Privacy Policy

1 Information We Collect

We collect the following categories of information when you use Credzo:

Account Information

• Name and email address (provided during registration)
• Mobile number (optional, used for account identification)
• Password (stored as a one-way BCrypt hash — never in plain text)
• Profile photo (stored locally on your device only)
• Preferred currency and language settings

Expense & Financial Data

• Expenses you manually enter: amount, category, description, date
• Credit card details: card holder name, last four digits, card type, bank name, billing date, expiry month/year
• Monthly budget limits (per category, per card, per billing period)
• Fixed recurring expenses you set up

Usage & Technical Data

• Membership plan and upgrade request history
• Notification preference settings
• App version and build number (for support purposes)

2 How We Use Your Information

We use the information we collect exclusively to provide and improve the Credzo service:

• Deliver core features — expense tracking, budget limits, reports, and analytics
• Authenticate your account — JWT-based sessions to keep your data private
• Send notifications — spending alerts and reminders at your chosen frequency
• Process membership upgrades — managing Pro and Elite plan access
• Provide customer support — responding to your enquiries via email
• Improve the app — understanding how features are used in aggregate, anonymised form

We do not use your data for advertising, profiling for third parties, or any purpose beyond delivering the service described above.

3 SMS & Transaction Data

With your explicit permission (READ_SMS), the App reads SMS messages on your device solely to detect bank and credit card transaction notifications sent by financial institutions. Only messages from financial institution senders — such as 5-digit or alphanumeric bank short codes (e.g., VM-HDFCBK, AD-ICICIB) — are processed. Personal SMS messages are never read, accessed, or stored.

To enable automatic expense detection, the text content, sender address, and timestamp of matched financial SMS messages are securely transmitted over HTTPS to our servers for deduplication and transaction parsing. This data is used solely to extract transaction amounts and merchant names for your expense tracking history. SMS data transmitted to our servers is retained for as long as your account is active and is permanently deleted when you delete your account.

• Only messages matching financial institution sender patterns are transmitted to our servers
• Personal SMS messages are never read, accessed, or stored
• All transmission uses HTTPS encryption
• SMS data is used solely for expense auto-import and is never used for advertising
• We do not sell or share SMS data with any third party

You can revoke SMS permission at any time from your device settings (Settings → Apps → Credzo → Permissions). The App will continue to function for manual expense entry without this permission.

4 Data Storage & Security

Your data is stored on secure servers. We implement the following technical safeguards:

• Authentication — JSON Web Tokens (JWT) with 24-hour expiry for all API access
• Password hashing — BCrypt with a strong work factor; plain-text passwords are never stored or transmitted
• Transport security — All communication between the app and our servers uses HTTPS/TLS encryption
• Access control — Each user can only access their own data; all API endpoints are authenticated
• Stateless sessions — No server-side session state; tokens are validated on every request

While we take commercially reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We encourage you to use a strong, unique password for your Credzo account.

5 Data Sharing & Third Parties

We do not sell your personal data. We do not share your data with advertisers, data brokers, or marketing companies.

We may share data only in the following limited circumstances:

• Service providers — Infrastructure and hosting providers that process data on our behalf under strict confidentiality agreements
• Legal requirements — If required by law, court order, or to protect the rights and safety of Credzo users
• Business transfer — In the event of a merger, acquisition, or sale of assets, user data may be transferred; we will notify you before this occurs

The AI-powered Planner feature (Elite plan) may transmit your anonymised spending patterns to an AI inference service for generating personalised recommendations. No personally identifiable information (name, email, card details) is included in these requests.

6 Data Retention

We retain your account and expense data for as long as your account is active. If you delete your account, all associated data — expenses, credit cards, budget limits, membership history, notification preferences, and any SMS transaction data transmitted to our servers — is permanently deleted from our systems within 30 days of account deletion.

Aggregated, anonymised usage statistics that cannot identify you may be retained indefinitely for product improvement purposes.

7 Your Rights & Choices

You have the following rights regarding your personal data:

• Access — View all your stored data directly within the Credzo app (Profile, Expenses, Reports)
• Correction — Update your expenses, card details, and budget limits at any time within the app
• Deletion — Delete your account and all associated data from Profile → Delete Account. This action is immediate and irreversible
• Data portability — Contact us at support@credzoapp.com to request an export of your data in a machine-readable format
• SMS permission — Revoke Credzo's SMS access at any time via Android system settings (Settings → Apps → Credzo → Permissions)
• Notification opt-out — Disable all notifications via Profile → Notification Preferences within the app

8 Children's Privacy

Credzo is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at support@credzoapp.com and we will promptly delete it.

9 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via in-app notification or email.

Your continued use of Credzo after changes are posted constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

10 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please reach out to us: