Privacy Policy

Pennie is developed by Prayo, an independent product studio based in India. This policy explains how the Pennie Android app and its connected services handle information. Contact us at support@prayo.co.in.

This is Pennie's single Privacy Policy, including all AI data-handling disclosures. There is no separate AI policy. The Terms of Use remain the service contract.

1. Records and learning on your device

Pennie's local database is the source of truth for your transactions, amounts, dates, categories, notes and related budgets, debts, savings and reminders. Captured notification content can include sensitive financial information and information about other people.

If you grant Android notification access, Pennie reads notifications from apps you choose to monitor, such as SMS, email or banking apps. It extracts financial events, groups possible duplicates and stages results for review, or uses an auto-save configuration you intentionally enable. Notification access is not access to your bank account or a general permission to read an entire email inbox. You can change monitored apps and revoke notification access in Android settings. You can also enter transactions or paste message text yourself.

Notes attached to saved transactions and their categories are used to fit an on-device lexical classifier: it learns matching words and phrases to suggest categories. Unsaved drafts are not its training corpus. This local learning step does not require cloud AI. Changing saved examples can change later suggestions.

Selected bill images or PDFs are processed to obtain local OCR or embedded text. Keep your device, exported files and backups protected; a device-lock screen is not a promise that every local file is separately encrypted.

2. Optional account and Google Drive backup

Google identity and the Pennie account

You can use local record-keeping without a cloud account. If you choose Google sign-in, Google provides an identity token and profile information such as a Google account identifier, email and display name. The Pennie proxy verifies that identity and maintains an account profile, referral information and session credentials.

The account access token (JWT) can include email, display name, provider identifiers and a referral code as well as an account identifier. It accompanies authenticated requests to Pennie's connected services. A JWT is not an anonymous identifier. Account sign-in does not authorize Drive backup or optional AI processing.

Separate Drive authorization

Google Drive backup requires separate authorization for Drive app data. If you enable it, Pennie uploads backup files to the hidden app-data area of your Google Drive account and can retrieve or remove those backups. Backup files can contain unredacted financial records and notes. Google receives the file contents and associated file metadata; this is distinct from the text-limited AI flow below.

Pennie may register backup metadata with its account service: filename, size, checksum, timestamps, device name and app version, linked to your account. Registering that metadata is not uploading the backup file to the Pennie proxy. Turning off automatic backup, revoking Google access and deleting existing Drive files are separate actions; signing out does not itself erase backups.

3. Optional AI assistance: benefits and data

AI assistance can suggest categories and subcategories for captured expenses and turn bill text into an editable bill draft, helping you spend less time entering and organizing records. Suggestions are not guaranteed to be correct; you remain in control of review and any intentionally enabled auto-save.

With your explicit AI choice enabled, Pennie can ask for help interpreting a transaction or structuring an initial bill draft. Expense suggestions try saved evidence and eligible cached answers before a permitted cloud call. For bills, enabled AI can structure the initial OCR/text draft even when some fields already parse locally; it is not limited to local parsing failures. Requests go through the authenticated Pennie proxy to Microsoft Azure AI (Microsoft Foundry). The app does not contact a model directly through a model SDK. Local processing remains available when cloud AI is off or unavailable.

• Expense suggestions: bounded transaction excerpts and relevant fields may include an amount, currency, date, merchant or payee, transaction direction, category context and non-phone UPI handles. Pennie extracts the relevant message window rather than intentionally sending a whole email.
• Bill parsing: OCR or embedded text can contain receipt details, merchant names, purchased items, prices, tax and totals. The current AI bill flow sends bounded text, not image bytes. Optional classification of an edited bill uses text and structured item/category information.
• Redaction: the app and proxy attempt to remove account and card numbers, OTPs and phone numbers. Non-phone UPI handles and useful merchant/payee text may remain. Redaction is not guaranteed anonymisation; formats can be missed and remaining details may identify you or someone else.

Do not submit information you are not entitled to share. AI may misread amounts, names or categories. Review suggestions before saving, or carefully choose and monitor any auto-save rules you enable. AI output is not financial advice.

