Privacy Policy

01Summary — privacy at a glance

Tindra is a privacy-first, offline-first personal expense tracker. In plain terms:

• Your financial data never leaves your device except through actions you explicitly start (a CSV/PDF/Excel export you save or share).
• No account, no sign-in, no sign-up. The app works fully, anonymously, offline, from first launch. We never ask for your name, email, or phone number.
• We do not have a server that stores your money data. There is no Aridya backend that receives your transactions, balances, budgets, or notifications.
• Optional notification capture reads notifications, never SMS or call logs. It is off until you turn it on, and works only for a fixed list of finance apps.
• The only information that can ever leave your device is (a) an anonymous currency code sent to a public exchange-rate service, and (b) optional, anonymous diagnostics that never contain your financial data.
• No ads. No selling or sharing of personal data. No cross-app tracking for advertising.

The rest of this policy explains exactly what this means.

02Scope

This policy covers the Tindra Android application distributed through Google Play and its functionally identical builds (development/beta/production share the same package and behavior). It does not cover third-party apps or services you may separately choose to use (for example, the storage location you pick for an export, or the finance apps whose notifications you allow Tindra to read) — those are governed by their own privacy policies.

03Data stored on your device (and not collected by us)

Tindra stores the following only in local, app-private storage on your device (an encrypted-at-rest–capable Room/SQLite database and Android DataStore preferences). This data is not transmitted to Aridya and is not accessible to other apps. We never receive it.

Financial and organizational data you enter or that the app derives locally:

• Profiles (separate ledgers): name, type, icon, color, and — if you enable a per-profile lock — a salted, hashed PIN (never the PIN itself in plaintext) and lock/biometric flags.
• Accounts: name, type (e.g. Cash, Bank, Card, Wallet), currency, opening balance, archive state.
• Categories and tags you create.
• Transactions: amount (stored as integer minor units), currency, direction (income/expense/transfer), date/time, optional note, optional merchant/payee, source, and an optional reference.
• Budgets and budget-alert state.
• Recurring rules and reminders (title, schedule).
• Pending captures (only if you enable notification capture — see Section 6): the raw notification title and text plus fields parsed from them, held only until you confirm or dismiss them, then purged (see Section 8).
• Cached exchange rates, monthly summaries, and other locally computed aggregates.

Settings and preferences (DataStore): your selected theme/accent, base currency, onboarding progress, notification preferences, the currently active profile, and your diagnostics-consent choice.

Because this data stays on your device, you are in control of it: you can view, edit, export, and delete it in the app, and uninstalling the app removes it.

We have deliberately disabled Android's OS-level backup for this app (android:allowBackup="false", plus data-extraction rules that also exclude the app from Android 12+ device-to-device transfer). This means your Tindra data is not silently copied to Google Drive by the operating system and is not restored automatically on reinstall — a reinstall starts clean. The only way your data persists off-device is an export you explicitly save or share.

04Permissions the app requests and why

Tindra never declares and never requests READ_SMS, RECEIVE_SMS, or READ_CALL_LOG. Reading your text messages or call history is not part of this app, by design.

05Information that leaves your device — and it's a very short list

Only two categories of information can ever leave your device, and neither includes your financial records:

• Exchange-rate lookups. To convert amounts into your chosen base currency, the app requests public reference rates from Frankfurter (https://api.frankfurter.dev), which serves European Central Bank reference rates. The request contains only a currency code (e.g. "USD", "EUR"). It contains no amounts, accounts, merchants, notes, identifiers, or any personal data. Rates are cached locally so the app works offline. All network traffic is over HTTPS; cleartext traffic is blocked app-wide.
• Optional anonymous diagnostics (crash reports, performance, and usage analytics) via Google Firebase — described in detail in Section 7, including your consent choices. These never contain your financial data.

That is the entire outbound data surface of the app.

06Optional notification capture

To save you from typing every transaction, Tindra can optionally read incoming notifications from a fixed allowlist of finance apps (UPI/bank/payment apps) and pre-fill a draft transaction for you to review.

• It is entirely optional and off by default. You must explicitly grant "Notification access" in Android Settings. The app is fully functional if you never enable it.
• It reads notifications only — via Android's NotificationListenerService — and only from apps on the allowlist. It ignores notifications from every other app. It never reads SMS, MMS, or call logs.
• Everything is processed on-device. The raw notification title/text is stored locally and parsed locally into a draft ("pending capture"). Nothing about a notification is transmitted to Aridya or any third party.
• Raw text is short-lived. Once you confirm a draft into a transaction, or dismiss it, the raw captured text is discarded. Unreviewed drafts and their raw text are automatically purged after 14 days.
• You can revoke Notification access at any time in Android Settings, which stops all capture immediately.

