This policy explains what personal data the Finscious app for Android and the finscious.com website handle, where it goes, and the choices you have. Finscious is a household cash-flow manager: it shows what is left to spend today, what you spent and what is safe to spend, the payments coming up, your entries, monthly reports and your plan. It is not a bank and it never moves money.

Who we are

Finscious is run by Finscious Innovations, a sole proprietorship of Aryan Babar, in India. It is not an incorporated company. Under India's Digital Personal Data Protection Act, 2023, Aryan Babar is the Data Fiduciary for the personal data described here. Contact: support@finscious.com. Grievance Officer: legal@finscious.com.

The short version

Your money data (entries, plan, scheduled payments and entries made from bank messages) lives on your own phone. Finscious cannot read it.
The text of your bank messages, references, account and card numbers, balances, dates and times never leave your phone. Names of people are taken out on your phone before any text is sent; a name written like an ordinary word can be missed, so we do not promise that one never leaves.
To understand or sort a payment, only an amount, a merchant or service name, or text with names, dates and numbers taken out on your phone, go to Google Cloud for AI processing in India. When you speak an entry, the voice clip goes to Google Cloud for speech processing in the United States. Both only if you agreed to the AI notice.
A backup is optional, and goes to your own Google Drive, encrypted.
From app version 1.6.4 (versions 1.6.3 and earlier do not send it), a small activity signal tells us the app is still installed and signed in. Nothing about your money is in it.
There are no ads, no analytics, and we never sell or lend your data.

What stays on your phone

Your money data: your entries, plan, salary details, scheduled and planned payments, cards and cash wallets, and everything worked out from them, such as your daily figure.
Your account details: when you sign in with Google, your name and email address are kept on your phone. They label your account in the app and connect your Google Drive backup. From app version 1.6.4, our account record keeps them too, with the activity signal described below.
Your settings: such as your notification and app lock choices, and your answer to the AI notice.

All of this stays on your phone until you delete it in the app or uninstall Finscious.

What leaves your phone

This is the complete list. Each item is explained in the sections below.

What	Where it goes
An amount, a merchant or service name, or text with names, dates and numbers taken out on your phone, to sort a payment or fill in an entry or a Pay now payment. From app 1.7.0, one recording can hold several entries, and the same kind of text is sent for each	Google Cloud, for AI processing, in India. Only if you agreed to the AI notice.
Your voice as a clip, when you tap the microphone to speak an entry	Google Cloud, for speech processing, in the United States. Only if you agreed to the AI notice.
An encrypted backup, only if you turn backup on	Your own Google Drive, in your Google account.
From app version 1.6.4, the activity signal: a random install id, the platform, the app version, the version code and the kind of event, authorised with your Google sign-in	Finscious, which keeps your account record (your Google account identifier, name and email address) and when the app was used. Hosted on Google Cloud in India. Only after you agreed to this notice in the app.

Never sent to us, to Google Cloud or for AI: the text of a bank message and its sender, the name of your bank, UPI references and transaction ids, account and card numbers, balances, and your entries as a whole. A spoken entry is the one exception to the list above: the clip carries your voice as you said it, so anything you say aloud, such as a date or a name, is in it. Your own data reaches your Google Drive only inside your encrypted backup.

Bank messages

If you allow it, Finscious reads bank transaction messages on your phone as they arrive, only to recognise bank transactions and record them. It does not read your older messages. The text of a message never leaves your phone.

Your phone first tries to place a payment by itself. When it cannot, and only if you have agreed to the AI notice, it sends only the merchant or service name and the amount to Google Cloud for AI processing in India, to choose a category. It does not send the bank's name, the payment method, the date or time, a reference, account digits, your balance or the message text. Money you receive is never sent. You can turn bank message reading off in Settings at any time.

Spoken and typed entries

When you add a payment by speaking or typing, your phone works out what it can by itself. When it needs help, and only if you agreed to the AI notice, it sends only an amount, a merchant or service name, or text with names, dates and numbers taken out on your phone, together with today's date and the app's category names, to Google Cloud for AI processing in India. If your phone cannot take those details out of the text, nothing is sent and the entry is worked out on your phone alone. A spoken entry is then saved for you and a notification shows what was saved, with Undo. If a detail is missing, or notifications are off, the app asks you to complete it before anything is saved. A typed entry is shown for you to check before it is saved. Pay now uses the same step for the amount and reason you say or type.

From app 1.7.0, one recording, or one note typed on the voice screen, can hold several entries. Each is handled on its own, one after another. Undo removes the Finscious record only, not a payment made in your bank or payment app. So that a retry cannot save an entry twice, the list of entries read from a recording is kept on your phone for at most 24 hours, and it is deleted when you sign out, turn off AI help or use Delete my data.

When you tap the microphone and have agreed to the AI notice, your phone records what you say, for at most 30 seconds, and sends the clip to Google Cloud for speech processing in the United States. The words come back to your phone. Finscious does not keep the recording or the words. If your phone is offline, the recording waits on your phone and is sent when you are back online, for at most 24 hours and three tries; after that it is deleted. You can always type instead of speaking. The microphone is used only after you agree to the AI notice and allow it.

Google Cloud acts for us under its service terms. Google does not use what it is sent to train its AI.

Pay now

Pay now records the payment you say you are about to make and then opens the payment app you choose. It does not make the payment, and it passes no amount, payee or note to that app: you pay inside that app, and Finscious never sees the result. To show you the apps you can open, Finscious checks which well-known payment apps are installed on your phone. It does not look at any other app.

You sign in with Google. When the app asks Google Cloud for help, or sends the activity signal, it proves who you are with your Google sign-in, which is checked with Google. For AI help, your Google account identifier is used only to limit how many requests one account can make in an hour; that count is not saved, and the sign-in, your name and your email address are not written anywhere. From app version 1.6.4, your Google account identifier, name and email address are read from it and kept as your account record. The sign-in token itself is never stored.

Activity signal and your account record

So that we know how many people really use Finscious, which versions are in use, and who needs support, the app sends a small activity signal to Finscious. It is hosted on Google Cloud in India. The activity signal starts with app version 1.6.4; versions 1.6.3 and earlier do not send it. The app sends it only after you have agreed to this notice in the app.

What is sent: five things only: a random install id made on your phone, the platform (Android), the app version, the version code and the kind of event. It is authorised with your Google sign-in. Nothing about money, bank messages, amounts, merchants, references, dates of payments or account numbers is ever in it. We do not store your IP address with the signal.

When it is sent: when you open the app or its home-screen button, at most once a day on a phone; from a daily background check, at most once a day and skipped if you opened the app that day; when you sign out; and when you use Delete my data.

What we keep: your account record (your Google account identifier, with your name and email address), and for each phone the install id, app version, platform, the first and last signal, when the app was last opened there, and when it signed out or deleted data; and for each day (India time) with a signal, whether the app was opened or only the daily check reported, and the app version. We also keep an anonymous count of how many accounts were deleted each day, which cannot be linked to you.

Why: to count how many people use Finscious and which versions are in use, to support and fix them, and to tell real people apart from testers and app store reviewers.

Who sees it: the Finscious team. Our owner and finance roles see your name and email with your activity; other roles see totals only. It is not sold, not used for advertising and not shared with anyone else.

How it ends: signing out stops the signal from that phone, and so does uninstalling Finscious. Neither erases the account record. Delete my data in the app schedules your account record and its activity for deletion, and they are erased within 30 days. If your phone cannot reach us at that moment, or you want the record erased without using the app, write to support@finscious.com from your account email address. You can also ask for a copy of your account record and its activity.

Backup

Backup is optional. If you turn it on, an encrypted copy of your data is saved in a hidden app folder in your own Google Drive, and the key that unlocks it is saved in your Google account. Both stay in your Google account. Finscious has no copy and no access to your backup.

Notifications

Notifications are created on your phone from the data on your phone. Finscious does not send you push messages.

The home-screen widget, the optional spending notification and reminder notifications show amounts and payee names on your home screen and lock screen; turn them off in Settings or in Android's notification settings if others can see your phone.

Monthly reports are made on your phone and leave it only when you share one.

Permissions the app asks for

Receive SMS: to see new bank messages as they arrive. Finscious does not read your message history.
Microphone: only while you are recording a payment (at most 30 seconds), and only after you agree to the AI notice.
Notifications, and run at start-up: to show reminders and to set them up again after your phone restarts.
Biometrics or screen lock: only for the optional app lock. Your fingerprint or face is handled by Android; Finscious never receives it.
Internet: for the things described in this policy.

What we do not do

We do not show ads, and we never sell or lend your data or share it for anyone else's purposes.
The app has no analytics or advertising software from anyone else. The only usage information it sends is the activity signal described above.
We do not collect your location, contacts or advertising identifiers, and the app does not ask for camera or location permission.

The website and contacting us

When you visit finscious.com, our hosting providers (Google Cloud and Cloudflare) keep short-lived technical logs, such as your IP address and the time of the visit, to run and protect the site. Google Cloud also keeps, for about a month, technical logs of the app's requests to us (the time, whether a request worked, how long it took and, in Google Cloud's own request log, the IP address), never what a request contained. If you email us, we keep your message and email address to answer you.

Who receives data, and where

Google Cloud receives the text described above for AI processing, in India, and the voice clip for speech processing in the United States. It hosts our account record in India. It acts for us under its service terms.
Google Drive holds your optional encrypted backup, and your Google account holds its key, in your own Google account.
Google sign-in identifies you to the app.
Google Cloud and Cloudflare serve the website and may process website visits outside India.

We do not sell, lend or rent your data to anyone.

Earlier versions of Finscious

Earlier versions of the app sent small pieces of text, or a short voice recording, to Google for AI processing; Finscious kept no copy. Some earlier versions (including GCS Finscious and Pay Smart) also offered features that are no longer in the app. If you created an account with one, we may still hold your name, email address, consent records and settings and, if you used GCS Finscious, the data you kept there, on Google Cloud in India. If you still use an earlier version, it works as the policy for that version (6.0) described until you update or delete it. Write to support@finscious.com from the email address on that account and we will export it for you or delete it.

How long we keep it

Data on your phone stays until you delete it in the app or uninstall Finscious. Your Drive backup stays in your Google account until you delete it in the app or in Google Drive. Google Cloud does not keep what it is sent for us; its technical logs expire within about a month. Your account record and the activity signal are kept while you have an account, and are erased within 30 days after you use Delete my data or ask us. Website logs expire on their own within a short period. Messages you send us are kept as long as needed to answer you and as the law requires. Data from earlier versions is kept until you ask us to delete it, except any record the law requires us to keep, for as long as it requires.

Your rights

See and correct your data: it is on your phone, in the app. For data from earlier versions, write to us.
Erase it: Settings > Delete my data deletes the data on your phone, your Google Drive backup and its key, and, from app version 1.6.4, schedules your account record (your name, email and activity signal) for erasure within 30 days. Uninstalling Finscious also removes the data on your phone. For data from earlier versions, see our deletion page.
Withdraw consent: turn off AI help, bank message reading or backup in Settings, or remove the microphone permission in your phone's settings, as easily as you gave it.
Nominate someone to act for you: email us from your account address.
Raise a grievance: email our Grievance Officer at legal@finscious.com. We acknowledge within 7 days and resolve within 30 days.
If we have not resolved your grievance, you may complain to the Data Protection Board of India.

The app asks for your agreement before AI help and, from app version 1.6.4, before the activity signal. Android asks your permission before the microphone and bank message reading, and backup runs only if you turn it on. Each is separate. You can turn off AI help, bank message reading and backup in Settings and remove the microphone permission in your phone's settings; signing out or Delete my data stops the activity signal. Withdrawing stops that use from then on.

Security

Your money data is encrypted on your phone, and you can lock the app with your phone's screen lock. Everything the app sends over the internet is encrypted in transit. See Security and privacy for our promises to you.

Data breaches

If a breach affects personal data we are responsible for, we will tell you without delay and notify the Data Protection Board of India as the law requires.

Children

Finscious is only for people 18 or older. We do not knowingly hold data of anyone under 18; tell us and we will erase it.

Changes

When this policy changes, we update the date and version above. If a change is significant, we will tell you in the app. The current policy is always in the app under Settings > Legal, and on this page.

Contact

support@finscious.com. Grievance Officer: Aryan Babar, legal@finscious.com.