripped from the text. Only sanitized, non-sensitive transaction details (amount, merchant name, date) are sent to the AI provider.

5. Notification Access and Auto-Capture (Android)

Auto-Capture Transactions is optional, Android-only, and OFF by default. It is enabled only after you consent inside the app and separately grant Notification access in your Android settings.

WHAT IS READ

Android delivers every posted notification to any app holding Notification access. Vyaya inspects each notification's title and text in memory, on your device, purely to apply a filter. A notification is retained only if it contains a currency amount, a money-movement word (such as debited, credited or paid), and identifies a bank you have added as an account in Vyaya. Notifications failing any of these tests — personal messages, chats, one-time passwords, promotions, and alerts from banks you do not track — are discarded at once and are never stored.

WHAT IS STORED, AND WHERE

For a retained bank alert only, the app saves the notification title (up to 300 characters), its text (up to 1,000 characters), the sending app's package name, and the time it arrived. This is written to the app's private storage on your device, limited to the 200 most recent alerts, and cleared once the alert has been reviewed. A list of your account names is also kept on the device so an alert can be matched to the correct account.

WHAT IS TRANSMITTED

Nothing. Notification content is parsed entirely on your device by the app itself. It is never sent to our servers, never sent to our AI providers, never shared with third parties, and never used to train any model. Only a transaction you review and confirm is saved to your account, and it is saved as the transaction details you approved — not as notification text.

HOW TO TURN IT OFF

Switch Auto-Capture off in Vyaya settings, or revoke Notification access in your Android settings. Either stops all capture immediately. Uninstalling the app removes the locally stored capture data.

6. How We Use Your Information

To provide and maintain the app's features
To store your financial data securely via Supabase
To process receipt images and advisor chat messages via AI for transaction parsing and financial guidance
To suggest transactions from bank notification alerts on your device, if you enable Auto-Capture (processed on your device only, never transmitted)
To send reminder notifications at your chosen times, delivered through Firebase Cloud Messaging (optional, can be disabled)
To understand which screens are used, through anonymous usage statistics

7. Data Storage and Security

Your financial data is stored securely on Supabase servers with Row Level Security (RLS) — only you can access your data
We never sell your personal data to third parties

8. Biometric Security

If you enable biometric lock, authentication is handled entirely by your device's secure enclave. No biometric data is collected, stored, or transmitted by the app.

9. Third-Party Services

Our app integrates with:

Supabase — database and authentication (supabase.com/privacy)
OpenAI / Google — AI provider services for receipt scanning and financial advisor chat. Receipt images and chat messages are transmitted to these providers for processing and are not retained after processing.
Firebase (Google) — Cloud Messaging, which delivers your reminder notifications to your device using a push token, and Analytics, which receives anonymous usage statistics (screen views and session length; never amounts, merchant names, account names or email addresses) (firebase.google.com/support/privacy)

Notification content captured by Auto-Capture is not shared with any third party, including the providers listed above.

10. Your Rights

You can at any time:

Access and export your data from the app
Delete your account and all associated data
Disable notifications from app settings
Turn off Auto-Capture, or revoke Notification access in your device settings
Remove your profile photo

11. Data Retention

Upon account deletion, all your data is permanently removed from our servers within 30 days. Locally stored data (preferences) is cleared immediately. The reminder settings and push token registered for a device are deleted when you sign out on that device, and with your account. Captured notification alerts are stored only on your device, limited to the 200 most recent, cleared once reviewed, and removed entirely when you uninstall the app.

12. Children's Privacy

Vyaya is not intended for users under 13 years of age.

13. Changes to This Policy

We may update this policy. We will notify you of changes by updating the date at the top of this policy.

14. Contact Us

For privacy questions, contact us at:

support.vyaya@gmail.com