Fidaura Privacy Policy

InnoCore Labs Technologies Private Limited · Effective 17 July 2026 · Contact: admin@innocorelabs.com

Your financial data never leaves your phone. Fidaura is free and supported by ads — and the ads never see your money. We never sell your data.

What Fidaura is

Fidaura is a privacy-first, offline-first personal expense tracker. Everything the app needs — capture, viewing, editing, insights — works entirely on your device. Your transactions, categories, budgets, accounts and goals are stored in an encrypted database (SQLCipher) on your phone. There is no account signup and no server-side copy of your financial data.

SMS permissions (Android) — what we read and why

If — and only if — you choose Auto capture, Fidaura asks for the READ_SMS and RECEIVE_SMS permissions to detect spending from bank, card and UPI alert messages:

Only financial SMS. A transaction filter decides whether a message is a money movement. Everything else — personal chats, OTPs, promotions — is ignored.
Parsed on your phone, never uploaded. Message text is processed entirely on-device. It is never sent to us or anyone else, and the raw text of a message is never even stored on the device — only the extracted transaction facts (amount, direction, merchant, bank) are kept, in the encrypted database.
Optional and reversible. Auto capture is off until you opt in, and the app is fully functional in manual mode if you decline or revoke the permission.

What ever leaves your device

Your financial data: nothing, ever. No transaction, amount, merchant, category, account, balance or message text leaves your device. There are no analytics SDKs, no crash reporters and no attribution SDKs.
Advertising: Fidaura shows ads from Google (AdMob) to stay free. Like any ad network, it receives your device's advertising identifier, device information and IP address, and you can reset or limit that identifier in Android Settings → Privacy → Ads. It is never given anything about your money: the ad requests carry no data from the app.
We do not choose the ads. Which ads appear is decided by Google, not by us. We do not vet or endorse individual ads, and an ad shown inside Fidaura is not a recommendation from us.
Collections (shared expense splitting), if you use it: shared entries are end-to-end encrypted on your device and relayed through our server as ciphertext we cannot read. The decryption key travels only inside the invite link you share (in the URL fragment, which never reaches our server). Relay data is automatically deleted when a collection is closed, and expires on a timer regardless.
Notification token (Android): Fidaura uses Firebase Cloud Messaging, a Google service, to receive a wake-up signal when one of your collections has new encrypted updates. When the app starts on Android, Google's software on your phone creates a device token. If you are in a collection, the app sends that token, with a random device ID that is not linked to your identity, to our relay, which stores it against that collection so it can send the wake-up. The signal carries no financial data, names or message content, only a fixed marker; the app then fetches the encrypted updates itself. The relay deletes the stored token when the collection is closed, and replaces it when Android issues a new one. Uninstalling the app stops the token working, but a stale token can remain on our relay until that collection is closed. Fidaura does not use Firebase Analytics or Crashlytics.
Parser rule updates, if you refresh them: the app may download a digitally signed rules file from our server. This is a download only — no personal or financial data is sent with it.

Backups and export

You can create an encrypted backup file protected by a passphrase only you know, and export your data as CSV at any time. Both stay wherever you choose to save them — we never receive a copy. Android's own cloud backup is explicitly disabled for this app, so the operating system never sweeps your data off the device.

Data retention and deletion

Your data lives on your device: uninstalling the app deletes it (keep your own backup if you want to return).
Collections relay ciphertext is deleted on collection close and expires automatically on a timer. The notification token held by our relay is deleted when the collection is closed.
We have no server-side account or profile to delete, because none is created.

Permissions summary

SMS (optional): on-device detection of financial alerts — see above.
Notifications (optional): to show a spend the moment it's detected.
Internet: used for the encrypted Collections relay, wake-up notifications, optional signed rule updates and ads — never for your personal financial data.

Children

Fidaura is a personal-finance tool intended for adults and is not directed at children under 18.

Changes

If this policy changes, the updated version will be posted at this address with a new effective date. We will never weaken the core promise above — on-device processing of your financial data, no data sale, and nothing about your money reaching an advertiser — without asking for your explicit consent in the app.