Burnly Privacy Policy
Version 1.0 · Effective: the date Burnly is first published on an app store · Last updated: 31 October 2026
Prepared by the publisher without separate legal review, against the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). This policy is available in English, Hindi and Tamil, and in any other language in the Eighth Schedule to the Constitution on request.
1. Who we are
Burnly is published by Udaya Krishnan, an individual based in Chennai, Tamil Nadu, India ("we", "us"). For data you give us to run your account, we are the Data Fiduciary under the DPDP Act.
Contact for any question about your data (DPDP Rule 9): Udaya Krishnan, Grievance Officer, [email protected]. General support: [email protected].
2. What Burnly does
Burnly is an expense tracker. It shows how much you can safely spend today, based on your income, fixed commitments and spending. It works on your phone first.
3. Data that stays on your phone
We do not receive this data unless you choose a feature in section 4 that sends it. - Transactions, card nicknames and last 4 digits, merchants, categories, budgets, fixed commitments and settings. They are kept in an encrypted database on your device. - Auto-capture (optional). If you turn it on, Burnly reads payment alerts on your device. These are bank SMS on the Android version that includes SMS access, and payment-app or bank notifications. From each alert it keeps only the amount, date and time, merchant, payment type and card or account last 4 digits. - Burnly ignores and does not store one-time passwords (OTPs), personal messages and promotional messages. - The full text of a message is never stored and never leaves your phone. - Burnly never sends SMS. - You can turn Auto-capture off at any time in Settings.
4. Data we collect, why, and where it goes
| Data | Purpose | Where it is processed |
|---|---|---|
| Mobile number, or Google account name and email | Sign you in and keep your account secure | Google Firebase Authentication |
| Household data, only if you use Household. Includes member first names and roles, Home Pool entries, a Dependent's monthly allowance and reported spend, and alert settings | Run shared budgets between members of your household | Google Cloud Firestore, Mumbai region (asia-south1) |
| Encrypted backup, only if you create one | Restore your data on a new phone | Google Cloud Storage. Encrypted on your phone with a passphrase only you know. We cannot read it or recover the passphrase |
| Subscription status (plan, renewal date, store transaction ID) | Unlock paid features | RevenueCat, Google Play, Apple App Store |
| App version and a device check token | Keep the app up to date and block abuse of our servers | Google Firebase Remote Config and App Check |
| Usage and crash data, only if you opt in | Fix bugs and improve the app | Google Firebase Analytics and Crashlytics (when enabled). Never includes amounts, merchants, names or message text. Never collected for Dependents |
| Emails you send to support@ or grievance@ | Answer you | Cloudflare Email Routing forwards them to our inbox |
Never uploaded: your personal transactions, unless you put an entry in the Home Pool or create an encrypted backup.
5. Legal basis
- We process your data on the basis of the consent you give at sign-up and for each optional feature.
- You can withdraw any consent as easily as you gave it: in Settings > Data & privacy, or by writing to [email protected].
- Withdrawal does not affect processing done before it. Some features stop working without the data they need.
6. Children (Dependent role)
- A child (under 18) can only be added to a household as a Dependent by the household Admin.
- The Admin must be signed in, must confirm they are 18 or older and the child's parent or legal guardian, and must give consent before the profile is created.
- We keep a record of that consent: who gave it, when, and which text version.
- For a child we keep only:
- first name
- monthly allowance
- the total the child reports spending in the current month
- We do not show roasts, ads or targeted content to children. We do not track or profile children's behaviour. We collect no analytics about children.
- The guardian can withdraw consent at any time. The child's household data is then erased.
- When DPDP Rule 10 takes effect, on 13 May 2027, we will also check the guardian's age and identity in a manner the Rules allow before a child profile is created. Examples are age and identity details we already hold, or a DigiLocker token. If that check is not available, we will switch off the Dependent role.
7. Sharing
- We do not sell or rent your personal data, and we do not use it for advertising.
- We share it only with the service providers named in section 4. They act on our instructions as Data Processors.
- We also share it when a law or a lawful order requires it.
- Some providers, such as RevenueCat and the app stores, may process data outside India. We do not transfer data to any country the Government of India has restricted.
8. Your rights
You can: - Access a summary of your data and how it is processed. - Correct, complete or update it. - Erase it. - Withdraw consent. - Nominate another person to exercise your rights if you die or become unable to. - Complain to our Grievance Officer, and then to the Data Protection Board of India.
How to exercise these rights: - In the app: Settings > Data & privacy lets you export your data and delete everything, on the device, in the cloud and in backups. Deletion is permanent. - By email: write to [email protected] from your registered email, or include your registered mobile number. Never send passwords or your backup passphrase.
9. Grievances
- We acknowledge a grievance within 48 hours.
- We aim to resolve it within 30 days.
- In every case we respond within the 90 days allowed by DPDP Rule 14(3).
- If you are not satisfied, you may complain to the Data Protection Board of India.
10. Retention
| Data | How long we keep it |
|---|---|
| Data on your phone | Until you delete it or uninstall the app |
| Account and household data | Until you delete your account or leave the household. Then it is erased within 30 days |
| Encrypted backups | Until you delete them or your account |
| Guardian consent records | For one year after consent is withdrawn, as proof that consent was obtained |
| Security and processing logs | At least one year, as DPDP Rules 6 and 8(3) require. Then deleted |
11. Security
- An encrypted database on your phone.
- Encrypted backups.
- Access rules that let each person see only their own data and their household's shared data.
- Encrypted connections, access controls, logs and monitoring, and backups of our cloud data.
- No system is perfectly secure.
12. Data breaches
If a personal data breach affects you, we will tell you without delay through the app or your registered contact. We will explain: - what happened - the likely effect - what we are doing - what you can do
We will report it to the Data Protection Board of India as the DPDP Rules require, including a detailed report within 72 hours.
13. Changes
We will tell you in the app before any material change to this policy. If a change needs new consent, we will ask for it.