Privacy Policy — FinSor

Effective date: 12-May-2026 Last updated: 29-Oct-2026

This Privacy Policy explains how Thulirr Technologies LLP ("we", "us", "our") handles your information when you use the FinSor mobile application ("FinSor", "the App") and the backend services that power it.

FinSor is a privacy-first personal finance application for the Indian market. The defining principle of FinSor's design is that your financial data lives on your device, not on our servers. This policy exists to tell you exactly what that means, what we do receive, and what we don't.

If anything in this policy is unclear, write to us at saithulirr@gmail.com before installing the App.

1 · Who we are

• Operator: Thulirr Technologies LLP
• Contact (privacy): saithulirr@gmail.com
• Grievance Officer (per the DPDP Act 2023 and the IT Rules 2011): Akila Dhanasekaran

We are a data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for the limited personal data we collect (see §3). We are not a data fiduciary for the financial data you store inside the App, because that data does not leave your device under normal operation.

2 · Plain-English summary

We never sell, rent, or trade your personal data to anyone, and we never use your financial data for advertising — not on the free plan, not ever.

If you want the full version with every nuance, read on.

3 · Information we collect

3.1 · Account information you give us

• Email address — used only to identify your account and to contact you for service notifications (e.g. payment receipts, security notices).
• Password — never stored as you typed it. We hash your password with bcrypt (cost factor 12) and store only the hash. We cannot recover your original password; if you forget it, you reset it.
• Subscription tier — whether your account is on the free or paid plan, and (for paid accounts) the renewal date. The free plan is ad-supported (see §3.5); the paid plan is ad-free. The purchase itself is handled by the app store and our subscription manager RevenueCat — see §4.6. We never see your card / UPI / wallet details.

3.2 · Usage counters

For quota enforcement on the free tier, we count:

• The number of documents you uploaded for extraction in the current calendar month
• The number of FinSor analyses you requested in the current calendar month

These counters reset on the first day of each month. They are not linked to specific documents or specific content — only the count.

For FinSor Plus subscribers, we additionally store a single timestamp indicating when the most recent monthly report email was sent. This is used only to avoid duplicate sends and to drive a single push-notification reminder if no report has gone out by the 5th of the new month. See §4.7.

3.3 · Device and diagnostic information

We collect crash reports (anonymized stack traces from the App) through Firebase Crashlytics (Google LLC). Crash reports are scrubbed of personally identifiable information before transmission — we explicitly strip email addresses, passwords, transaction descriptions, amounts, account numbers, and any other content from your financial documents before the report is sent.

If you allow notifications, the App registers a push notification token with us through Firebase Cloud Messaging (Google LLC). This token is an opaque routing string issued by your device's operating system — it carries no financial data and no document content, and is used only to deliver the notifications described in §4.7 and §4.10 (e.g. that a long-running extraction has finished, a monthly-report reminder, or that support has replied to your issue). The token is stored on your account row and is wiped when you sign out, revoke notification permission, or delete your account.

We (Thulirr) do not collect, on our own servers:

• Your location
• Your contact list
• Your photo library
• Advertising identifiers (IDFA / GAID) — but note that on the free plan the Google AdMob SDK on your device may access this identifier to serve ads; see §3.5
• Any analytics that profile you across sessions

3.5 · Advertising (free plan only)

The free plan is supported by ads served through Google AdMob (Google LLC). Ads appear in a few places in the App, such as the statement-processing screen and the home screen.

• No financial data is ever used for ads. Your transactions, balances, account numbers, document contents, and categories are never shared with AdMob or any ad network. They never leave your device for this or any other purpose.
• To display and frequency-cap ads, the AdMob SDK running on your device may access your device's advertising identifier (IDFA on iOS, GAID on Android) and basic technical data (device type, OS, coarse region, IP-derived country). This is collected by Google, not by us — we do not receive or store it.
• We configure AdMob to request non-personalized ads only, which limits the data Google uses for ad targeting.
• On iOS, ads are shown without app-tracking-transparency tracking unless you separately grant permission.
• The paid plan is entirely ad-free — no AdMob SDK calls are made for subscribers.

Google's handling of ad data is governed by the Google Ads / AdMob policies and Google Privacy Policy. You can reset or limit your advertising identifier in your device settings at any time.

