Privacy Policy – RupeeRail

Effective Date: August 19, 2026

RupeeRail (“we”, “our”, “us”) provides personal finance tracking and insights with a privacy-first approach.

1) Data We Collect

• Account info: phone number (for OTP login), optional name/profile details
• Financial app data: budgets, debts, savings goals, preferences
• SMS-derived transaction data (only if SMS permission is granted)

2) SMS Permission Usage

RupeeRail's core feature is automatic transaction tracking from bank SMS alerts. With SMS permission granted, the app scans messages only from a fixed allowlist of recognized bank sender IDs (e.g. HDFC, ICICI, SBI, Axis, and other major Indian banks) to detect debit/credit alerts and extract the amount, merchant, and category. Messages from any other sender — personal texts, OTPs unrelated to bank transactions, marketing SMS — are never read or processed.

All parsing happens on-device. Raw SMS content is never transmitted to our servers, sold, or used for advertising. You can revoke SMS permission at any time via Android Settings → Apps → RupeeRail → Permissions; the app continues to work with manual transaction entry if you do.

3) Microphone Permission Usage

RupeeRail requests microphone access solely to enable optional voice input when adding expenses manually (the "Quick Add" expense sheet). Audio is processed entirely on-device using Android's built-in speech recognition API and is never recorded, stored, or transmitted to our servers. Granting microphone permission is optional — the app functions fully without it.

4) Storage & Backup

• By default, app data is stored locally on your device.
• If you enable Cloud Backup, data is encrypted on-device before upload.
• Supabase stores encrypted backup blobs (ciphertext), not readable plain transaction records.
• Restore requires OTP login and your backup PIN.

5) How We Use Data

We use data only to provide app features:

• transaction tracking