Privacy Policy

01Summary — privacy at a glance

Tindra is a privacy-first, offline-first personal expense tracker. In plain terms:

• Your financial data never leaves your device except through actions you explicitly start (a CSV/PDF/Excel export you save or share).
• No account, no sign-in, no sign-up. The app works fully, anonymously, offline, from first launch. We never ask for your name, email, or phone number.
• We have no server that stores your financial records. No Aridya server ever receives your transactions, amounts, balances, budgets, accounts, or notifications. The only thing an Aridya server can receive from you is the optional, anonymized contribution described in Section 7 — and only if you turn it on.
• Optional notification capture reads notifications, never SMS or call logs. It is off until you turn it on, and works only for a fixed list of finance apps.
• The only information that can ever leave your device is (a) exchange-rate requests that carry no personal data, (b) optional, anonymous diagnostics that never contain your financial data, (c) only if you opt in, anonymized expense descriptions used to improve automatic categorization — never amounts, balances, or account details, and (d) an install-measurement signal for our own ads, sent to Meta under the same consent rules as diagnostics (Section 8.6) — again with no financial data.
• No ads in the app, and no selling of personal data. The one advertising-related data flow is install measurement for Tindra's own ads on Meta (Section 8.6): an install/app-open event and your device's advertising ID — never anything you entered in the app.

The rest of this policy explains exactly what this means.

02Scope

This policy covers the Tindra Android application distributed through Google Play and its functionally identical builds (development/beta/production share the same package and behavior). It does not cover third-party apps or services you may separately choose to use (for example, the storage location you pick for an export, or the finance apps whose notifications you allow Tindra to read) — those are governed by their own privacy policies.

03Data stored on your device (and not collected by us)

Tindra stores the following only in local, app-private storage on your device (an encrypted-at-rest–capable Room/SQLite database and Android DataStore preferences). This data is not transmitted to Aridya and is not accessible to other apps. We never receive it.

Financial and organizational data you enter or that the app derives locally:

• Profiles (separate ledgers): name, type, icon, color, and — if you enable a per-profile lock — a salted, hashed PIN (never the PIN itself in plaintext) and lock/biometric flags.
• Accounts: name, type (e.g. Cash, Bank, Card, Wallet), currency, opening balance, archive state.
• Categories and tags you create.
• Transactions: amount (stored as integer minor units), currency, direction (income/expense/transfer), date/time, optional note, optional merchant/payee, source, and an optional reference.
• Budgets and budget-alert state.
• Recurring rules and reminders (title, schedule).
• Pending captures (only if you enable notification capture — see Section 6): the raw notification title and text plus fields parsed from them, held only until you confirm or dismiss them, then purged (see Section 9).
• Cached exchange rates, monthly summaries, and other locally computed aggregates.

Settings and preferences (DataStore): your selected theme/accent, base currency, onboarding progress, notification preferences, the currently active profile, and your diagnostics-consent choice.

Because this data stays on your device, you are in control of it: you can view, edit, export, and delete it in the app, and uninstalling the app removes it.

We have deliberately disabled Android's OS-level backup for this app (android:allowBackup="false", plus data-extraction rules that also exclude the app from Android 12+ device-to-device transfer). This means your Tindra data is not silently copied to Google Drive by the operating system and is not restored automatically on reinstall — a reinstall starts clean. The only way your data persists off-device is an export you explicitly save or share.

04Permissions the app requests and why

Tindra never declares and never requests READ_SMS, RECEIVE_SMS, or READ_CALL_LOG. Reading your text messages or call history is not part of this app, by design.

05Information that leaves your device — and it's a short list

Only four categories of information can ever leave your device. None of them includes your amounts, balances, or account details:

• Exchange-rate lookups. To convert amounts into your chosen base currency, the app uses Aridya's in-house exchange-rate service (aridya.com). That request carries no personal or financial data — not even a currency code; the only thing it includes is an access key that is identical in every copy of the app. If our service is unavailable, the app may request rates directly from a public exchange-rate service instead; such a request contains only a currency code (e.g. "USD"). Rates are cached locally so the app works offline.
• Optional anonymous diagnostics (crash reports, performance, and usage analytics) via Google Firebase — described in Section 8, including your consent choices. These never contain your financial data.
• Optional categorization contributions — only if you opt in: anonymized expense descriptions and the categories you chose, used to improve automatic categorization. Described in full in Section 7.
• Install measurement for our ads (Meta) — an install/app-open event and your advertising ID, so we can tell which of our ads lead to installs. Same consent rules as diagnostics; described in Section 8.6.

All network traffic is over HTTPS; cleartext traffic is blocked app-wide. As with any internet request, the server that receives a request can see your device's IP address; for requests to Aridya's own services, our hosting provider keeps it in routine request logs for up to 30 days (Section 9). That is the entire outbound data surface of the app.

06Optional notification capture

To save you from typing every transaction, Tindra can optionally read incoming notifications from a fixed allowlist of finance apps (UPI/bank/payment apps) and pre-fill a draft transaction for you to review.

• It is entirely optional and off by default. You must explicitly grant "Notification access" in Android Settings. The app is fully functional if you never enable it.
• It reads notifications only — via Android's NotificationListenerService — and only from apps on the allowlist. It ignores notifications from every other app. It never reads SMS, MMS, or call logs.
• Everything is processed on-device. The raw notification title/text is stored locally and parsed locally into a draft ("pending capture"). The raw notification text is never transmitted to Aridya or any third party. (If you have opted in to categorization contributions, a capture you confirm is treated like any expense you save: only its cleaned-up merchant name can be contributed — see Section 7.)
• Raw text is short-lived. Once you confirm a draft into a transaction, or dismiss it, the raw captured text is discarded. Unreviewed drafts and their raw text are automatically purged after 14 days.
• You can revoke Notification access at any time in Android Settings, which stops all capture immediately.

07Optional: help improve automatic categorization

Tindra is building a feature that suggests a category for each new expense. You can help train it by contributing anonymized examples. This is entirely optional and off by default: Tindra asks once ("Help Tindra get smarter" — Contribute or Not now), and you can change your mind any time in Settings → Privacy & data → Contribute data. The app works fully without it.

7.1 What is sent

If you opt in, then for each expense you save (entered manually or confirmed from a notification capture — never income), Tindra may send:

• A short description built from the merchant/payee and note of that expense, cleaned up on your device before it is stored or sent: every run of two or more digits is removed (amounts, dates, reference numbers), as are UPI IDs and email-like handles, phone numbers, and account or card fragments (such as "A/c XX1234"); the text is then lower-cased and limited to 200 characters. Our server applies the same clean-up again on arrival.
• The category you chose — one of Tindra's built-in categories, or simply "custom" (the name of a category you created is never sent).
• Whether the expense was entered manually or from a notification capture.
• The hour it was saved (rounded down to the hour, not the exact time).
• Your country, as a two-letter code determined on your device (for example "IN").
• The app version and a random install ID (Section 7.3).
• Once automatic suggestions are available: the category Tindra suggested, how confident it was, and whether you changed it.

When you first turn contributions on, expenses you saved earlier on this device are included as well.

7.2 What is never sent

Amounts, currencies, balances, exact dates or times, account names or numbers, card details, profile names, income entries, raw notification text, your name, email address, or phone number, and device or advertising identifiers are never part of a contribution.

Please note: the description comes from what you type. The automatic clean-up removes numbers and account identifiers, but it cannot reliably remove names — for example, a note like "dinner with Ravi" would be contributed as "dinner with ravi". If you contribute, please avoid putting other people's personal details in your notes.

7.3 The install ID

Contributions from your device are grouped under a random install ID that Tindra creates on your device the first time you agree. It is not derived from, or linked to, your identity, Google account, phone number, Android ID, or advertising ID — we cannot tell who you are from it. It exists so that you can delete everything your device contributed (Section 7.4); after a deletion, the app replaces it with a new one.

7.4 Turning it off and deleting your contributions

• Turn it off — Settings → Privacy & data → Contribute data. Nothing further is sent. Entries already sent stay on our servers until you delete them or they expire (Section 7.5).
• Delete — Settings → Privacy & data → Delete my contributed data erases everything this device ever contributed from our servers. Your transactions and other data on the phone are not affected.
• Before you uninstall: because contributions are tied only to the random install ID stored on your device, please use "Delete my contributed data" first. Once the app is uninstalled we have no way to find which contributions were yours; they are then deleted automatically when they expire.

7.5 Where it is stored, and for how long

• Contributions are stored by Aridya Technologies on Google Cloud (Firestore) in Mumbai, India. The storage allows no public or app access — only Aridya's server-side administrative access.
• Each contribution is kept for at most 24 months from when we receive it, then deleted.
• The categorization model trained from contributions is statistical: it does not contain your individual entries in a form that can be read back.
• Contributions are used only to build and evaluate Tindra's categorization. They are not sold, not shared with third parties, and not used for advertising or to build a profile about you.
• Our hosting provider automatically records the IP address of each request to our servers in routine request logs, together with basic request details; for uploads and deletion requests, these logs also record the install ID. They are kept for up to 30 days, used only for security and troubleshooting, and never used to identify you.

08Diagnostics, Google Firebase, and ad measurement

Tindra uses Google Firebase for anonymous app health and usage diagnostics only. This helps us find crashes and understand which features are used, so we can improve the app. No financial content is ever included.

8.1 What is (and isn't) collected

We may collect, subject to your consent (Section 8.2):

• Crash reports (Firebase Crashlytics): stack traces, device model, OS version, app version, and non-financial breadcrumbs such as screen names.
• Usage analytics (Google Analytics for Firebase): anonymous events such as screen views and feature-used counters, plus general device/app metadata.
• Performance data (Firebase Performance Monitoring): anonymous app start-up and network timing metrics.

We never collect, log, or transmit: transaction amounts, balances, merchant/payee names, notes, account names or numbers, card/IBAN details, references, or notification text. This is enforced in code by a sanitizer that strips any financially-named field before an event is sent, in addition to our rule that such data is never passed to telemetry in the first place.

8.2 Your consent and regional controls

All Firebase data collection (Analytics, Crashlytics, Performance) is disabled by default and is only ever turned on after your consent state has been resolved:

• European Economic Area (EEA), United Kingdom, and Switzerland: diagnostics are off until you explicitly opt in. Nothing is collected and no analytics/messaging identifiers are registered until you make a choice. You can turn diagnostics on or off at any time in Settings → Privacy & data → Share anonymous diagnostics. Turning it off stops collection immediately.
• All other regions: anonymous diagnostics are enabled by default and disclosed (here, and in the app's Privacy & data screen).

The same choice also controls install measurement for our ads (Section 8.6).

Your region is determined on-device (from the SIM/network country or device locale); this determination involves no network call and no identifier leaving your device.

8.3 Advertising identifier

The Google Analytics for Firebase SDK and the Meta SDK declare the Android Advertising ID permission. Tindra contains no advertisements and never uses the advertising ID to show you ads, to build a profile of you, or to share with data brokers. Its only advertising-related use is measuring installs from Tindra's own ad campaigns, via Meta (Section 8.6). Where diagnostics are disabled (by default, and unless/until you opt in in the EEA/UK/Switzerland), it is not used. You can reset or delete your Advertising ID at any time in Android Settings (Privacy → Ads); once deleted, apps can no longer read it.

8.4 Announcements (Firebase Cloud Messaging)

Tindra can receive occasional product announcement push notifications via Firebase Cloud Messaging. This is client-only: the app subscribes to a broadcast "announcements" topic and your device's messaging token is not uploaded to any Aridya server (we have no backend). Pushes carry only non-financial content (news/updates). Like other Firebase functions, messaging is not initialized in the EEA/UK/Switzerland until your consent state is resolved. Announcement pushes are delivered through Android's standard notification system and you can mute them via the app's notification channels or Android Settings.

8.5 Remote configuration

Tindra uses Firebase Remote Config to fetch small, non-personal configuration flags (for example, the current privacy-policy URL). This is download-only; it sends no personal or financial data.

8.6 Install measurement for our ads (Meta)

We advertise Tindra on Meta's platforms (such as Facebook and Instagram). To learn which of our ads lead to installs, the app includes Meta's App Events SDK (its core module only), used solely for install measurement:

• What is sent to Meta: Meta's standard automatic events — the app was installed, and the app was opened — together with your device's advertising ID (if available), the Google Play install referrer, and general device and app information (such as device model, OS version, app version, language, and time zone).
• What is never sent: amounts, balances, transactions, budgets, categories, merchant/payee names, notes, account or profile names, captured notification text, or any of the in-app usage events described in Section 8.1. Tindra logs no custom events to Meta, and automatic in-app-purchase logging is turned off.
• Consent: the same rules as diagnostics (Section 8.2). In the EEA, UK, and Switzerland it stays off until you opt in to diagnostics, and turning diagnostics off turns it off again. Elsewhere it is on by default and disclosed here. Everywhere, you can limit it by deleting or resetting your Advertising ID in Android Settings.
• Nothing runs early: the Meta SDK is not started at all until your consent state has been resolved.
• Who receives it: Meta Platforms, Inc. (and Meta Platforms Ireland Ltd. for users in the EEA/UK/Switzerland), which processes it under its own terms and privacy policy and may use it to measure and improve the delivery of our ads. We receive only aggregated campaign reports that do not identify you.

09Data retention

• Your financial records are retained until you delete them. Tindra never auto-deletes confirmed transactions or other data you entered. You remain in control.
• Raw captured notification text is the sole exception: it is retained only until you review a draft (confirm or dismiss), and unreviewed drafts are purged after 14 days (Section 6).
• Diagnostics collected via Firebase are retained according to Google's Firebase data-retention settings and policies; analytics data is retained for a limited, configurable period and crash data per Firebase defaults.
• Install-measurement data received by Meta (Section 8.6) is retained according to Meta's data policy.
• Categorization contributions (only if you opt in) are kept on our servers for at most 24 months from receipt, then deleted — sooner if you use "Delete my contributed data" (Section 7).
• Server request logs for Aridya's services (IP address and basic request details) are kept for up to 30 days.
• Uninstalling the app removes all locally stored data from your device. Because OS backup is disabled, nothing is left behind in Google's cloud backup.

10Your choices and controls (in the app)

You can exercise the following directly in Tindra, without contacting us:

• Export your data — Settings → Privacy & data → Export my data, and the Import/Export screen, let you export your transactions to CSV/Excel and reports to PDF. These files are saved or shared only where you choose. (This is your data-portability tool.)
• Delete your data — Settings → Privacy & data → Delete all data erases all accounts, transactions, budgets, recurring rules, tags, and custom categories in the current profile (a fresh empty Cash account is kept so the profile stays usable). Deleting a profile removes that profile's ledger. Uninstalling removes everything.
• Diagnostics — turn anonymous diagnostics on/off where offered (Section 8.2); this also controls install measurement for our ads (Section 8.6).
• Notification capture — enable or revoke Notification access at any time (Section 6).
• Categorization contributions — Settings → Privacy & data → Contribute data (on/off) and Delete my contributed data (Section 7).
• Profile lock — set or remove a PIN and/or biometric lock per profile.

11Legal bases for processing (EEA / UK / Switzerland — GDPR & UK GDPR)

Most data you create in Tindra is stored only on your device and is not processed by us, so it does not involve Aridya as a data controller. For the limited processing we do perform, our legal bases under the EU General Data Protection Regulation (GDPR) and UK GDPR are:

India (Digital Personal Data Protection Act, 2023): categorization contributions are processed only on the basis of your consent, which you can withdraw at any time as easily as you gave it (Section 7.4).

We do not carry out profiling or automated decision-making that produces legal or similarly significant effects, and we never use your data to show you ads. The only advertising-related processing is the install measurement for our own campaigns described in Section 8.6.

12Your rights

Depending on where you live (e.g. the EEA/UK under the GDPR, or California under the CCPA/CPRA), you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent at any time.

• Because your Tindra data lives on your device, you can exercise most of these rights directly in the app at any time — view and edit any record, export your data (portability), and delete any or all of it (erasure), as described in Section 10.
• For the limited diagnostics we process via Firebase, you can withdraw consent (EEA/UK/Switzerland) or reset your Advertising ID and, in most regions, request that we help address any diagnostics data associated with your device — contact us using Section 19.
• For categorization contributions, use Delete my contributed data (erasure) and the Contribute data switch (withdrawal of consent) in the app. Because contributions are tied only to a random install ID, we cannot locate them from your name or email address — the in-app controls are the way to reach them.
• We do not sell your personal information. The install-measurement signal sent to Meta (Section 8.6) may be treated as "sharing" for cross-context behavioral advertising under some U.S. state privacy laws. You can opt out at any time by deleting or resetting your Advertising ID in Android Settings, or by contacting us (Section 19).
• If you are in the EEA/UK/Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority.

To make a request, contact us (Section 19). We will respond within the timeframe required by applicable law. We may need to verify that a request genuinely relates to your device/data.

13International data transfers

Aridya does not receive your on-device financial data, so it is not transferred internationally by us. The limited diagnostics processed through Google Firebase, the install-measurement signal received by Meta, and any fallback exchange-rate request to a public exchange-rate service, may be processed on servers located outside your country, including in the United States. Where such transfers involve personal data from the EEA/UK/Switzerland, they rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework) as implemented by those providers. See Google's privacy documentation for details of its safeguards.

Categorization contributions (only if you opt in) and requests to Aridya's exchange-rate service are processed on Google Cloud in India (Mumbai region). If you are outside India, opting in means your contributions are transferred to and stored in India, which may not offer the same level of data protection as your own country.

14Children's privacy

Tindra is intended for a general audience and is not directed to children. We do not knowingly collect personal data from children under the age of 13 (or under 16 where a higher age of digital consent applies, such as in parts of the EEA). If you believe a child has provided personal data in a way that involves us, contact us (Section 19) and we will take appropriate steps.

15Security

We take reasonable and appropriate measures to protect your information:

• On-device by default. Financial data stays in app-private storage; OS auto-backup and device-to-device transfer are disabled for this app.
• Profile lock. Optional per-profile PIN is stored only as a salted hash (PBKDF2-HMAC-SHA256), never in plaintext; optional biometric unlock is handled by the Android system.
• Encrypted transport. All network requests use HTTPS; cleartext traffic is blocked.
• Data minimization. The app's outbound data surface is deliberately tiny, and financial content is structurally excluded from diagnostics.
• Contributions. Optional contributions are cleaned up on the device before they are stored or sent, cleaned again on our server, accepted only from the Tindra app, and stored with no public or app access.

No method of storage or transmission is 100% secure, but we design Tindra to keep your data on your device and under your control.

16Google Play Data safety — summary

This section summarizes how Tindra maps to Google Play's Data safety disclosures. It is provided for transparency; the authoritative disclosure is the Data safety form in the Play listing, which is kept consistent with this policy.

• Data collected by Aridya: none of your amounts, balances, or account data. Only if you opt in: anonymized expense descriptions and the categories you chose, for improving automatic categorization — optional, not shared, deletable in the app (Section 7).
• Diagnostics processed via Google (Firebase), subject to your consent as described: app activity (anonymous usage), app performance (crash logs, diagnostics), and device/other identifiers (including an advertising ID declared by the analytics SDK). Used only for app functionality and analytics — not for advertising, and not sold.
• On-device only, not "collected" in the Play sense: your transactions, accounts, budgets, categories, tags, profiles, reminders, and any captured notification text.
• Shared with Meta, for advertising or marketing (install measurement of our own ads only, subject to the consent rules in Section 8.2): device or other identifiers (the advertising ID) and app interactions (app installed / app opened). No financial data.
• Encryption in transit: yes. User can request deletion: yes, in-app (delete data / uninstall; and "Delete my contributed data" for contributions).
• No data is sold. Apart from the install-measurement signal to Meta described above, no data is used or shared for advertising.

17Third-party services

The third parties that may process limited, non-financial data as described above are:

• Google Firebase (Analytics, Crashlytics, Performance Monitoring, Cloud Messaging, Remote Config) — see Google's Privacy Policy: policies.google.com/privacy and Firebase data-handling documentation.
• Google Cloud (Cloud Functions, Firestore) — hosts Aridya's in-house exchange-rate service and stores optional categorization contributions on our behalf, in India (Sections 5 and 7).
• Public exchange-rate services (used only if our own service is unavailable) — receive only a currency code, no personal data.
• Meta (App Events SDK, core module) — receives the install-measurement signal described in Section 8.6. See Meta's Privacy Policy: facebook.com/privacy/policy.

18Changes to this policy

We may update this policy from time to time (for example, when features change or to meet legal requirements). When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. The current version is always available at the policy URL in the Play listing and in the app (Settings → Privacy & data → Privacy policy). Your continued use of Tindra after an update means you accept the revised policy.

19Contact us

If you have questions, requests, or concerns about this policy or your data, contact:

• Provider / Data controller: Aridya Technologies
• Email: privacy@aridya.com
• Postal address: Doddanekundi, Bangalore, India 560037
• Grievances (India, Digital Personal Data Protection Act, 2023): privacy@aridya.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.

If you are in the EEA, UK, or Switzerland and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection supervisory authority.