3.4 · What we never collect

Apart from what you choose to send us for processing (§4 — always in memory only) and what you choose to send through Help & support (§4.10), we have no record of and no access to:

• Your transactions, balances, account numbers, or any financial detail
• The contents of any document you upload
• Names of your banks, employers, payees, or counterparties
• Your real name (unless you choose to put it in your email address)
• Your phone number, address, or date of birth
• Your biometric data (Face ID / fingerprint authentication happens entirely on your device)
• Email message content, attachments, or OAuth tokens for connected email accounts — these are processed and stored only on your device (see §4.5)

3.6 · Anonymous rule contributions

To improve categorization accuracy for everyone, FinSor can contribute the matching rules you create — and only those rules — to our backend in an anonymous, aggregated form. This is the only category of on-device data, besides the account and usage information above, that we ever receive.

• What is shared: the text patterns of the rules you author yourself — your categorization rules (e.g. "a description containing SWIGGY → Food") and your email-import rules (sender domains and subject keywords you add to find statements). We share the rule content only.
• What is never shared: your transactions, balances, account numbers, statement contents, the names of your banks or payees, your identity, or anything that could link a rule back to you. The built-in default rules and any rule we already received are not re-sent.
• How it is anonymised: the rule text carries no user id. To recognise when many different people independently created the same rule (the signal that a pattern is generic and worth adding to the defaults), our server derives a one-way, irreversible token from your account id. This token lets us count distinct contributors without recording who they are — and it cannot be turned back into your identity.
• How it is used: a rule only ever becomes a candidate for the shared default library once a threshold number of distinct people have created it (k-anonymity). An administrator reviews candidates before any becomes a default. Promoted defaults then flow back to all devices to improve out-of-the-box categorization.
• Your control: contribution is on by default. FinSor Plus subscribers can turn it off at any time from More → Help improve FinSor. On the free plan this anonymous, financial-data-free contribution is part of what keeps the plan free and cannot be disabled — see our Terms of Service.

3.7 · Signing in with Google or Apple

In addition to email-and-password, you can create or access your account using Sign in with Google or Sign in with Apple. This is optional — email-and-password works just as well.

• What we receive: when you choose one of these, the provider returns a signed identity token to your device, which our backend verifies. From it we read only your verified email address and the provider's opaque account identifier — used to create your FinSor account or to link the sign-in to your existing account with the same email.
• What we do NOT receive: your Google or Apple password, your contacts, your calendar, your files, or any other data from those accounts. Signing in does not grant FinSor access to your Gmail or iCloud mailbox — connecting an inbox for statement import is a separate, explicit step (see §4.5).
• Apple's private relay: if you use Sign in with Apple and choose to hide your email, Apple gives us a relay address; we treat it exactly like any other account email.

3.8 · This website

Our marketing website (where you are reading this) loads fonts from Google Fonts and may keep standard, short-lived server access logs (IP address, browser type) for security and abuse prevention. It does not set advertising or cross-site tracking cookies. This policy otherwise concerns the FinSor app.

4 · How financial data flows

This is the most important section. Read it carefully.

4.1 · Extracting a statement

When you tap Upload and pick a statement:

1. The document bytes leave your phone over an encrypted HTTPS connection.
2. They arrive at our backend gateway, where they live in memory only — never written to disk, never logged, never stored in any database.
3. The structured result (transactions, balances) is returned to your phone.
4. The original bytes are dropped from memory at the end of the request. They cannot be recovered after that point — by us or by anyone else.
5. Your phone saves the extracted structured data to its on-device SQLite database. This database never leaves your phone except through backups you explicitly enable (see §7).

4.2 · Account numbers are masked at the boundary

Before the extracted data is returned to your phone, account numbers are masked to the last 4 digits on our server (e.g. "XXXXXXXX1234"). Some statements (for example from fund houses or depositories) print your PAN as the account identifier; its letters are masked too, leaving only the last 4 digits (e.g. "XXXXX1234X"). Demat client IDs and insurance policy numbers are masked the same way. The unmasked digits never leave our server's RAM and are never persisted anywhere. The mobile app stores only the masked form.

4.3 · Password-protected PDFs

If you upload a password-protected PDF, your password is used to decrypt the file in our server's memory using the qpdf tool, and discarded immediately. The decrypted bytes are also discarded after extraction. Your PDF password is never stored, logged, or transmitted to any third party.

4.4 · FinSor analysis ("FinSor Insights")

When you tap Analyze on the Insights tab, the App builds a summary of your portfolio on your device (totals, allocation percentages, category breakdowns) and sends only that summary — not your raw transactions — to our backend, which forwards it to Google Gemini for analysis. The returned insight text is shown in-app. The summary is treated identically to document bytes: in memory only, not stored.

4.5 · Email connections (Gmail, Outlook, iCloud)

Connecting an email account is entirely optional and voluntary. FinSor works fully without it — statement uploads, dashboards, insights and portfolio analysis all function normally if you never connect an inbox. You opt in only if you want FinSor to find your statement attachments automatically, and you can disconnect at any time. You may connect more than one inbox.

FinSor supports two kinds of inbox connection, and in both cases your email is fetched directly to your device and processed there:

• Gmail and Outlook connect using the standard OAuth 2.0 flow with read-only scope — we never see your email password. The refresh token issued by the provider is held in your device's hardware-backed secure storage (iOS Keychain / Android Keystore) and is never transmitted to or stored by FinSor.
• iCloud Mail does not offer OAuth for third-party apps, so it connects over IMAP using an app-specific password that you generate in your Apple ID settings. That app-specific password is stored only in your device's hardware-backed secure storage and is used solely to read your mailbox from your phone — it never reaches our servers.

1. Email content is fetched directly to your device and processed entirely on your phone. The bytes of your messages never reach our servers.
2. We do not store messages, attachments, headers, or metadata on our backend at any point.
3. If a statement attachment is password-protected, any statement password you save to skip re-typing is also kept only in your device's secure storage.
4. When you disconnect an email account from More → Connections, its OAuth refresh token (Gmail / Outlook) or app-specific password (iCloud) is removed from your device's secure storage in the same action, and OAuth tokens are revoked at the provider.

You can revoke FinSor's access at any time from your provider's security dashboard (e.g. Google Account → Third-party apps, the equivalent Microsoft page, or by deleting the app-specific password in your Apple ID settings), without opening the FinSor app. Disconnecting does not affect any other FinSor feature.

4.6 · Subscription billing (FinSor Plus)

The paid FinSor Plus plan is sold via Google Play Billing on Android and Apple StoreKit on iOS, with RevenueCat (RevenueCat, Inc.) orchestrating receipt validation and entitlement tracking on our behalf.

1. When you tap Subscribe, the App opens the native Play / StoreKit purchase sheet. The card / UPI / wallet details you enter go directly to Google or Apple — they never touch our servers, and they never touch RevenueCat.
2. Google / Apple charge you, return a purchase receipt to your device, and the App forwards the receipt to RevenueCat for validation.
3. RevenueCat validates the receipt with the store, then notifies our backend via a signed webhook that your account is now entitled to FinSor Plus.
4. Our backend updates only your subscription tier and paid-until date. No purchase amount, currency, payment method, transaction id, or last-4-of-card is stored on our side.
5. We send to RevenueCat only your FinSor user id. RevenueCat sees: that user id, the store-issued receipt, and the resulting subscription state. It does not see any of your financial or document data, and we send it nothing about your transactions, balances, or accounts.

RevenueCat's handling of this data is governed by its own Privacy Policy. Cancellations and refunds are handled by the app store directly — manage your subscription via Google Play → Payments & subscriptions on Android or Settings → [your name] → Subscriptions on iOS.

4.7 · Monthly report by email (FinSor Plus only)

FinSor Plus subscribers receive a monthly PDF report by email — net-worth trend, asset allocation, expense category split, and the insights surfaced in the App. You can also trigger one manually from More → Monthly report, or turn the automatic monthly send off from the same screen. The free plan does not have this feature.