The backend keeps some classification answers, bill results and request records to reuse answers, handle retries and enforce limits. Bill results can contain structured receipt details. Microsoft also processes prompts and results under its applicable service terms and deployment settings. Its abuse-monitoring arrangements can include automated review and, depending on the deployment, storage of flagged content for authorized human review. This policy does not promise zero storage or a universal provider retention period. See Microsoft's Azure AI data-privacy explanation.

4. Enable cloud AI: one control in AI Intelligence

Enable cloud AI in Settings > AI Intelligence controls optional AI processing. Turning it on opens a small dialog on that screen with a link to this policy's AI section and an agreement checkbox. Checking the box enables cloud AI; cancelling leaves cloud AI off. You are not sent to another consent page and are not asked again for every AI request.

Signing in or accepting the Terms does not enable AI. Reading this policy is not an AI opt-in. The app asks for an explicit optional choice for cloud AI and any additional bill-processing permission it presents. Declining leaves local record-keeping and local exports available.

Your setting is remembered locally for the account and device it applies to; it is not synchronized across devices. An existing opt-out is not overridden by signing in, a returning session or accepting updated service terms. With the switch off, Pennie sends no optional cloud AI requests.

Existing signed-in users can review and explicitly acknowledge updated legal versions under Privacy & terms. That acknowledgement is separate from the AI switch. General policy acknowledgement does not gate AI or turn it on or off. These local records are not a server-side acknowledgement audit.

You can withdraw permission by turning Enable cloud AI off, without another confirmation. This stops future optional AI requests; it does not recall a request already sent or automatically delete past results. Use the deletion controls described below for stored data. Do not assume the setting has followed you to a different account or device.

Materially changed purposes require a renewed choice before the new optional processing. OS permissions, Google identity, Drive access and ad consent remain separate. Granting one does not grant the others, and disabling AI does not disable every other connected feature.

5. Monthly review and local Excel exports

The updated Pennie app creates no new AI monthly reports. Excel exports are generated locally from your financial records; cloud AI is not needed to generate them. You control any later saving or sharing through the file location, sharing app or recipient you select. Exports can contain detailed financial information, and the selected recipient's practices apply after you share.

Older AI reports can still be read or deleted where available; a report or link may expire or be removed. Updating the app does not itself erase historical server records or copies already shared with others.

6. Optional community feedback and support

You can suggest ideas, report bugs, comment and vote without signing in. The app creates a random guest credential in secure storage, scoped to this feedback service and product. The service uses a one-way hash of that credential to recognize your submissions and votes, not device fingerprinting, your email or a public profile. Network-origin and identity-based request limits help prevent abuse. Voting is limited to one vote per identity, not one vote per person.

Account sign-in is optional. If you choose to link guest activity to your verified account, the service transfers that activity and combines duplicate votes; it keeps a linking record to prevent another account from claiming it. The old guest credential does not grant access to the linked account. Without linking, reinstalling the app, clearing storage or losing the credential may lose your ability to access prior private submissions or remove prior votes. Those actions do not delete server submissions.

If you submit feedback or a comment, the feedback service stores its text, product, timestamps, status, moderation decisions and guest- or account-linked ownership. It also stores votes and duplicate-request identifiers needed to operate the community. New comments and public suggestions become public only after moderation approval; bug submissions are private by default and may be published by a moderator. Do not include financial records, account credentials or other people's personal information in feedback.

A submission can include a snapshot of a host-reported, display-only Pro flag. It describes what the app reported at submission time, not a verified public billing record. It grants no additional vote weight, moderation power or access. Approved public entries can show this badge, text, dates, counts and developer responses. Public responses do not include account email or profile name, but your own text can still identify you. Private entries and pending comments are limited to the relevant author and authorized moderation access.

If you contact support, we receive the message, your contact details and anything you attach. Send only what is needed. Ask us about removing published content or associated support records; signing out or deleting local data does not automatically remove them.

