runi1. Who provides Runi
Runi is a personal finance tracker for Android and iOS, provided under the Runipe brand by Auvana Ventures Private Limited. Privacy and support: support@runipe.com. This policy is effective from 14 November 2026, version 1.1.
Your ledger and financial calculations stay on your device. Runi has no online account, bank connection or cloud sync. It works without an internet connection.
Runi uses Google Analytics and Firebase Crashlytics to collect app usage and diagnostic data automatically. Financial records are not sent. You can turn off Usage analytics and Crash reports separately in Settings. Section 3 explains the technical data these services process and the limits of those controls. Exports and shares you choose can also leave the device through another provider.
This policy covers Runi and, in section 14, visits to runipe.com and separate support correspondence. It does not give us remote access to your ledger.
2. What is processed locally and why
| Local information | Purpose and choices |
|---|---|
| Account names/types, currencies, opening balances, income, expenses, transfers, categories, dates and notes | Maintain your manual ledger and calculate balances and summaries. These are not connected bank accounts. |
| Budgets, goals and contributions, bills and recorded payments, journal notes | Show plans, progress, due items and your own notes. A recorded bill payment moves no money. |
| Optional offline profile: name and, if you provide them, age, gender and UPI ID | Display your local profile. An optional UPI ID can appear on INR receivable QR slips you choose to share; syntax checks do not verify ownership. Guest use does not require a profile. This information is not sent to us. |
| Saved people's names and optional labels; equal/exact splits, loans, borrowings, repayments and reminders | Calculate your shares and amounts owed, and remind only you. Runi does not access contacts, invite people or maintain a shared online ledger. |
| Manual confirmations, reversal reasons, financial revisions, dates and local record times | Retain original entries and linked corrections for your reconciliation. These are not bank verified records or independently certified evidence. Archiving retains history. |
| Reviewed slip snapshots: person name, amount/currency, reference, capture time, optional UPI ID and selected receipt/bill photo | Keep a local historical copy and prepare your chosen text, image or PDF share. A saved snapshot records the reviewed facts, not proof of delivery or payment. |
| Optional onboarding password verifier and separate app lock passcode verifier | Support local credential functions. A verifier is a salted cryptographic result, not the original secret. The onboarding password is separate from app lock and does not create an online login. |
| Language, theme, currency, hide balances and reduced motion preferences; reminder/lock settings, local prompt history and device notice acknowledgment | Apply your choices. Device locale/region can suggest language/currency; time zone information supports local scheduling. This is not GPS or location tracking. |
| Local device integrity signals and acknowledgment | Display a device safety warning when local checks indicate risk; no remote attestation or reporting. |
| Lock attempt count and retry time; local operation and import markers | Apply retry delays and avoid duplicate writes/imports. These are local records, not analytics sent to Runipe. |
| Files you select for backup restore or CSV import | Read, validate, preview and import locally after your confirmation. Runi does not read your whole document library. |
| Derived totals, charts and insights | Deterministic local calculations, with no remote AI, profiling service, credit scoring or professional advice. |
Names and notes may identify you or others. Financial details and credential verifiers deserve particular protection. Do not enter information you lack authority to keep or unnecessary secrets such as bank credentials or full card authentication details.
3. Usage analytics and crash reports
Google Analytics helps us understand app usage. Firebase Crashlytics helps us identify and fix crashes. Both are enabled automatically in the release app unless you turn them off in Settings. Debug and profile development builds do not enable these services.
Google Analytics processes app instance identifiers, automatically collected usage and session events, device and operating system information, app version, and connection information used by the service, which can include approximate region derived from an IP address. These are technical usage records, not your financial transactions. Runi does not send custom financial events, profile fields, user IDs, record names, amounts, notes, photos or screen arguments to Analytics. Advertising identifier collection, advertising storage, advertising user data and ad personalization are disabled. Runi does not use advertising or cross-app tracking.
Crashlytics processes installation and session identifiers, crash times, app and device information, operating system details and crash traces. Runi replaces Dart application error messages with fixed diagnostic codes and sanitized source stack traces; it does not attach your financial records or arbitrary application logs. Native or operating system crash artifacts may contain additional technical context. A diagnostic safeguard is not a guarantee about every artifact produced by a compromised device or its operating system.
Google processes telemetry for these services, and authorised Runipe personnel can review the resulting reports. Processing may take place outside India on Google's infrastructure. The services use encrypted network transport. See Google's privacy policy at https://policies.google.com/privacy and Firebase's data handling information at https://firebase.google.com/support/privacy. These services do not create a remote ledger, verify payments or give us access to your local profile, files or credentials.
Turn off Usage analytics to stop Analytics collection on that installation and reset its local Analytics data. Turn off Crash reports to disable crash report uploads and discard unsent reports; queued reports are also discarded before reporting is enabled again. The switches are independent and persist across app launches. Turning them off does not recall data already received by Google. Core record keeping continues without either service or an internet connection.
Telemetry is retained under the service's configured retention and deletion controls. Google states that Crashlytics retains crash traces and associated identifiers for 90 days before starting removal from live and backup systems. Analytics retention depends on the property's settings; aggregated reports can have different retention from individual events. Contact support@runipe.com for a request concerning telemetry we can identify and control. We do not ask you to send a ledger to make such a request.
Runi does not connect to banks, UPI, account aggregators or financial data providers, read transaction SMS, perform KYC, or obtain biometric templates or precise location. A QR encodes user entered instructions locally; Runi does not open that payment URI or receive a payment callback. We do not sell your local records or use them to train models. Your chosen exports and shares remain separate from telemetry.
4. Permissions and device features
| Feature | Access and reason | Your control |
|---|---|---|
| Local bill/People reminders and budget alerts | Notification authorisation on iOS and Android versions that require it; Android notification/vibration support and reboot reception to reschedule reminders | Decline or revoke notification permission in OS settings, or turn off reminders/alerts. The ledger remains usable. No reminder is sent to another person. |
| Optional biometric unlock | Android USE_BIOMETRIC; iOS Face ID purpose text and the OS biometric authentication interface |
Enable only if you choose; disable in Runi. The OS returns an authentication result. Runi and Runipe do not obtain fingerprint images, face scans or templates. |
| Backup, restore, CSV and receipt/bill photos | System document pickers/save dialogs for the specific file or destination you choose; photos are selected files, without an in app camera | Cancel the dialog or select another file/location. No broad storage, photo library or contacts permission is requested for these functions. |
| Sharing a slip | OS share menu receives only the prepared text/files; your chosen app or service can pass them to recipients or cloud storage | Review the preview and attachments before choosing a destination. Runi has no WhatsApp integration or automatic recipient messaging. |
| Locale, region and time zone | Local OS information used for presentation and scheduling | Adjust app/OS settings; no device location permission is needed. |
Runi does not request camera, microphone, contacts, SMS, phone, GPS, advertising tracking or bank access. Android reminders use inexact scheduling rather than an exact alarm permission. Android uses internet access for the telemetry in section 3. iOS has no equivalent general internet permission. Financial functions remain local and do not depend on these requests.
5. Storage and security
Your main records live in an encrypted SQLite database on the device. The pinned cipher is named chacha20 in SQLite3MultipleCiphers and uses ChaCha20-Poly1305. Its random database key is held in Android Keystore backed secure storage or Apple Keychain, with device bound settings. It is not your six digit app passcode or backup passphrase. The app checks the cipher at open and is designed to refuse unsafe access rather than fall back to plaintext.
Android disables app backup and explicitly excludes app data from cloud backup and device transfer. On iOS the ledger directory, including recovery files, is excluded from OS backup and uses complete file protection. Keys are not synchronised to another device. These protections apply to private app data, not files you deliberately save elsewhere.
Sensitive screens use available screen protection measures and an app switcher privacy cover. These are safeguards, not a guarantee against every screenshot, compromised OS, malicious keyboard, physical observer or forensic attack. App lock does not add a second encryption layer or remotely manage the device. Avoid sharing unlocked devices and use an OS lock.
No system is perfectly secure. Crash reporting can alert us to technical failures; it is not a monitored security incident or emergency reporting channel. Report concerns separately to support@runipe.com, with secrets and financial content removed. If an incident affects information held separately by Runipe, applicable notification obligations concern that separate processing too.
6. Encrypted backups and recovery copies
You choose whether to create a portable encrypted .runi backup, its passphrase and where to save it. Version 1 uses Argon2id key derivation and XChaCha20-Poly1305 authenticated encryption. The backup contains supported financial records, journal/profile information, People records, retained slip snapshots and receipt copies, correction history and selected portable preferences, rather than every device setting. Database keys, onboarding/app lock credential verifiers, biometric choices and retry state are not portable backup content. Limited format/header metadata, such as version and creation information, is not all secret; financial content is encrypted.
We do not receive the file or passphrase, keep a recovery key or offer passphrase reset. A forgotten passphrase or lost file can make recovery impossible. Protect both and verify a backup before relying on it.
Ordinary restore normally retains one encrypted local safety copy of the previous ledger, protected by a separate device held secret, for "Restore previous ledger". Confirmed restore can replace current records; an explicitly chosen low space option may proceed without a new safety copy. Recovery can retain old encrypted stores and keys in a separate device location. These copies remain private app data and are not sent to us.