1. The PDF is built entirely on your phone from the on-device SQLite database. The numbers inside the PDF are never sent to our server as data — only the finished PDF bytes leave your phone.
2. The PDF bytes travel over an encrypted HTTPS connection to our backend, where they live in memory only — never written to disk, never logged.
3. Our backend hands the PDF directly to our email-delivery vendor Brevo (Sendinblue SAS) as an attachment, with the recipient address pinned to your registered FinSor email. You cannot send the report to anyone else.
4. Once the email is queued for delivery (typically within a few seconds), the PDF buffer is dropped from memory. We do not retain a server-side copy.
5. The only record we keep is a timestamp on your account row indicating when the most recent monthly report was sent — used to avoid sending duplicates and to nudge you (via a push notification on day 5) if no report was sent that month.

Brevo handles the email-to-inbox delivery and may retain delivery-status records (sent / delivered / bounced) under its own retention rules. We do not pass Brevo your transactions, balances, account numbers, or any data about the contents of the PDF other than the PDF itself and the recipient address. Brevo's privacy handling is described at https://www.brevo.com/legal/privacypolicy/.

If you do not want a monthly report at all, turn off "Send automatically each month" in More → Monthly report. The manual button on the same screen stops working only if you also cancel your FinSor Plus subscription.

4.8 · Finding recurring payments with AI (optional)

Recurring payments are normally found on your phone, from statements you have already saved, with no server involved. Only if you tap Find more with AI in Insights → Recurring payments does anything leave your phone:

• Your phone first groups your debit transactions from the last 12 months by payee. It sends our server only the payee groups its own rules didn't already recognise. For each group: at most three sample payee names / descriptions, the number of payments, and the dates and amounts of the most recent payments (at most 24) — plus the names and repeat interval of the recurring payments FinSor already found, so the AI can tell when one has been renamed.
• Before anything leaves your phone, FinSor removes UPI handles, phone numbers, email addresses and any long number (such as an account or reference number) from those descriptions. Account numbers, balances, your name and your bank's account identifiers are never sent.
• Payees you've paid only once, ones you already track or have dismissed, cash withdrawals, card bill payments, salary, interest, transfers to your own accounts, transactions you've excluded and credit-card payments already matched to a card statement are left out.
• Our server passes the groups to our AI provider (Google Gemini) and holds them in memory only while it waits — not written to disk, not logged, not stored in any database. If you cancel, the request and the AI call stop. The AI returns only which transactions belong together; your phone works out the amounts and dates and keeps the result on your phone.

4.9 · Your FinSor Score and "Explain my score" (optional)

Your FinSor Score, its eight areas and the suggestions under "What moves your score" are worked out entirely on your phone. If you add your age and the number of people who depend on you, those details are stored only on your phone and you can clear them at any time. Your score history is also kept only on your phone.

When you tap Explain my score (FinSor Plus), FinSor sends our server only: your score (0–100) and its band; whether you added age and dependents (yes or no, never the details); and, for each of the eight areas, its score, whether there was enough data, and one rounded ratio such as "20% of income saved" — plus which areas your phone picked as going well or worth improving. No rupee amounts, balances, account numbers, names, institutions, transactions or document contents are sent; our server rejects any request that contains anything else. Our server passes these figures to our AI provider to write a short plain-language explanation, holds them in memory only while it waits, and does not write them to disk, log them or store them. The explanation is saved on your phone. Each explanation counts as one of your monthly AI analyses.

4.10 · When you contact support

When you report a problem or ask a question from More → Help & support, we store on our server:

• what you write — the subject, your message and any later replies;
• the topic you picked, and whether you want our reply in the App or by email;
• screenshots you choose to attach (up to 3 per message). Screenshots of FinSor can show your balances or transactions — we suggest hiding amounts first (the eye icon on Home);
• basic app facts sent automatically: the FinSor version, your phone's platform and OS version and, on Android, the phone model. Nothing from your statements, accounts or on-device data is sent.
• your account email, so we can reply.

Why: only to understand and answer your request. Who sees it: our authorized support personnel. If you choose email, our reply is sent through our email vendor Brevo and your answers come to our support inbox. If you choose in-App replies, we send a push notification when we reply — it says only that there is a reply, never the reply itself.

How long: screenshots are deleted automatically 30 days after the issue is closed. Messages are kept while your account exists, so we can see the history of an issue, and are deleted with your account. Message contents are never written to our server logs.

