Svakosh Privacy Policy

Effective date: 5 October 2026
App: Svakosh (Android and iOS)
Publisher: Authentic Technologies, Postal address — to be published before the app launches, India
Contact: Privacy contact email — to be published before the app launches

The short version

• We collect nothing. No name, no email, no phone number, no device ID, no usage statistics.
• Your data stays on your phone, encrypted. We do not run any server that receives it.
• No account, no sign-up, no login.
• No analytics, no advertising, no tracking, no crash-reporting tools.
• The Android app does not even have permission to use the internet.
• Backups go only where you send them, and they are encrypted with a passphrase only you know.
• Payments are handled by Google Play or Apple, not by us.

1. Who we are

Svakosh is published by Authentic Technologies ("we", "us"). Svakosh is a personal planner for tasks,
follow-ups, notes, expenses and money received (receipts), designed so that your information never
leaves your device unless you choose to move it.

2. What information the app handles, and where it is kept

When you use Svakosh you may enter:

• tasks, reminders, recurrence rules and their status;
• notes against tasks;
• expenses (amount, date, category, payee, payment method, note);
• receipts of money (amount, date, Bank or Cash, bank name, reference number such as UTR or
  cheque number, received from, note);
• attachments such as photos, PDFs or scans of documents;
• your settings (reminder times, quiet hours, language, currency, lock preferences).

All of this is stored only on your device, inside the app's private storage:

• the database is encrypted with SQLCipher using a random 256-bit key;
• attachments are encrypted individually with AES-256-GCM using a separate random 256-bit key;
• both keys are generated on your device the first time you open the app and kept in your phone's
  secure key store (Android Keystore / iOS Keychain). They are tied to that device and are never
  sent anywhere.

We never receive this information. We cannot see it, recover it, or hand it to anyone.

3. What we do not do

• We do not create user accounts or ask you to log in.
• We do not use analytics, advertising, attribution, profiling or crash-reporting software.
• We do not request a push-notification token. All reminders are scheduled locally on your phone.
• We do not sell, share or rent any data, because we have none.
• We do not use your data to train any model or for any purpose of our own.

4. Notifications

Reminders, follow-ups, the evening review and backup reminders are local notifications
created by the app on your phone. By default they show generic text such as "You have a task due"
so that task titles and amounts do not appear on your lock screen. You can choose to show details in
Settings. If you do, the operating system may also show that text on connected devices such as a
smartwatch or car display.

5. Backups and exports

• Encrypted backup. You can create a backup file (.svakosh) containing your data and
  attachments. It is encrypted with AES-256-GCM, using a key derived from a passphrase you choose
  (Argon2id). We never see your passphrase and cannot recover it. If you lose it, the backup
  cannot be opened by anyone, including us.
• You choose where the backup goes through your phone's share or save sheet (for example Files,
  Google Drive, email or a computer). The app does not upload it anywhere. Once you send it to a
  service, that service's privacy policy applies to the (encrypted) file.
• Exports (CSV and PDF) are created on your device and shared only when you choose to. Exports
  are not encrypted, so treat them like any other financial document.
• Phone (OS) cloud backup is switched off for Svakosh on purpose, so your data is not copied to
  Google or Apple cloud backups. This means a new phone restored from a phone backup will not contain
  your Svakosh data. Use a Svakosh backup to move to a new phone.

6. Purchases

Svakosh offers optional paid features (a one-time lifetime unlock and an annual plan). Purchases are
processed entirely by Google Play or the Apple App Store. They handle your payment details
and account under their own privacy policies:

• Google: https://policies.google.com/privacy
• Apple: https://www.apple.com/legal/privacy/

The app only reads the purchase status that the store provides on your device, so it knows which
features to unlock. We do not run a license server and we do not receive your payment details.
The stores may give us sales reports (for example, number of purchases and country), as they do for
every app; these do not include anything you have stored in Svakosh.