Backup operations use private staging files. Saved or cancelled export staging is removed; a failed save may retain it for retry, and leftover staging is swept at a later launch. Selected restore files can remain staged while you retry authentication. These operational copies are different from the external file you chose and the retained recovery data described in section 9.
If you choose iCloud Drive, another cloud backed provider, shared storage or a recipient, that provider or recipient may receive the file through the OS. Their own privacy and retention practices apply. This is your chosen file transfer, not Runi cloud sync. Keep passphrases separate from transferred files.
7. CSV, slips and user directed sharing
CSV export produces readable, unencrypted transaction data. Encryption of the app database does not encrypt the exported CSV. Other apps, recipients or a cloud folder can read it according to the destination's access rules.
CSV import processes the file you select locally, in memory, and does not upload it. Review columns, date formats, account selection and duplicates. The selected source file remains where you obtained it; Runi does not delete it. CSV reports are not complete .runi backups and do not include every record or setting. Remove unnecessary external copies, including cloud versions and trash, through their respective providers.
Slips, photos and OS sharing
A receipt or bill photo is optional and off by default. Runi reads the selected PNG/JPEG locally and makes a resized PNG copy for the reviewed slip. It does not scan the receipt for transactions, authenticate it or automatically redact visible information. Review names, addresses, card details and anything else in the image before sharing. Selecting or removing the attachment does not delete your original photo.
Before an intentional share, Runi saves a historical snapshot in its encrypted database, including the selected photo and optional UPI ID. This copy can remain even if you cancel the OS chooser or the share fails; it is not a delivery log. Changing your profile, recording repayment or undoing confirmation does not rewrite historical snapshots.
The selected text, image or PDF is readable outside the encrypted database. Text sharing contains the summary and any included UPI ID and can attach the selected receipt separately. Runi adds no payment link to the text. Image/PDF formats include the reviewed preview, with a QR only if selected and eligible. The share workflow uses temporary plaintext files and, on Android, temporary read only recipient copies. It attempts cleanup and sweeps old staging files later; cancellation is not a secure erasure guarantee. Recipients and chosen apps may store, upload or forward copies under their own practices, including through a messaging service such as WhatsApp. Runi cannot inspect their retention or recall those copies. Shared copies cannot be updated or revoked, and an old QR may still be scanned after the record changes. Editing/removing the profile UPI ID affects future slips only.
8. Notifications and app lock
Bill reminders, People reminders and budget alerts are scheduled or generated locally, without a push notification server or remote push token. Their visible content is generic and their payload identifies a route, not amounts, balances, payees or account names. Notification history and lock screen display remain subject to OS settings. A notification tap does not bypass app lock.
Optional app lock stores a salted Argon2id verifier for a separate six digit passcode on the device, together with settings and retry delays. Biometrics are optional and managed by the OS. A failed or cancelled biometric attempt returns to the app passcode; it does not use the phone PIN as an app passcode reset. Credentials and lock settings do not travel in a .runi backup. An ordinary restore preserves the destination's lock; recovery into a fresh store can require setting it up again.
9. Retention, Start fresh, uninstall and deletion
We have no remotely held Runi ledger and no central retention timer for your device. Current records remain locally until changed, deleted through an available feature, replaced by a restore, set aside or removed by OS app data removal. Some referenced accounts/categories, people and debt records are archived rather than physically deleted. Archiving does not erase a name, cancel an obligation or remove confirmations, reversal reasons, revisions, saved slip snapshots or receipt copies. Current People controls preserve correction history; they do not provide selective erasure of that retained history. Deleting a current row does not delete older backups or recovery copies, and secure overwriting of flash storage is not guaranteed.
Start fresh does not erase all data. It sets aside the old encrypted database and key, plus existing safety copies and their secrets, then starts an empty ledger. The app does not automatically purge those set aside files or keys and provides no in app recovery of them in the current flow. It resets your profile and app lock, retains theme, language, reduced motion and hide balances choices, and cancels reminders/delivered notifications. OS permission settings remain. Recovery operations may also retain encrypted old stores indefinitely until app data removal. Do not treat either operation as a complete erasure request being fulfilled.
Uninstalling normally removes private app files, including set aside files, subject to OS behavior. iOS offloading retains documents/data; deleting the app is different. Android clearing app storage can remove private files but destroys access to records unless you kept a usable backup. Keychain or other secure store items may remain after uninstall; we do not promise that uninstall erases all keys. Before selling a device or when complete removal is essential, follow the manufacturer's full erase procedure and remove external backups separately. No remote support request lets us wipe your phone.
