Vittova
Privacy Policy
Last updated: 31 October 2026
This policy explains what information the Vittova Android app (package com.vittova.app) and web app collect, why, who processes it, how long it is kept, and how to delete it. Vittova is an expense tracker. It does not move money, connect to your bank account, or sell your data.
1. Information you give us
- Account: your email address and name. If you sign in with Google, we receive your name and email address from Google. Passwords are handled by our authentication provider and are never visible to us. Your month and year of birth, to confirm you are 18 or over.
- Expenses: amount, category, description, date, and how it was added (manual, receipt scan, bank SMS, payment notification, or statement import).
- Budget settings: monthly budget, savings target, and recurring bills you add.
- Afford-It checks and SIP stress tests: the amount and optional description you enter are used to work out the answer and are not stored. We only count how many checks you used today, for the free-plan limit.
- Coach conversations: the questions you ask the money coach and its answers.
2. Information created while you use Vittova
- Round-up totals, logging streaks, Money Streak history (for each day: that day's mission, whether it was completed, the amount spent that day and the day's spending limit), Money XP awards, the days you mark as no-spend days, weekly Spend Score history and statement-import history (bank name, number of transactions, statement period).
- Usage counters for free-plan limits (for example, coach questions asked or money checks used today).
- Recurring-payment audit (Vittova Pro): which of your payments look recurring, what you told us about them (confirmed, intentional, unwanted or not recurring), and each next expected debit with whether a matching payment was later seen. Expected-debit reminders are scheduled on your phone; nothing is sent to a notification service.
- Save-to-Earn: the money challenges you start, their dates and whether they were completed, an estimate of spending avoided for each completed challenge (the Victory Pot), your badges and XP. These are worked out on our server from your own records and are never shared with sponsors.
- Sponsored challenges (Vittova Pro, when available): which challenges you join, whether you completed them, and the voucher issued to you. The sponsor receives only campaign totals and the voucher codes it supplied, never your transactions, balances, spending categories, scores or other personal data. We count challenge views without linking them to you.
- Basic server logs needed to run and secure the service, such as request time and error type. Logs do not contain expense amounts, descriptions or notification text.
- App usage and diagnostics: to understand how Vittova is used and to find problems, we record simple events such as the app being installed or opened, sign-in succeeding or failing (with a short reason category), an expense being added, edited or deleted, an import or receipt scan succeeding or failing, a coach answer being given, and the app showing its error screen (error type only). Each event has a time, the platform (Android or web) and the app version. The app creates a random installation ID on first launch; it is not an advertising ID or device identifier, and a reinstall creates a new one. Events contain no expense amounts, descriptions, payees, coach questions or answers, or notification text. After you sign in, events are linked to your account; if you delete your account, that link is removed.
We do not use advertising IDs, third-party analytics or crash-reporting SDKs, or location data, and we do not show ads.
3. Payment tracking on Android (optional)
Payment tracking is switched on in Vittova by default, but it only works after you allow it in Android: SMS access for your bank's debit alerts and, optionally, Notification Access for payment-app notifications. Android asks you for these; Vittova cannot grant them itself.
Bank SMS. Most payment apps do not announce a payment, but your bank sends a debit SMS. Vittova uses SMS only to find these alerts (Google Play: SMS-based money management).
- Vittova reads SMS only from the business sender IDs that banks, card issuers and payment services use (for example VM-HDFCBK). Messages from people (phone numbers) are never read.
- One-time passwords, offers and other messages that are not payments are skipped. From a debit alert, Vittova keeps only the amount, payee, bank, time and a coded reference used to avoid adding a payment twice. The message itself is not saved or uploaded.
- Vittova reads only messages that arrive after you allow SMS access; it does not import older messages.
- Vittova does not send SMS and does not request call-log access.
Payment-app notifications (optional). With Notification Access, Vittova also detects payments from these supported apps only:
Google Pay, PhonePe, Paytm, BHIM, BHIM SBI Pay, CRED, super.money, MobiKwik, Freecharge, FamPay, HDFC Bank, ICICI Bank iMobile, SBI YONO, Kotak, Axis Bank, Bank of Baroda, Union Bank, PNB, Canara Bank, IndusInd Bank, IDFC FIRST Bank.
- Notifications from every other app (for example WhatsApp, messaging, email and social apps) are ignored and not read.