7. Ads, purchases and referrals

More apps by Prayo is an optional catalog of our other applications. When you open it, the app can request public catalog information and icons from Prayo, identifying the current application and platform so it can exclude itself and show suitable store links. It does not send your account, financial records or an inventory of installed apps, and does not require sign-in. The last successfully downloaded catalog can be cached locally for offline viewing. Opening a store or website link is your choice; that destination's privacy practices then apply.

Pennie uses Google AdMob for advertising, including rewarded formats. Google's advertising services may process device or advertising identifiers, IP address, app/device information and ad interactions for delivery, measurement and abuse prevention under their terms and your applicable settings. Ad-related consent and personalization controls are separate from Pennie's AI choice. See Google's Privacy Policy and the controls available in your Google account, device and app.

Purchases use Google Play Billing. Google handles checkout and payment details. Pennie receives purchase/product identifiers, tokens and entitlement state to unlock or restore purchased features, and stores related state on the device. Refund and purchase records held by Google are governed by Google Play's processes.

Optional account referrals use referral codes, redemption records, referral counts and earned ad-free time to apply rewards and prevent repeat redemption. Referral ad-free time is not the same as paid Premium features or the cosmetic Pro label.

8. Service providers, diagnostics and security

Connected features involve more than one provider: Google for identity, Drive, advertising and purchases; Microsoft Azure for hosted backend and AI services; and the apps or recipients you choose for exported files. Providers can process information outside your country, depending on the service and deployment. Their applicable privacy terms and controls also matter.

Our cloud services process operational records such as request timing, errors, feature usage, quota counters and pseudonymous account references to run the service, troubleshoot failures, limit cost and detect misuse. Hosting providers can also process network and diagnostic information. Pseudonymisation or hashing does not necessarily make a record anonymous.

Local debug logs can contain financial details. When diagnostic logging is enabled, logs on your device can contain financial notification content and receipt details. Bill debug transcripts can include redacted recognizer text and AI-ready text; remaining merchant names, item descriptions and other details may still be personal. Local logs are not guaranteed to be anonymous. Review logs before sharing them with support or anyone else, and remove details that are not needed.

Access controls, authenticated requests and secure transport help protect connected services, but no app, network or storage system is risk-free. This policy is not a guarantee against unauthorized access or a statement that every copy is encrypted end to end. We may need to disclose information to meet applicable legal requirements or address misuse and security incidents.

9. Retention, deletion and access requests

Different records have different lifecycles; there is no single automatic deletion period for all Pennie data.

• Local records: manage transactions and captured items in the app. Clearing app storage or uninstalling can remove local data but not exported copies, remote backups or other cloud records. Preserve any records you need first.
• AI data controls: the app can clear local AI caches/learning data and request deletion of supported server-stored bill results and historical reports. Saved transaction notes can be used to rebuild local suggestions. Server quota counters and hashed no-repeat markers may remain to prevent duplicate calls or charges; shared classification caches and diagnostic records are not all erased by this action.
• Account deletion: use the account deletion control or contact support. The server account-deletion path removes the account profile, retires its referral code and clears supported bill-result/report content. It is not a blanket deletion of feedback, backup metadata, operational records or copies held by providers. Signing out only ends the local session.
• Backups, exports and purchases: delete Drive backups separately and manage Drive authorization in Google. Delete exported files and contact recipients about their copies. Account deletion does not cancel a Google Play purchase or erase Google's payment records.
• Service records: account operations, support, moderation, usage, caches and security records may remain where needed for the relevant service, request handling, abuse prevention or legal obligations. We do not promise a fixed automatic purge period for every such record.

For access, correction, deletion or other privacy rights available under applicable law, email support@prayo.co.in. Describe the feature and records concerned, without sending passwords or full financial data. We may need to verify account ownership and explain any data we cannot remove through a particular control. A failed or offline deletion request may need to be retried.

10. Policy updates and contact

This is policy version 2026-09-25, effective 25 September 2026. We will make revised notices available here and present relevant updates in the app. Accepting updated legal terms does not silently enable optional AI; materially changed optional purposes require a renewed choice.

Prayo · Independent product studio, India
Contact: support@prayo.co.in
Related: Pennie Terms of Use