Privacy Policy
1. Introduction
Klera (“the App”, “we”, “our”) is a personal finance application built for India. This Privacy Policy explains what data the App collects, how it is used, and what rights you have over it under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable laws.
Key principle: Klera is designed to be privacy-first and offline-first. Your financial data lives on your device. We do not sell, rent, or share your personal data with advertisers or third parties for marketing purposes.
2. Data We Collect
2a. Data you provide (stored on-device only)
| Category | Examples | Purpose |
|---|---|---|
| Account details | Account name, type, opening balance | Core ledger functionality |
| Transactions | Amount, category, date, notes, merchant (optional) | Expense tracking |
| Contacts & IOUs | Name, borrow/lend amounts | Personal IOU ledger |
| Goals | Goal name, target amount, contributions | Savings tracking |
| Budgets | Category, limit amount | Budget planning |
| Loan records | Loan name, principal, rate, tenure | Loan Tenure Planner |
| Calculator inputs | SIP/loan parameters (ephemeral) | Financial calculators |
| App settings | Currency preference, biometric lock toggle | App configuration |
All of the above is stored exclusively on your device in an encrypted SQLite database (AES-256 via SQLCipher). It is never sent to our servers unless you explicitly enable cloud sync (a future paid feature).
2b. Data collected automatically (none by default)
In the current version, the App does not collect analytics or usage telemetry, and does not collect crash reports unless you explicitly opt in (see §7). No background data collection occurs otherwise.
2c. Data we do NOT collect
- Aadhaar number, PAN, passport, or any government ID
- Full card numbers, CVV, or card PINs (only last-4 digits + network nickname, at your option)
- Call logs or contact lists (Klera never requests call-log or contacts permissions)
- Biometric data (biometric authentication is handled entirely by your device OS — we never see the raw biometric)
- Location data
2d. SMS-based auto-capture (opt-in, Android only, off by default)
If you turn on “SMS auto-capture” (Settings → Privacy), the App reads incoming SMS messages only from a fixed allowlist of known bank and UPI-app sender IDs (e.g. HDFCBK, SBIINB) to detect transaction confirmations and turn them into a draft transaction for you to review and save. Messages from any other sender are never inspected. All parsing happens entirely on your device — no SMS content, sender, or parsed data is ever transmitted anywhere, logged, or shared with us or any third party. A one-time, explicit “Scan existing messages” action lets you build your transaction history from past bank/UPI SMS the same way, also entirely on-device. Klera is never registered as your device’s default SMS handler. This permission is off by default, fully optional, and can be revoked at any time from your device’s app settings.
3. How We Use Your Data
Your data is used solely to provide the App’s features to you, on your device:
- Display your account balances, transaction history, and reports
- Calculate EMI, loan comparisons, SIP projections, and goal progress
- Enforce your app-lock preference (biometric / device PIN)
We do not use your financial data for advertising, profiling, or any purpose other than running the App for you.
4. Data Storage and Security
- Encryption at rest: The database is encrypted with AES-256 (SQLCipher). The encryption key is generated on first launch, stored in your device’s OS secure keystore (Android Keystore / iOS Secure Enclave), and never leaves your device.
- No cloud backup by default: Automatic cloud backup (e.g. Google Drive backup) is disabled for encrypted database files. If your OS backs up app data, the encrypted file is backed up — but it cannot be decrypted without your device’s keystore key.
- Screen security: Financial screens are protected with
FLAG_SECURE(Android) / screen-capture prevention (iOS) to prevent screenshots and screen recordings from leaking financial content.
5. Your Rights (DPDP Act + Good Practice)
You have the following rights over your personal data:
| Right | How to exercise |
|---|---|
| Access / Portability | Settings → Privacy → Export My Data. Generates a complete JSON export of all your on-device data. |
| Erasure | Settings → Privacy → Delete All My Data. Permanently wipes all personal data from the device in one tap. |
| Correction | Edit any transaction, account, or contact directly in the App. |
| Withdraw consent | You may uninstall the App at any time; this removes all locally stored data. |
| Grievance | Email support@kleraapp.com within 30 days; we will acknowledge within 48 hours and resolve within 30 days. |
6. Children
The App is not directed at children under 18. We do not knowingly collect data from minors.
7. Third-party Services
The current version uses no third-party SDKs that collect personal data. The following are used locally, without data transmission:
| Library | Purpose | Data access |
|---|---|---|
| Drift (SQLite) | Local database | On-device only |
| flutter_secure_storage | Key storage | OS keystore only |
| local_auth | Biometric lock | OS biometric API only |
Crash reporting (opt-in, off by default): If you choose to turn on “Crash reports” (offered once during setup, and always available in Settings → Privacy), the App uses Sentry to send us technical crash and error reports — stack traces, the type of error, your device model, OS version, and app version. This is off unless you explicitly turn it on, and you can turn it off again at any time. We do not send your financial data as part of this: every report is scanned and stripped of anything that looks like an amount, balance, account, category, contact, or note before it leaves your device, as a safeguard in addition to our engineering practice of never logging financial content in the first place. Crash reports are not linked to your identity — the App has no user accounts.
Future versions may add: cloud sync (opt-in) and subscription management. Each will be disclosed in an updated Privacy Policy before it is enabled.
8. Changes to This Policy
We will notify you of material changes via an in-app notice before the effective date. Continued use after the effective date constitutes acceptance.
9. Contact Us
Grievance Officer: Manish Talreja Email: support@kleraapp.com Response time: within 48 hours (acknowledgement), 30 days (resolution)