For both:
- A detected payment is analysed on your phone, including while Vittova is closed. If it is a completed payment, Vittova keeps only the amount, payee name, bank or app name, time and payment type in a private queue on your device until it is uploaded or reviewed, for up to 30 days.
- Clear payments are added to your expenses automatically: the next time Vittova runs while you are signed in, the amount, payee name and time are saved to your account as an expense. If a message or notification is unclear, Vittova asks you before adding it. In Profile → Payment tracking you can choose to be asked about every payment.
- Payments detected on your phone are only added to the account signed in on it. If a different account signs in, anything still waiting on the phone is deleted.
- You can switch payment tracking off in Profile → Payment tracking, or remove SMS access or Notification Access at any time in Android settings.
4. AI features and Google Gemini
Some features send content to Google's Gemini API, operated by Google LLC, to generate a result:
- Receipt scan: the receipt photo you choose. We save the merchant name, item list and total; we do not store the photo.
- Money coach: your question and a summary of your spending figures (for example monthly totals by category, budget and upcoming bills). Your name and email are not included.
- Spending tip: when you are projected to exceed your budget, your budget, amount spent and top spending category.
- Bank statement import (when available): the text of the PDF you upload. The file is processed in memory and not stored; the extracted transactions are saved.
Google processes this content under the Gemini API Terms of Service, which describe how long Google may retain it and how Google may use it. AI output can be wrong. Please check amounts before relying on them.
5. How we use information
- To provide the app: show your spending, budget, forecasts and score, and answer your questions.
- To enforce free-plan limits and prevent abuse (for example rate limiting).
- To keep the service secure and fix problems.
We do not sell or rent personal data, and we do not use your financial data for advertising.
6. Service providers
- Supabase: authentication and database hosting.
- Render: hosting for the Vittova API server.
- Vercel: hosting for the Vittova website.
- Google: Google Sign-In (if you choose it), the Gemini API (section 4) and Google Play billing for Vittova Pro.
These providers process data on our behalf and may store it on servers outside India.
Purchases: Vittova Pro can only be bought through Google Play, which handles the payment. We receive the purchase token, the plan and the subscription status from Google Play to check the purchase and turn Pro on for your account; we never receive your card, UPI or bank details.
Notifications: Vittova does not send push notifications from a server. Expected-debit reminders, if you turn them on, are scheduled by the app and shown on your phone only.
7. Security
Data is sent over encrypted HTTPS connections. Database access rules allow each account to read only its own records, and all changes go through our server. The Android app excludes your sign-in session from device backups. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you as required by law.
8. Stored on your device
The app stores your sign-in session, whether you have completed onboarding, your payment-tracking choices, and the payment queue described in section 3. Signing out removes the session from the device. Payments still waiting in the queue stay on the phone for the same account, are deleted if a different account signs in, and are deleted when you delete your account in the app.
9. Retention
- Account and expense data: kept until you delete it or delete your account.
- Payments detected on your device and not yet uploaded: until they are uploaded, reviewed or dismissed, and at most 30 days. Payments already uploaded or dismissed are remembered on the device for 3 days only, so a repeated notification is not added twice.
- Server logs: kept for a limited period for security and debugging.
- Database backups kept by our hosting provider may contain deleted data until they expire on their normal schedule.
10. Your choices and rights
- Access and portability: export your expenses as a CSV file from Settings.
- Correction: edit or delete any expense in the app.
- Deletion: delete your account in Settings → Delete account, or follow the steps at Vittova account deletion. Deleting your account removes your login, profile, expenses, bills, score, streak and Money XP history, import history and coach conversations, and the group pools you created.
- Withdraw consent: switch off payment tracking in Profile or remove SMS access or Notification Access in Android settings, or stop using AI features.
To exercise any right or raise a grievance, email support@vittova.in.
11. Children
Vittova is intended for people aged 18 and over. When you sign up we ask for your month and year of birth (never the day) to check this, and we keep only the month and year. If you are under 18, we do not create an account; an account created through Google sign-in is stopped straight away, no spending data is processed for it, and it can be deleted in one tap. We do not show ads, and we never use age or financial data for advertising. If you believe a child has created an account, contact us and we will delete it.
12. Not financial advice
Vittova provides expense tracking and general financial education. It does not recommend any security, fund, broker or platform and is not a SEBI-registered investment adviser.
13. Changes
If we change this policy we will update the date above and, for significant changes, tell you in the app before they take effect.