PaiYo is an Android app made by AdRaw App Studio. This policy explains what the app reads, where that data is kept, how it is protected, and what leaves your phone.
What the app reads
With your permission, PaiYo reads SMS messages on your phone, and (only if you connect Gmail) emails in your own mailbox, to find alerts from banks and businesses that mention an amount. Personal messages are skipped. One-time-password messages are never stored.
Where your data is kept
Transactions, budgets, bills, accounts and settings are stored only on your phone, in the app's private storage and in an encrypted database (see below). Your transactions and messages are never sent to the developer or anyone else. PaiYo has no server, no user accounts, no analytics and no advertising.
How your data is protected
Encrypted database. The app's database is encrypted with AES-256 (SQLCipher). Its key is 32 random bytes made on your phone and wrapped by a key in Android's hardware-backed Keystore, which can't be copied off the phone. Someone who copies the app's files without that phone can't read them.
Alert text kept for 30 days. The full text of each bank alert is kept for 30 days, so it can be re-read if a rule changes or reported if it was read wrongly. After that the text is deleted; the transaction it produced (amount, date, merchant, account and category) stays.
Passphrase-encrypted backups. Backups, whether to Google Drive or to a file, are encrypted on your phone before they are saved, with a passphrase you choose (at least 8 characters). The encryption is AES-256-GCM with a key derived from your passphrase using PBKDF2-SHA256 with 600,000 iterations. The passphrase is never sent anywhere. Without it a backup can't be opened by Google, the developer or anyone else; if you forget it, the backup can't be restored. Automatic daily backups pause until a passphrase is set.
App lock. If you turn it on, the app asks for your fingerprint, face or screen lock when it opens and after a minute in the background, and its screens are hidden from the recent-apps view and from screenshots.
New SMS senders. Payment alerts from an SMS sender the app doesn't recognise as a bank are held until you choose to count them, because a sender name can be faked.
Connections. The app connects only over HTTPS and trusts only your phone's built-in certificate authorities.
Crash reports
If the app crashes, a crash report is sent to the developer through Firebase Crashlytics, a Google service. It contains the error and where in the app it happened, the last few screens you opened, your phone model, Android version, app version, a random report ID created by the app, and identifiers Firebase assigns to the installation. It never contains your transactions, messages, account numbers, contacts or your name. Google keeps crash reports for 90 days. You can turn this off in Settings → About → "Send crash reports".
What leaves your phone, only if you turn it on
Gmail. If you choose Sign in with Google, PaiYo asks Google for read-only access to your Gmail (gmail.readonly). It searches only for emails from bank and card senders and reads those messages on your phone to extract the amount, date, merchant and account. It keeps the resulting transactions, and the alert's text for 30 days as described above, in the app's encrypted storage. It never sends, changes, deletes or labels email, and email content is never sent to the developer or any server. Google sign-in is handled by Google Play services; the app never sees your Google password and keeps no long-lived token. You can remove access in the app (Settings → Gmail alerts → Disconnect) or at myaccount.google.com/connections.
As an advanced alternative you can instead give the app a Gmail app password; it is stored encrypted on your phone and used only to read bank alerts over IMAP.
Google Drive backup. Backups are encrypted on your phone with a passphrase you choose, and then uploaded to a "PaiYo backups" folder in your own Google Drive. Without the passphrase they can't be read, by Google or anyone else; if you forget it, they can't be restored. The app uses the drive.file permission, so it can see and change only the files it created, not the rest of your Drive. Google sign-in is handled by Google Play services; the app never sees your Google password.
Google Sheet. If you set it up, transactions are sent to a Google Sheet and script that you own.
Fund prices. Mutual fund and NPS prices are downloaded from public sources (AMFI and npsnav.in). None of your data is sent with these requests.
Use of Google user data
PaiYo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Gmail data is used only to show you your own transactions, budgets and bills inside the app.
- Drive access is used only to store and restore your own encrypted backups.
- Google user data is not transferred to anyone, except to your own Google Drive and Google Sheet when you turn those features on.
- Google user data is not used for advertising, is not sold, and is not used to train AI or machine-learning models.
- No person reads your Google user data, unless you send it yourself (for example with "Report this format") or the law requires it.
Sharing
PaiYo does not sell or share your data. Crash reports are processed by Google (Firebase) on the developer's behalf. When you choose "Report this format" or "Send feedback", the app opens your phone's share sheet with the text (account numbers and references blanked out, plus your app version, phone model, Android version and report ID so the problem can be looked into); you decide whether and to whom to send it.
Removing your data
Uninstalling the app deletes everything it stored on your phone. Backups in your Drive and rows in your Sheet stay until you delete them. You can disconnect Drive in the app or at myaccount.google.com/permissions.
Children
PaiYo is not directed at children under 18.
Changes and contact
If this policy changes, the new version will be posted on this page with a new date. Questions: app.paiyo@thevoltdesk.in