07Diagnostics and Google Firebase

Tindra uses Google Firebase for anonymous app health and usage diagnostics only. This helps us find crashes and understand which features are used, so we can improve the app. No financial content is ever included.

7.1 What is (and isn't) collected

We may collect, subject to your consent (Section 7.2):

• Crash reports (Firebase Crashlytics): stack traces, device model, OS version, app version, and non-financial breadcrumbs such as screen names.
• Usage analytics (Google Analytics for Firebase): anonymous events such as screen views and feature-used counters, plus general device/app metadata.
• Performance data (Firebase Performance Monitoring): anonymous app start-up and network timing metrics.

We never collect, log, or transmit: transaction amounts, balances, merchant/payee names, notes, account names or numbers, card/IBAN details, references, or notification text. This is enforced in code by a sanitizer that strips any financially-named field before an event is sent, in addition to our rule that such data is never passed to telemetry in the first place.

7.2 Your consent and regional controls

All Firebase data collection (Analytics, Crashlytics, Performance) is disabled by default and is only ever turned on after your consent state has been resolved:

• European Economic Area (EEA), United Kingdom, and Switzerland: diagnostics are off until you explicitly opt in. Nothing is collected and no analytics/messaging identifiers are registered until you make a choice. You can turn diagnostics on or off at any time in Settings → Privacy & data → Share anonymous diagnostics. Turning it off stops collection immediately.
• All other regions: anonymous diagnostics are enabled by default and disclosed (here, and in the app's Privacy & data screen).

Your region is determined on-device (from the SIM/network country or device locale); this determination involves no network call and no identifier leaving your device.

7.3 Advertising identifier

The Google Analytics for Firebase SDK declares the Android Advertising ID permission. Tindra contains no advertisements, does not use the advertising ID for advertising, ad measurement, or cross-app tracking, and does not share it with data brokers. Where analytics is disabled (by default, and unless/until you opt in in the EEA/UK/Switzerland), it is not used. You can reset or delete your Advertising ID at any time in Android Settings.

7.4 Announcements (Firebase Cloud Messaging)

Tindra can receive occasional product announcement push notifications via Firebase Cloud Messaging. This is client-only: the app subscribes to a broadcast "announcements" topic and your device's messaging token is not uploaded to any Aridya server (we have no backend). Pushes carry only non-financial content (news/updates). Like other Firebase functions, messaging is not initialized in the EEA/UK/Switzerland until your consent state is resolved. Announcement pushes are delivered through Android's standard notification system and you can mute them via the app's notification channels or Android Settings.

7.5 Remote configuration

Tindra uses Firebase Remote Config to fetch small, non-personal configuration flags (for example, the current privacy-policy URL). This is download-only; it sends no personal or financial data.

08Data retention

• Your financial records are retained until you delete them. Tindra never auto-deletes confirmed transactions or other data you entered. You remain in control.
• Raw captured notification text is the sole exception: it is retained only until you review a draft (confirm or dismiss), and unreviewed drafts are purged after 14 days (Section 6).
• Diagnostics collected via Firebase are retained according to Google's Firebase data-retention settings and policies; analytics data is retained for a limited, configurable period and crash data per Firebase defaults.
• Uninstalling the app removes all locally stored data from your device. Because OS backup is disabled, nothing is left behind in Google's cloud backup.

09Your choices and controls (in the app)

You can exercise the following directly in Tindra, without contacting us:

• Export your data — Settings → Privacy & data → Export my data, and the Import/Export screen, let you export your transactions to CSV/Excel and reports to PDF. These files are saved or shared only where you choose. (This is your data-portability tool.)
• Delete your data — Settings → Privacy & data → Delete all data erases all accounts, transactions, budgets, recurring rules, tags, and custom categories in the current profile (a fresh empty Cash account is kept so the profile stays usable). Deleting a profile removes that profile's ledger. Uninstalling removes everything.
• Diagnostics — turn anonymous diagnostics on/off where offered (Section 7.2).
• Notification capture — enable or revoke Notification access at any time (Section 6).
• Profile lock — set or remove a PIN and/or biometric lock per profile.