7. Diagnostics from Google and Apple

Svakosh contains no crash-reporting tool. Separately, Google Play and Apple may share aggregated
technical reports with app developers (for example crash and "app not responding" statistics) if
you have allowed this in your phone's settings. These reports are generated by the operating system,
are governed by Google's and Apple's policies, and are designed to contain technical information such
as device model and stack traces, not the content you store in Svakosh. You can turn this sharing off
in your phone's settings.

8. Permissions the app uses

The Android app does not request the internet permission.

9. Children

Svakosh is a productivity and money-record tool for adults and is not directed at children. Because
the app collects no personal data from anyone, it does not knowingly collect data from children
either.

10. Your rights and choices

Because we hold no data about you, there is nothing for us to access, correct, export or delete on
our side. You are fully in control on your device:

• See or export your data: use Reports and Export (CSV/PDF), or create an encrypted backup.
• Correct your data: edit any entry in the app.
• Delete your data: delete individual entries (and empty "Recently deleted"), use the in-app
  option to delete all data, or uninstall the app. Uninstalling removes the database, attachments and
  keys from the device. Backup or export files you have saved elsewhere are not affected; delete them
  wherever you stored them.
• Withdraw permissions: at any time in your phone's settings.

11. India: Digital Personal Data Protection Act, 2023

We have designed Svakosh so that we do not collect, receive or process your personal data. In our
understanding, this means we do not act as a Data Fiduciary for the information you keep in the app;
it remains under your sole control on your device. If you have any question or grievance about
privacy, you may still contact us (Section 14) and we will respond.

Users outside India: the same design applies everywhere. Since no personal data is transferred to
us, there is no cross-border transfer by us.

12. Security

We protect data on the device with encryption, keys in the phone's secure key store, optional app
lock, screenshot blocking (on Android, on by default), hiding the app preview in the app switcher,
and generic lock-screen notifications. No method is perfect: if your phone is unlocked and in
someone else's hands, or if the phone's operating system is compromised (for example rooted or
jailbroken with malicious software), your data may be exposed. Please use a device screen lock and
consider turning on Svakosh app lock.

13. Your responsibility for backups

Since your data exists only on your phone, if the phone is lost, broken or reset and you have no
Svakosh backup (or have forgotten its passphrase), the data cannot be recovered. The app reminds
you to back up regularly. Please keep at least one recent backup somewhere safe.

14. Contact

Authentic Technologies
Postal address — to be published before the app launches
Email: Privacy contact email — to be published before the app launches
Grievance officer (if required): Grievance officer — to be published before the app launches

15. Changes to this policy

If we change this policy, we will update the effective date above and publish the new version at
https://svakosh.fly.dev/privacy and in the app's Privacy screen. If a change would ever affect the core promise that
your data stays on your device, we will tell you clearly in the app before it takes effect, and you
will be able to export your data and stop using the app.

Why we can promise this

You do not have to take our word for it. The design can be checked:

1. No internet permission on Android. Any Android app's permissions are listed on its Google
   Play page ("App permissions" / "About this app") and in your phone's app settings. Svakosh's
   Android release build does not declare android.permission.INTERNET, so the operating system will
   not let the app open a network connection. Anyone can also inspect the APK's manifest with
   standard tools (for example aapt dump permissions).
2. Automated build check. Our build pipeline runs a check (scripts/check-privacy.mjs) that
   fails the build if the final Android manifest contains a network permission, or if any known
   analytics, advertising, attribution or crash-reporting library appears among the app's
   dependencies.
3. No accounts. There is no sign-up screen and no login, because there is no server to log in to.
4. Store privacy labels. Our Google Play Data safety section and Apple App Privacy label both
   declare that no data is collected.
5. Software bill of materials. For each release we generate a list of every software component
   the app ships with, which can be reviewed on request.

On iOS, Apple does not offer an equivalent "no internet" permission. The same code, the same
dependency check and the absence of any networking or analytics code apply there.