Privacy Policy

1. Introduction

MyPaisa ("the App") is a personal finance management application developed for individual use in India. This Privacy Policy explains how the App handles information on your device. Because MyPaisa is designed as an entirely offline-first app, the principles here are simpler than most: your data does not leave your phone.

By installing or using MyPaisa you agree to the practices described in this policy. If you do not agree, please uninstall the App.

2. Information the App Accesses

MyPaisa requests the following Android permissions. All data accessed through these permissions is processed entirely on your device.

3. How Your Data is Stored

All financial information you enter — accounts, transactions, investments, budgets, loans, bills — is stored in a local SQLite database on your device. This database is encrypted using SQLCipher (AES-256) with a unique encryption key generated on your device and secured inside the Android KeyStore. Neither the data nor the encryption key ever leaves your phone.

Your PIN is never stored in plain text. It is hashed using SHA-256 with a fixed application-level salt before being saved to Android DataStore Preferences. The App cannot recover your original PIN.

Retention: your data remains on your device until you uninstall the App or manually delete records within it. Uninstalling the App removes all locally stored data.

4. What We Do Not Collect

MyPaisa does not:

• Collect or transmit your name, email address, phone number, Aadhaar, PAN, or any other personally identifiable information.
• Upload your financial transactions, account balances, investments, or any financial data to external servers.
• Use advertising SDKs (e.g., Google AdMob, Meta Audience Network) or display advertisements.
• Integrate analytics SDKs that profile your behaviour (e.g., Firebase Analytics, Mixpanel, Amplitude).
• Share any information with third parties for marketing or commercial purposes.
• Track your location.
• Access your contacts, camera, microphone, or files.

5. Network Requests

The App makes outbound network requests for the sole purpose of fetching publicly available market prices:

• Mutual Fund NAV — queried from api.mfapi.in using only the publicly registered AMFI scheme code of a fund you have added. No account balances or unit counts are sent.
• Stock Prices — queried from Yahoo Finance's public quote API using only the NSE/BSE ticker symbol you enter. No holding quantity or cost basis is sent.

All network communication uses HTTPS (TLS) exclusively. Plaintext HTTP traffic is blocked by the App's network security configuration.

These third-party services have their own privacy policies independent of MyPaisa.

6. SMS Access — Detailed Explanation

Because READ_SMS and RECEIVE_SMS are considered sensitive permissions by Google Play, we explain exactly how the App uses them:

• The App listens for incoming SMS messages from a pre-defined list of known Indian bank sender IDs (e.g., VM-ICICIB, AD-HDFCBK, BP-SBICRD). Messages from other senders are ignored.
• Matching messages are parsed on-device using regular expressions to extract: transaction type (credit/debit), amount, and the last four digits of the account/card number.
• The extracted data is stored locally in the encrypted database as a pending transaction for your review.
• The full text of SMS messages is never stored — only the extracted structured fields are retained.
• SMS data is never transmitted to any server, third party, or remote service.
• OTP messages are explicitly detected and discarded without processing.

The permission is used in accordance with Google Play's SMS and Call Log Permissions policy. You may deny this permission; doing so simply means you will need to enter transactions manually.

7. Security Measures

MyPaisa implements multiple layers of security appropriate for a financial application:

• AES-256 encrypted database (SQLCipher) with a hardware-backed key stored in the Android KeyStore.
• PIN authentication with SHA-256 hashing; brute-force protection with exponential back-off delays and a hard lock after 10 consecutive failures.
• Biometric authentication via Android's BiometricPrompt API — raw biometric data is never accessible to the App.
• HTTPS-only networking enforced through Android's Network Security Configuration.
• ProGuard/R8 code obfuscation in release builds to resist reverse-engineering.
• App screenshot prevention in the Android task switcher.
• No cloud backup of sensitive files.

While we have taken reasonable precautions to protect your data, no security system is infallible. We recommend keeping your device PIN/password enabled and keeping the App up to date.

8. Children's Privacy

MyPaisa is not intended for use by children under the age of 18. We do not knowingly collect any information from minors. If you believe a minor has used this App, please contact us at the address below and we will provide guidance on removing locally stored data.

9. Your Rights Under Indian Law

MyPaisa complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 (including the IT (Reasonable Security Practices and Procedures) Rules, 2011).

Because all data is stored exclusively on your own device and we do not collect or process your personal data on any server, most data-subject rights (access, correction, portability, erasure) are exercised directly by you within the App or by uninstalling it. Specifically:

• Right to access — all your data is visible within the App at all times.
• Right to correct — you can edit any record directly in the App.
• Right to erasure — delete individual records in the App, or uninstall the App to remove all data.
• Right to data portability — a future version of the App may include an export feature; in the meantime your data can be queried via the local database.

If you have any questions about exercising these rights, please contact us using the details in Section 11.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page and release an updated version of the App. Your continued use of the App after an update constitutes acceptance of the revised policy. Material changes will be highlighted in the App's release notes on Google Play.