4.11 · Fund-house logos

To show fund-house logos next to your mutual funds, the App downloads the complete set of logos from our server — every fund house, whether you hold its funds or not — and keeps it on your phone. Updates arrive as changes to the whole set. Nothing in these requests reveals which funds you hold.

5 · Local data on your device

The bulk of your financial data lives in an encrypted-at-rest SQLite database managed by the App on your phone. This includes:

• Uploads (file names, hashes, document types, dates)
• Accounts (institution, masked account number, account type)
• Transactions (date, description, amount, category)
• Assets and liabilities (balances)
• Net-worth snapshots
• Manually entered physical assets (real estate, vehicles, gold)
• Your categorization rules
• Cached FinSor analysis results
• Your mutual fund and stock holdings, and any average cost you enter for a stock
• Your FinSor Score, its history, and the age / dependents details if you add them
• Your Renewals items, their history and reminder settings, and the photos / PDFs / links you attach (see §5.2)

This database is accessible only through the App and only on your unlocked device. We have no remote access to it. If you change phones without restoring from your own backup (see §7), the data does not come with you — there is no server-side copy to download.

5.1 · Biometric / PIN unlock

If you enable Face ID, fingerprint unlock, or a 6-digit PIN to open the App, the underlying secret is stored in your device's secure hardware enclave (iOS Keychain / Android Keystore) and is never transmitted to us. The PIN, when used, is hashed before storage; we cannot recover a PIN you've forgotten.

5.2 · Renewals and the documents you attach

Renewals keeps track of things that expire, renew or repeat: subscriptions, insurance, SIPs, recurring payments, and certificates or identity documents such as a PUC certificate, driving licence, passport, PAN or Aadhaar.

• Everything stays on your phone. Renewal items, their dates, amounts, reference numbers, history and reminder settings are stored only in the App's on-device database. They are never sent to FinSor's servers, to our advertising partner, or to our subscription partner.
• Photos and PDFs you attach are saved inside FinSor's private storage on your phone. They are not uploaded anywhere and are not read by any AI service.
• Links you attach (Google Drive, OneDrive, Dropbox or any other https link) are stored as the link text only. FinSor doesn't download the file; tapping the link opens it with that provider under your own account. We recommend keeping the file's sharing set to Restricted.
• Reference numbers are masked in lists (only the last 4 characters are shown).
• Suggestions — recurring payments, SIPs found in mutual fund statements and insurance policies found in NSDL / CDSL statements — are worked out on your phone from statements you have already saved. No server is involved, except for the optional AI check in §4.8.

5.3 · Renewal reminders

Renewal reminders (FinSor Plus) are local notifications scheduled by the App on your phone; no notification server is involved and nothing about the item leaves your device. To protect what's visible on your lock screen, reminder text never includes the item's title, reference number, amount or holder name — only a generic description such as "Health insurance renews in 30 days". With Hide details on lock screen turned on in Renewals → Reminders, the notification reads only "FinSor · 1 item due soon".

6 · Third-party services

The App relies on a small number of third-party services, listed in full here.

Each third party listed below is bound by its own contractual confidentiality and security obligations, processes data only for the stated purpose, and — other than the app stores and the ad SDK, which act under their own policies — acts on our instructions as a processor.

7 · Backups

FinSor Plus subscribers can back up their on-device data to a place they choose — for example their own iCloud Drive, Google Drive or the phone's Files app — never to our servers. Backups are made only when you tap More → Backup → Back up now; nothing is backed up automatically.

• After you confirm with your app PIN, you choose a backup password. The App encrypts a snapshot of your on-device database with it (AES-256, with the key derived from your password) before the file leaves the App's private storage.
• Your phone's share sheet then saves the encrypted file wherever you pick. We do not have access to your iCloud, Drive or Files storage, or to the backup file.
• The backup password is never stored or sent anywhere. Without it the file cannot be opened — not by us, and not by you — so keep it safe.
• To restore, tap More → Backup → Restore, pick the file and enter its password. Restoring replaces the data currently on the phone.
• We do not maintain server-side backups of your data at any point.

To stop keeping backups, simply stop making new ones and delete the files you saved from wherever you put them.