10Legal bases for processing (EEA / UK / Switzerland — GDPR & UK GDPR)

Most data you create in Tindra is stored only on your device and is not processed by us, so it does not involve Aridya as a data controller. For the limited processing we do perform, our legal bases under the EU General Data Protection Regulation (GDPR) and UK GDPR are:

We do not carry out profiling or automated decision-making that produces legal or similarly significant effects, and we do not use your data for advertising.

11Your rights

Depending on where you live (e.g. the EEA/UK under the GDPR, or California under the CCPA/CPRA), you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent at any time.

• Because your Tindra data lives on your device, you can exercise most of these rights directly in the app at any time — view and edit any record, export your data (portability), and delete any or all of it (erasure), as described in Section 9.
• For the limited diagnostics we process via Firebase, you can withdraw consent (EEA/UK/Switzerland) or reset your Advertising ID and, in most regions, request that we help address any diagnostics data associated with your device — contact us using Section 18.
• We do not sell or share your personal information for money or for cross-context behavioral advertising, as those terms are used under U.S. state privacy laws.
• If you are in the EEA/UK/Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority.

To make a request, contact us (Section 18). We will respond within the timeframe required by applicable law. We may need to verify that a request genuinely relates to your device/data.

12International data transfers

Aridya does not receive your on-device financial data, so it is not transferred internationally by us. The limited diagnostics processed through Google Firebase, and any exchange-rate request to Frankfurter, may be processed on servers located outside your country, including in the United States. Where such transfers involve personal data from the EEA/UK/Switzerland, they rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework) as implemented by those providers. See Google's privacy documentation for details of its safeguards.

13Children's privacy

Tindra is intended for a general audience and is not directed to children. We do not knowingly collect personal data from children under the age of 13 (or under 16 where a higher age of digital consent applies, such as in parts of the EEA). If you believe a child has provided personal data in a way that involves us, contact us (Section 18) and we will take appropriate steps.

14Security

We take reasonable and appropriate measures to protect your information:

• On-device by default. Financial data stays in app-private storage; OS auto-backup and device-to-device transfer are disabled for this app.
• Profile lock. Optional per-profile PIN is stored only as a salted hash (PBKDF2-HMAC-SHA256), never in plaintext; optional biometric unlock is handled by the Android system.
• Encrypted transport. All network requests use HTTPS; cleartext traffic is blocked.
• Data minimization. The app's outbound data surface is deliberately tiny, and financial content is structurally excluded from diagnostics.

No method of storage or transmission is 100% secure, but we design Tindra to keep your data on your device and under your control.

15Google Play Data safety — summary

This section summarizes how Tindra maps to Google Play's Data safety disclosures. It is provided for transparency; the authoritative disclosure is the Data safety form in the Play listing, which is kept consistent with this policy.

• Data collected/shared with Aridya: none of your financial data. We operate no server that receives it.
• Diagnostics processed via Google (Firebase), subject to your consent as described: app activity (anonymous usage), app performance (crash logs, diagnostics), and device/other identifiers (including an advertising ID declared by the analytics SDK). Used only for app functionality and analytics — not for advertising, and not sold.
• On-device only, not "collected" in the Play sense: your transactions, accounts, budgets, categories, tags, profiles, reminders, and any captured notification text.
• Encryption in transit: yes. User can request deletion: yes, in-app (delete data / uninstall).
• No data is sold. No data is used or shared for advertising or cross-app tracking.

16Third-party services

The third parties that may process limited, non-financial data as described above are:

• Google Firebase (Analytics, Crashlytics, Performance Monitoring, Cloud Messaging, Remote Config) — see Google's Privacy Policy: policies.google.com/privacy and Firebase data-handling documentation.
• Frankfurter exchange-rate service — receives only a currency code, no personal data.

17Changes to this policy

We may update this policy from time to time (for example, when features change or to meet legal requirements). When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. The current version is always available at the policy URL in the Play listing and in the app (Settings → Privacy & data → Privacy policy). Your continued use of Tindra after an update means you accept the revised policy.

18Contact us

If you have questions, requests, or concerns about this policy or your data, contact:

• Provider / Data controller: Aridya Technologies
• Email: privacy@aridya.com
• Postal address: Doddanekundi, Bangalore, India 560037

If you are in the EEA, UK, or Switzerland and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection supervisory authority.