User saved .runi files, CSVs, shared slips and photos, source imports, cloud histories, trash, external storage and recipients' copies have their own retention. Delete those separately where required. We cannot recall them. Separate support correspondence has the retention rules in the Runipe policy.
Telemetry has separate retention and opt-out controls described in section 3. Removing local ledger records or using Start fresh does not remove reports already received by Google. Uninstalling does not recall external or telemetry copies.
10. Children and age
For Indian data protection purposes, a child is generally a person under 18. Runi is not directed to children and provides no children's online account, targeted advertising or age verification service. Automatic telemetry is described in section 3; a local age entry does not change those settings or establish verifiable parental consent.
An app store age rating and the local profile field accepting ages from 13 do not establish legal capacity or make a 13 year old an adult. Where a minor's use is lawful, a parent or guardian must supervise it, review the telemetry controls and ensure any legally required consent is obtained. Ordinary terms acceptance is not a substitute for verifiable parental consent where required. No child specific service or exemption from applicable child protection duties is created by this policy.
If you believe a child's data has reached us, contact support@runipe.com so we can assess and address it. Do not send identity documents or financial records unnecessarily.
11. Your choices and privacy rights in India
The Digital Personal Data Protection Act, 2023 and final DPDP Rules, 2025 have phased commencement. Rights and duties apply when their relevant provisions are in force and the processing falls within their scope. This policy does not claim all DPDP provisions are already operational or that an offline app is automatically exempt. Purely personal/domestic processing by an individual and processing by Runipe are different legal questions.
You can review and correct records through available app controls and export supported transaction data. To stop an optional function, disable it or revoke its permission. To stop all ongoing app use, stop using/remove the app, subject to the retained file limits in section 9.
For data processed through telemetry or held separately, such as correspondence, you may contact support@runipe.com to request applicable access information, correction, completion, updating, erasure, withdrawal of consent, grievance redressal or nomination of a person to exercise rights on death or incapacity. We will explain any lawful retention or other limit. Nomination does not create a master key, unlock a device or override succession law. A CSV export is a product feature, not a representation that DPDP creates a general data portability right.
We cannot inspect, retrieve, correct, remotely erase or decrypt a local ledger on your behalf. We can explain available controls and acknowledge that we hold no app server copy. Do not send a full ledger or identity documents just to prove an app account that does not exist. For correspondence requests, we may seek proportionate verification through the contact channel used, disclosing why it is needed. There is no charge or requirement to create an account merely to raise a privacy concern.
A policy is not blanket consent. If future processing requires a specific notice and consent, we must obtain it separately. Withdrawal does not invalidate earlier lawful processing. Where the applicable DPDP complaint process is available, first use our grievance mechanism as required, then approach the Data Protection Board of India through its official process. Nothing prevents other statutory remedies.
12. Privacy requests and contact
Email support@runipe.com for privacy requests, complaints or support. Describe your concern, desired outcome and a safe reply channel. We must handle requests and complaints within any applicable statutory deadline. A response does not give us access to records we do not hold. We cannot investigate a device ledger by remotely accessing it.
13. Changes and languages
We identify policy revisions by date and version. Material changes are explained through updated bundled information and the public policy page. We have no app user account or contact list and cannot promise individual email notices. Runi does not fetch policy revisions automatically. A website update does not alter an installed app's behavior or grant new consent. Processing requiring a specific notice, permission or consent must meet that requirement before it starts.
The bundled legal summaries are currently in English. The app identifies this when another interface language is selected. Interface translations do not constitute reviewed translations of these policies. Ask support@runipe.com for clarification or available language assistance. No language precedence rule removes rights to information in a language required by applicable law.
14. This website and correspondence
Visiting runipe.com is separate from using Runi. Your browser sends connection information, such as your IP address, browser information and the requested page, to the website host to deliver and protect the site. Hosting logs may be processed for delivery, security and fault investigation.
The public website does not set visitor cookies or use analytics or advertising trackers, load third party fonts or embed third party media. It has no account, payment, waitlist or contact form. Opening an email link uses your chosen email service, which has its own privacy terms.
If you email us, we receive your email address, message and any attachments you choose to send. We use correspondence to respond, investigate your request and meet applicable legal obligations. Only provide information needed for your request. Do not send passwords, passphrases, UPI PINs, full ledgers or unredacted financial records.
We retain correspondence only as needed to resolve the request, maintain necessary follow up and meet applicable legal obligations. Email and hosting providers may process the information required to provide their services. We do not sell support correspondence or use it for advertising. To request access, correction or deletion of information we hold, contact support@runipe.com. Legal retention requirements and other applicable rights may affect the response.