SAGIRO Privacy Policy

1. Overview & Core Privacy Commitment

SAGIRO ("we", "our", or "the app") is a personal finance tracking and budgeting application engineered for users in India. We believe your financial data belongs exclusively to you.

SAGIRO is built with an on-device first architecture. Your financial ledger, transaction logs, account balances, and SMS messages are processed, analyzed, and stored locally on your device in an encrypted database (SQLCipher AES-256).

2. Data We Process on Your Device

• Bank Transaction SMS Messages: If you grant SMS permissions, SAGIRO reads incoming and existing bank transaction SMS messages solely to identify transactional debits, credits, refunds, merchant names, and timestamps. Personal messages, one-time passwords (OTPs), and non-financial messages are ignored.
• Transaction Records: Financial transactions you log manually, via voice input, CSV import, or SMS parsing are stored locally on your device.
• Categories & Budgets: User-defined spending budgets, Safe Today™ limits, and savings goals are stored locally.

3. SMS Permission Disclosure (Google Play & DPDP Act 2023)

SAGIRO requests Android runtime permissions (READ_SMS, RECEIVE_SMS) strictly to automate local bank transaction tracking under the Personal Financial Management (PFM) / SMS-based money management core use case.

• All SMS parsing algorithms run 100% locally on your phone.
• Raw SMS text and financial transaction details are NEVER uploaded to any remote server or third-party database.
• Granting SMS permission is optional. If denied, all budgeting, Safe Today™, and analysis features remain fully operational via Manual Entry and CSV Imports.

4. Accurate Network & Third-Party Service Disclosures

Your financial transactions never leave your device. However, SAGIRO utilizes limited, non-financial network requests for specific optional features:

• IFSC Bank Code Resolution: When you look up a bank branch by IFSC code, the app queries the public Razorpay IFSC API (ifsc.razorpay.com) using ONLY the 11-character alphanumeric IFSC code. No account numbers, names, balances, or transaction details are ever transmitted. Results are cached locally in your SQLite database.
• Exchange Rates: Currency conversion references use public currency data (api.frankfurter.app) with offline cached fallbacks.
• In-App Subscriptions (Google Play Billing): Purchase validation and subscription management are handled securely via the official Google Play Billing Library (Billing Client 8.0.0).
• Authentication: If you use optional Google Sign-In or Firebase Authentication, authentication tokens are managed via Google Play services.

5. Data Security & Encryption

• On-Device Database Encryption: SAGIRO uses SQLCipher (AES-256-CBC) to encrypt your local database at rest using a 256-bit key backed by Android Keystore.
• Encrypted Backups: When you export an encrypted backup, the archive is encrypted using AES-256-GCM authenticated encryption with 100,000 PBKDF2-HMAC-SHA256 iterations and a user-defined password. We do not store or transmit your backup passwords.
• OS Security: We enforce android:allowBackup="false" and disable cleartext HTTP traffic to prevent unauthorized data extraction.

6. User Data Rights & Data Deletion (DPDP Act Compliance)

Under India's Digital Personal Data Protection Act (DPDP Act 2023) and Google Play User Data policies, you have complete control over your data:

• Right to Access & Export: You can export your full transaction ledger in CSV or Encrypted JSON format at any time from the Import/Export Center.
• Right to Erasure / Deletion: You can instantly and permanently erase all transaction history, accounts, budgets, and preferences by tapping "Clear All Data" in Settings or uninstalling the app. Because SAGIRO stores your data locally, local deletion immediately and permanently purges all records.

7. Non-Advisory Notice

SAGIRO and its Money Brain companion provide descriptive and informational financial summaries based on your device data. SAGIRO is not a registered investment advisor, lender, or banking institution, and does not provide professional financial, investment, legal, tax, or banking advice.

8. Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000, and DPDP framework, if you have any questions, concerns, or grievances regarding this Privacy Policy or your data, please contact our Grievance / Support Desk: