1. Who we are
Rupend is operated by [Company name] Private Limited ("Rupend", "we", "us"), [Registered office address]. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here. Contact: rupend.app@gmail.com.
2. What stays on your phone — never on our server
Rupend reads your payment information and works out your spending on your own phone. The following stays there, encrypted, and is never sent to our server:
- your transactions, amounts and account balances;
- the bank, card and UPI alert messages Rupend reads (Android), or that your Apple Shortcut passes to it (iPhone);
- merchants, UPI IDs and the categories you choose.
This data is encrypted on your phone. The encryption key is created on your phone, kept in its secure key storage (Android Keystore or Apple Keychain), and never leaves the phone or goes into a backup. Rupend data is excluded from Android backups. On iPhone, an encrypted copy may be included in your iCloud backup; it cannot be read without the key.
On Android, Rupend reads only messages from banks, card issuers and UPI apps about payments. Personal messages and one-time passwords are ignored. You can switch SMS reading off in Accounts.
3. What our server keeps, and why
Our servers are in Mumbai, India.
| Data | Why we keep it |
|---|---|
| Email address; when you signed up and last signed in | To create your account and let you sign in with a one-time code |
| App settings (for example, your Day's End time) | So your settings return if you change phones |
| Subscription status, plan and renewal date | To give you access to what you paid for |
| Payments and refunds reported by Google Play or the App Store: amount, currency, date and the country of your store account | To run our accounts and count subscribers; we never see your card or UPI details |
| Your email choices, and a record of when you gave or changed them and which notice you saw | To send only the emails you agreed to, and to prove we asked |
| Records of the bank-link consents you approve (bank name, last 4 digits, status, validity) — not your statements | To manage your Account Aggregator consents |
| Your state and city — only if you choose to tell us | To count users by area and decide where to promote Rupend. Rupend never uses your phone's location or GPS and has no location permission. |
Only Rupend's owner can see this data, through a private dashboard protected by a secret key, and in a daily summary email sent to Rupend's own inbox.
4. Consent
We process your personal data on the basis of your consent, given when you create an account after seeing this notice, and for the purposes listed above. Optional choices — product-update emails and your state and city — are off unless you turn them on. You can withdraw consent any time by changing the setting in the app or by deleting your account; this does not affect processing done before you withdrew it.
5. Emails we send
- Sign-in codes — a one-time code each time you sign in.
- One feedback request if you cancel — about 3 days after you cancel a subscription, with at most one reminder 4 days later, and never more than once in 180 days. Not sent if a payment simply failed or you resubscribed. Every one has an unsubscribe link, and you can turn it off in Accounts → Emails from Rupend.
- Product updates — only if you ticked the box at sign-up or turn them on in the app.
We never send advertising for other companies, and we never sell or share your email address.
6. Who helps us run Rupend
We use a small number of service providers, who process data only on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Hosts our database and sign-in | Mumbai, India |
| Google Play / Apple App Store | Take your subscription payment | Their own terms apply |
| RevenueCat | Keeps your subscription status in step with the store, using your Rupend user ID — not your name or spending | United States |
| Google (Gmail) | Delivers our emails, including sign-in codes | Global |
| Licensed Account Aggregators | Carry the bank data you consent to share, directly to your phone's Rupend app | India |
7. How long we keep it
- Your account data is kept while you have an account and erased when you delete it.
- When you delete your account we keep only: an anonymous count that an account was deleted (date and plan), the reason you chose to give (if any), and payment records needed for our accounts and tax law with your email and user ID removed. None of these can be linked back to you.
8. Your rights
Under the DPDP Act you can:
- See your data — Accounts → What Rupend knows about you shows everything on our server, live, and lets you save a copy;
- Correct or update it — in the app, or by writing to us;
- Erase it — Accounts → Your account → Delete my account, or see how to delete your account;
- Withdraw consent — as described in section 4;
- Nominate someone to exercise these rights if you die or become unable to — write to us;
- Raise a grievance with our Grievance Officer (section 11). If you are not satisfied with our response, you may complain to the Data Protection Board of India.
9. Security
Spending data is encrypted on your phone with AES-256-GCM, with keys kept in the phone's secure hardware storage. Rupend can be locked with your fingerprint, face or phone PIN. On our server, every table is protected so that each signed-in person can reach only their own records, and data travels only over encrypted connections. No system is perfectly secure; if a breach affecting your personal data occurs, we will inform you and the Data Protection Board as the law requires.
10. Children
Rupend is for people aged 18 and over. We do not knowingly create accounts for children. If you believe a child has created an account, write to us and we will delete it.
11. Grievance Officer and contact
[Grievance Officer name], Grievance Officer, [Company name] Private Limited, [Registered office address]. Email: rupend.app@gmail.com. We acknowledge grievances within 24 hours and aim to resolve them within 15 days. More ways to reach us are on the Contact page.
12. Changes
If we change this policy in a way that affects you, we will tell you in the app before the change applies, and ask for your consent again where the law requires it. The version date is at the top of this page.