Privacy Policy

1. Who we are

Penny Pulse is a personal finance app for Android, published on Google Play by Penny Pulse ("we", "us"). This policy explains how the Penny Pulse app handles your information.

For any privacy question or request, write to privacy@pennypulse.co.in.

2. Data the app handles

Penny Pulse is local-first. Everything you enter is stored in a database on your phone, and the app works fully offline. The table below lists what the app stores and why. None of it is sent to us.

We use this data only to provide the app's features to you, on your phone. We do not use it for advertising, profiling or any other purpose.

3. What we don't collect

We, the developer, do not collect, receive, store, sell or share any personal data from Penny Pulse. Specifically, the app does not:

• require an account, email address or phone number;
• read your SMS, emails, contacts, photos, location or call logs;
• connect to your bank accounts;
• include advertising, analytics or crash-reporting SDKs;
• use your advertising ID or track you across apps or websites.

Google Play may give us aggregated, non-identifying statistics such as install counts, ratings and app stability (crash rates). Google collects these under its own privacy policy, and they never include the financial information you enter in Penny Pulse.

4. Google Drive backup (optional)

Backup is off by default. If you choose to turn it on in Settings:

• You sign in with your Google account, and the app asks only for the Drive app-data permission (drive.appdata). This lets Penny Pulse use a hidden folder in your Drive reserved for the app. It cannot see, open or change any of your other Drive files.
• Before anything leaves your phone, the backup is encrypted on the device (AES-GCM) with a key derived from a passphrase you choose. We never see your passphrase or your key.
• Apart from the backup's date, a random device ID created by the app and a version number, nothing about the backup is readable in Drive.
• The encrypted backup goes straight from your phone to your Google Drive. It never passes through any server of ours.
• Backups run when you tap "Back up now" and automatically once a day while the toggle is on. Only the most recent few backups are kept; older ones are deleted automatically.

Important: if you forget your backup passphrase, the backup cannot be decrypted by you, by us, or by anyone else. Keep it somewhere safe.

Penny Pulse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The app uses Drive access only to store and restore your own backup.

Your use of Google Sign-In and Google Drive is also covered by Google's Privacy Policy. Google may store your Drive data on servers outside India.

To stop backing up, turn the toggle off in Settings. The app's Android device backup (Auto Backup) is switched off for your financial data, so it is not copied into Google's device backups.

5. Device permissions

Penny Pulse asks only for the permissions it needs:

6. How your data is protected

• Data on your phone is kept in the app's private storage, which other apps cannot read. Modern Android devices also encrypt this storage.
• App lock lets you require a PIN or biometric unlock to open Penny Pulse, and lets you hide the app's content in the recent-apps screen.
• Backups are encrypted on your phone before upload and are sent to Google Drive over an encrypted (HTTPS) connection.
• Because we hold no copy of your data, there is no central database of Penny Pulse users that could be breached.

No method of storage is perfectly secure. Keeping your phone's screen lock enabled and your software up to date adds important protection.

7. Retention and deletion

Your data stays on your phone until you delete it. You can delete it at any time:

• Delete all my data (in Settings) permanently erases everything in the app after you confirm. The app also offers to delete your Drive backups.
• Uninstalling the app, or clearing its storage in Android settings, removes all data on the phone.
• Drive backups can also be removed from Google Drive on the web: Settings → Manage apps → Penny Pulse → Options → Delete hidden app data.

There is no account to close, and we have no copy of your data to delete on our side.

8. Your rights

Under India's Digital Personal Data Protection Act, 2023, and other laws that may apply to you, you have rights over your personal data. With Penny Pulse, you exercise them directly in the app:

• Access and portability: view everything in the app, and export it as JSON or CSV from Settings.
• Correction: edit any record, account or profile detail at any time.
• Erasure: delete individual records, or use "Delete all my data".
• Withdraw consent: turn off Google Drive backup at any time. This is as easy as turning it on.
• Grievance redressal: contact us using the details in section 12. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

9. Third-party services

Penny Pulse uses only Google services, and only when you turn on backup:

• Google Sign-In, to connect your Google account for backup;
• Google Drive API, to store your encrypted backup in your own Drive.

We do not sell, rent or share your data with anyone, and we have no data to share.

10. Children

Penny Pulse is intended for people aged 18 and over and is not directed at children. Because we don't collect personal data, we don't knowingly collect data from anyone, including children.

11. Changes to this policy

If we add features that change how data is handled, such as a feature that sends data off your phone, we will update this policy before that feature is released, change the date at the top, and tell you in the app. Any new feature of that kind will be optional and will ask for your consent first.

12. Contact and grievances

For questions, requests or complaints about privacy, contact:

Penny Pulse
Email: privacy@pennypulse.co.in
Website: pennypulse.co.in

We aim to reply within 7 days, and will resolve grievances within the time required by applicable law.