Renewals in backups. A FinSor backup includes your renewal items, their history, reminder settings and any links you've attached. It does not include the photos or PDFs you've attached to renewals — those stay only on the phone where you added them. After restoring on a new phone, each such document shows as "File not on this phone", and you can re-attach or remove it. To keep a document across phones, store it in your own cloud storage and attach it as a link.

8 · Your rights under the DPDP Act 2023

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access the personal data we hold about you (email, hashed password, subscription tier, usage counters, and anything you have sent through Help & support). Email support@thulirr.in to request a copy.
• Correct inaccurate or outdated personal data. You can change your email from inside the App; password resets are self-service.
• Erase all personal data we hold by deleting your account from More → Privacy → Delete account. Deletion is immediate and irreversible. You may also email us to request deletion if you cannot use the in-app option.
• Withdraw consent at any time by deleting the App and your account.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, as provided under the DPDP Act 2023. Write to us to register a nominee.
• Grievance redressal — write to our Grievance Officer at the address in §1. We will respond within 30 days as required by the DPDP Act.

If you are dissatisfied with our response, you may complain to the Data Protection Board of India once it is operational.

9 · Account deletion

You can delete your account at any time from More → Privacy → Delete account inside the App. Doing so will:

• Permanently delete your email, hashed password, subscription tier record, all usage counters, and your Help & support issues, messages and screenshots from our backend within 24 hours.
• Disconnect any device on which you are signed in.
• Revoke any active authentication tokens.

This does not delete the on-device database on your phone — that data is yours and is removed only when you delete the App or clear its storage. The cloud backup, if you enabled one, lives in your own iCloud / Drive account and is removed only when you delete it there.

10 · Data retention

• Account information (email, hashed password, tier, usage counters): retained as long as your account is active. Deleted within 24 hours after you delete your account.
• Document bytes sent for extraction: discarded at end of request, never retained.
• Email content and OAuth tokens for connected mail accounts: never retained on our servers. Tokens live in your device's hardware-backed secure storage and are revoked when you disconnect.
• Help & support: screenshots are deleted 30 days after the issue is closed; messages and the app / device details sent with them are kept while your account is active and deleted within 24 hours of account deletion.
• Optional AI checks (recurring payments, Explain my score): held in memory only for the duration of the request; never retained.
• Crash reports: retained by Firebase Crashlytics for 90 days then auto-purged.
• Push notification token: stored on your account row while notifications are enabled; wiped on sign-out, when you revoke notification permission, or within 24 hours of account deletion.
• Ad data (free plan): we retain none. Any advertising identifier / technical data is collected and retained by Google under its own policies, not ours.
• Subscription state (paid plan): retained as long as your account is active; deleted within 24 hours of account deletion. The store receipt itself lives with the app store and RevenueCat under their own retention policies (not ours).

11 · Security

• All traffic between the App and our backend is encrypted in transit (HTTPS / TLS 1.2+).
• Passwords are stored as bcrypt hashes with cost factor 12.
• Our backend has no production database storing financial information of any kind — this is enforced by the architecture, not just by policy. The only exception is what you choose to send us through Help & support (§4.10), which is kept only as described there.
• We follow industry-standard practices for server hardening, secret rotation, and access logging.

No system is impossible to compromise. If we ever experience a security incident affecting your personal data, we will notify you, the Indian Computer Emergency Response Team (CERT-In), and the Data Protection Board of India within the timelines required by law.

12 · Children

FinSor is not directed at children. We do not knowingly create accounts for users under the age of 18. If you believe a minor has registered, write to saithulirr@gmail.com and we will delete the account.

13 · International users

FinSor is built for the Indian market. Our backend runs in India (Mumbai region). If you use the App from outside India, your data will still be processed in India and subject to Indian law.

14 · Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app on next launch (a "What's new" notice) and via email to your registered address at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

15 · Contact

For any privacy question, request, or complaint:

• Email: saithulirr@gmail.com
• Grievance Officer: Akila Dhanasekaran, reachable at the same address

We aim to respond within 7 business days for general queries and within 30 days for formal DPDP requests.

This document is plain English by design and is not a substitute for legal advice. If you need to understand how this policy interacts with your specific situation, consult a lawyer.