Rupya Privacy Policy

Effective date: [DD Month 2026] · Applies to the Rupya Android app, the Rupya web app (installable on iPhone) and the Rupya API.

1. Who we are

Rupya ("Rupya", "we", "us") is a personal finance app operated by [Company legal name], [registered address, India]. We are the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and we follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Information we collect

2.1 Account and profile information (you provide it)

• When you sign in with Google (or Apple): the account identifier, name, email address and profile picture that the provider shares with us. We never receive your Google or Apple password.
• Your savings goal (for example, "Build savings" or "Pay off loan")
• Only if you sign up with a mobile number instead, when that option is available: your mobile number (used for login by one-time password), name, date of birth, gender, profession, monthly income range, work sector and an optional email address

2.2 Bank transaction SMS (Android: only with your permission)

If you choose Import from SMS and grant the SMS permission, the app reads your SMS inbox on your phone. It looks only for messages sent by bank and payment sender IDs (such as AX-HDFCBK) that describe a completed transaction. From those alerts we receive the message text, the sender ID and the time it was received. That covers the amount, debit or credit, merchant or payee, and the masked account or card number the bank includes (for example XX1234).

These messages are filtered out on your phone and never uploaded:

• one-time passwords (OTPs), PINs and verification codes;
• messages from people (any phone number or saved contact);
• promotions, offers and loan advertisements;
• balance enquiries, statements, reminders, due-date notices, payment requests, failed or pending transactions, and any other message that is not a completed transaction.

SMS are read only when you tap Import, never in the background. You can withdraw the permission at any time in Android Settings → Apps → Rupya → Permissions.

2.3 iPhone auto-import (only if you set it up)

iPhones do not let apps read messages. If you create the optional Shortcuts automation, your iPhone sends Rupya each new message containing the words you choose (such as "debited" or "credited"), along with its sender and time. Rupya stores only completed bank transactions. OTPs are detected and discarded immediately, and every other message is ignored. None of them are stored or logged. The automation uses a personal key that you can turn off at any time in the app.

2.4 Bank statements (only when you upload one)

When you upload a statement PDF, it is read in memory to extract its transactions and then discarded. The file is not stored. If the statement is password-protected, the password is used once to open it and is never stored or logged.

2.5 Information created when you use Rupya

• Transactions, the categories you assign, merchant labels, and the summaries, health score and coaching tips we calculate from them
• Messages you send to the AI money coach, and its replies
• Family House: the household you create or join, and your sharing preference
• Subscription and payment records (plan, amount, status, payment reference). Card and UPI details are entered on our payment partner's page and are not received by Rupya.

2.6 Device information

• Device model, app version and operating system
• A push-notification token, so we can send you alerts and coaching tips
• Technical logs (such as IP address, request time and errors) that our servers keep for security and troubleshooting

2.7 What we do not collect

We do not access your contacts, location, photos, camera, microphone, call logs or any SMS other than bank transaction alerts. We do not use advertising identifiers or third-party advertising or analytics SDKs.

3. How we use your information

• To create and secure your account and log you in
• To record your transactions, categorise them and show your spending, savings and trends
• To calculate a goal-based "safe to spend" budget and send coaching tips
• To answer your questions in the AI money coach
• To show your household's combined totals, if you join a Family House
• To process subscriptions and payments
• To prevent fraud and abuse, keep the service secure, and comply with law

We do not sell your personal data, and we do not use it to show you advertising.

4. Who we share it with

We share data only with service providers that process it on our behalf, under contract, for the purposes above:

In a Family House, other members see your monthly income and spending totals. They see your category breakdown only if you turn on detail sharing. Individual transactions are never shown to other members.

We may also disclose information when required by law, a court order or a government authority, or to protect the rights and safety of our users and of Rupya.

5. Where your data is stored

Your data is stored in India: our servers run on Amazon Web Services and our database on Supabase, both in the Mumbai (ap-south-1) region. Data sent to the AI providers listed above may be processed outside India. We transfer data abroad only as permitted under the DPDP Act and use providers that apply strong security safeguards.

6. How long we keep it

• Account, profile and transaction data: while your account is active.
• After you delete your account: removed from our live database immediately, and from backups within [7] days, unless we must keep certain records by law (for example, payment and tax records).
• Statement PDFs and their passwords: not stored.
• OTP messages and non-transaction SMS: never stored.
• Server logs: up to [90] days.

7. How we protect it

• All traffic between the app and our servers is encrypted with HTTPS (TLS).
• Data is encrypted at rest in our database and in its backups, connections to the database are encrypted (TLS), and access is restricted to authorised staff.
• Login sessions use short-lived tokens. The iPhone auto-import key is stored only as a one-way hash, and you can revoke it at any time.
• On Android, OTP and non-transaction filtering happens on your phone before anything is uploaded.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.

8. Your rights and choices

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you
• Correct or update your profile in the app at any time
• Delete your account and data. Use Profile → Delete account in the app, or delete it on the web (sign in with Google) without the app, or email [privacy@your-domain].
• Withdraw consent: turn off SMS permission in Android Settings, turn off iPhone auto-import in the app, or delete your account
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated
• Raise a grievance with our Grievance Officer (section 11). If you are not satisfied with the response, you can complain to the Data Protection Board of India.

We respond to requests within [30] days.

9. Children

Rupya is meant for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

10. Changes to this policy

We will post any changes on this page and update the effective date. If a change is significant, we will also tell you in the app before it takes effect.

11. Contact and Grievance Officer

Grievance Officer: [Full name]
Email: [grievance@your-domain]
Address: [registered address]
General questions: [support@your-domain]