Where your data lives — and what leaves your device.
You choose whether your data ever leaves the phone. Cloud is encrypted, analysis is signed and refused unless the signature verifies, and AI is optional with the exact payload shown before it is sent.
This phone. Holdings, transactions and statements are stored encrypted on the device.
Cloud. Only if you choose it. Encrypted at rest; backups are sealed with a passphrase only you hold.
Analysis. A compact, signed request. The result is verified before it is shown.
AI. Only the exact summary you approve. Statements, credentials and raw transactions never leave.
Where your data lives
At setup you pick one of two modes, and you can change your mind later.
| Mode | What happens | Trade-off |
|---|---|---|
| Only on this phone | Your portfolio stays on the device. No account is created and nothing is synced. | Lose the phone without a backup and the data is gone. |
| Sync & recover | Your portfolio is encrypted and synced so you can restore it on a new phone. | Requires an email account. |
The on-device database is encrypted, and its key is held in the Android keystore. Backups you export are encrypted with a passphrase that only you know — we cannot read a backup file, and we cannot recover one for you if the passphrase is lost.
Analysis you can check
The health check runs on a server because it needs reference data — NAV history, benchmark series, scheme documents — that would be impractical to ship to a phone. What comes back is a signed report:
- Each report carries a signature over the exact bytes of the full report.
- The app verifies that signature, and the report's own hash, before anything is rendered. A report that fails verification shows nothing at all rather than showing unverified numbers.
- Each report names the exact reference-data snapshot it was computed from, so the same inputs can be checked again later.
Your portfolio is analysed and returned. It is not kept on the server afterwards.
Statement files stay on the phone
When you import a statement, the file is parsed on the device. The file itself is never uploaded, and there is no server endpoint that accepts a raw statement or a statement password — that route was removed deliberately rather than left disabled.
The AI boundary
AI is off until you turn it on, and there are three separate routes, which never mix:
- Built-in — included with Premium. We run it for you.
- Your own API key — your key, stored encrypted on your device, talking to your provider account.
- Your own computer — the work happens on a machine you already control; your AI sign-in never leaves it.
Whichever route you pick, before each send the app shows the exact compact summary that will leave the device. Statement files, credentials and raw transaction history are never part of it.
Reference data
Market and scheme data comes from free public sources — AMFI, SEBI scheme documents, NSE and BSE, RBI and Nasdaq. It is collected on a schedule into an immutable, content-addressed snapshot, and every figure the app shows carries the source and the date it was observed. When a value is missing, the app says it is missing; it does not substitute an estimate.
Measurement on this website
This site uses Cloudflare Web Analytics, which is cookieless and aggregate: it records page views and Core Web Vitals, and it cannot identify you. Optional first-party product analytics is off unless you turn it on, never receives holdings, balances, instrument identifiers or search text, and can be turned off again at any time. Session replay is disabled.
Deleting your account
You can delete your account and its cloud copy from inside the app, or from this page without the app. Deletion is verified before it runs and is not reversible.
You decide what leaves the phone.
Local mode needs no account at all, and every route off the device is shown to you first.
Next: Privacy policyAndroid 8.0 and later · Free to track