Privacy Policy

Effective August 15, 2026 · Applies to the PaisaVault Android app

Summary

By default, PaisaVault stores everything only on your device. There is no PaisaVault server or account - the app does not collect, transmit, or sell your data to anyone. Android's automatic app-data backup is explicitly turned off, so nothing about the app is silently backed up anywhere on its own. Every feature that does send data anywhere is optional and only activates when you deliberately turn it on.

What's stored, and where

Your transactions, accounts, categories, budgets, goals, investment holdings, lending records, and settings are kept in your device's local storage (IndexedDB, inside the app's own sandboxed storage) and never transmitted anywhere unless you take one of the optional actions described below.

Your app-lock PIN or password is hashed (PBKDF2-SHA256, 150,000 iterations) with a random salt unique to your device before being stored - never in plain text - and is deliberately excluded from every backup, whether local, Google Drive, or Dropbox. Biometric unlock, if you turn it on, uses your device's own operating system; PaisaVault never sees or stores any fingerprint or face data itself.

Budget alerts and reminder notifications are scheduled entirely on-device - there is no push notification service or server involved in delivering them.

Optional features that involve another party

Sign in with Google (Settings → Profile, optional) uses Google's own sign-in. PaisaVault receives your email address and display name, and never sees your Google password. Signing in alone does not upload any of your financial data.

Google Drive Backup (requires Google sign-in) uploads a copy of your data to a "PaisaVault" folder in your own Google Drive, only when you tap Back Up Now or turn on Auto Backup (daily, weekly, or monthly - your choice). PaisaVault can only see and manage files it created itself in your Drive (Google's restricted drive.file permission scope) - nothing else in your Drive is ever visible to this app. You can optionally protect a backup with a passphrase; if set, the file is encrypted (AES-256-GCM) before upload and unreadable to anyone, including Google, without that passphrase.

Sign in with Dropbox and Dropbox Backup (optional, independent of Google/Drive) work the same way - PaisaVault only ever creates and manages one file inside its own dedicated app folder in your Dropbox (Dropbox's "App folder" permission scope), never anything else in your Dropbox. Same optional passphrase protection, same Auto Backup choice. You can use Drive, Dropbox, both, or neither - they don't depend on each other.

Offline Backup (optional, needs no sign-in) writes a copy of your data to a "PaisaVault" folder inside your device's own Documents folder. Nothing is sent anywhere - it's purely a second copy on the same device (or an SD card, if that's where your device's Documents folder lives).

Sync with Family sends your data directly to another device you choose, over your local Wi-Fi network only - never through the internet or any server. It only happens when you start it, requires both devices to enter the same passphrase, and everything sent is encrypted with that passphrase before it leaves your device.

What we don't do

• We don't run analytics, tracking, or advertising SDKs of any kind.
• We don't sell or share your data with third parties.
• We don't collect your data on a server - there isn't one.
• The only ways data ever leave your device over a network are actions you explicitly take: backing up to Google Drive or Dropbox, syncing with another of your own devices over local Wi-Fi, or sharing a transaction/report yourself.

Permissions the app uses

• Internet - only used when you actively back up to Drive/Dropbox or the app checks for those services; never used in the background to send your data anywhere.
• Camera - only used for scanning a QR code during Sync with Family device pairing.
• Storage (legacy Android versions only) - used to save exports and Offline Backup files to your device's own Downloads/Documents folders.

Children's privacy

PaisaVault is a general-audience personal finance tool and is not directed at children under 13. We do not knowingly collect information from children.

Data deletion

Since your data lives only on your device, you can delete all of it at any time from within the app (Settings → Security, or by uninstalling the app). If you've backed up to Google Drive or Dropbox, deleting the backup file from that service (or disconnecting the linked account) removes it from there too - PaisaVault has no separate copy to delete on its end, because it never had one.

Changes to this policy

If this policy changes, the "Effective" date at the top of this page will be updated. Meaningful changes will also be reflected in the in-app Privacy Policy (Settings → Privacy Policy).