Burnly Privacy Policy
Version 1.0 · Effective: the date Burnly is first published on an app store · Last updated: 2 November 2026
Prepared by the publisher without separate legal review, against the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). This policy is available in English. On request to [email protected] we will provide it in Hindi, Tamil or any other language in the Eighth Schedule to the Constitution.
1. Who we are
Burnly is published by Udaya Krishnan, an individual based in Chennai, Tamil Nadu, India ("we", "us"). For data you give us to run your account, we are the Data Fiduciary under the DPDP Act.
Contact for any question about your data (DPDP Rule 9): Udaya Krishnan, Grievance Officer, [email protected]. General support: [email protected].
2. What Burnly does
Burnly is an expense tracker. It shows how much you can safely spend today, based on your income, fixed commitments and spending. It works on your phone first.
3. Data that stays on your phone
We do not receive this data unless you choose a feature in section 4 that sends it. - Transactions, card nicknames and last 4 digits, merchants, categories, budgets, fixed commitments and settings. They are kept in an encrypted database on your device. - Auto-capture (optional). If you turn it on, Burnly reads payment alerts on your device. These are bank SMS on the Android version that includes SMS access, and payment-app or bank notifications. From each alert it keeps only the amount, date and time, merchant, payment type and card or account last 4 digits. - Burnly ignores and does not store one-time passwords (OTPs), personal messages and promotional messages. - The full text of a message is never stored and never leaves your phone. - Burnly never sends SMS. - You can turn Auto-capture off at any time in Settings.
4. Data we collect, why, and where it goes
| Data | Purpose | Where it is processed |
|---|---|---|
| Mobile number, email address, or Google account name and email | Sign you in and keep your account secure | Google Firebase Authentication |
| Household data, only if you use Household. Includes member first names and roles, Home Pool entries, a Dependent's monthly allowance and reported spend, and alert settings | Run shared budgets between members of your household | Google Cloud Firestore, Mumbai region (asia-south1) |
| Encrypted backup, only if you create one | Restore your data on a new phone | Google Cloud Firestore, Mumbai region (asia-south1), stored as an encrypted file. Encrypted on your phone with a passphrase only you know. We cannot read it or recover the passphrase |
| Subscription status (plan, renewal date, store transaction ID) | Unlock paid features | RevenueCat, Google Play, Apple App Store |
| App version and a device check token | Keep the app up to date and block abuse of our servers | Google Firebase Remote Config and App Check |
| Usage and crash data, only if you opt in | Fix bugs and improve the app | Google Firebase Analytics and Crashlytics (when enabled). Never includes amounts, merchants, names or message text. Never collected for Dependents |
| Emails you send to support@ or grievance@ | Answer you | Cloudflare Email Routing forwards them to our inbox |
| Feedback you send from the app (your message, the type, an optional rating, app version, phone platform and your account ID) | Read and act on your feedback, and reply if you ask | Saved in Google Cloud Firestore, Mumbai region, and emailed to our support inbox through Resend (an email delivery service that may process data outside India). Do not put passwords, card numbers or other private details in feedback |
Never uploaded: your personal transactions, unless you put an entry in the Home Pool or create an encrypted backup.
5. Legal basis
- We process your data on the basis of the consent you give at sign-up and for each optional feature.
- You can withdraw any consent as easily as you gave it: in Settings > Data & privacy, or by writing to [email protected].
- Withdrawal does not affect processing done before it. Some features stop working without the data they need.
6. Dependents and age
- Burnly is for adults. You must be 18 or older to use it. We do not offer profiles for anyone under 18 and we do not knowingly collect data about children.
- A Dependent is an adult (18 or older) in your household who gets a monthly allowance from the household Admin.
- Before the profile is created, the Admin must confirm that the person is 18 or older and has agreed to be added, and gives consent. We keep a record of that consent: who gave it, when, and which text version.
- For a Dependent we keep only:
- first name
- monthly allowance
- the total the Dependent reports spending in the current month
- We do not show roasts, ads or targeted content to Dependents. We do not track or profile their behaviour. We collect no analytics about Dependents.
- The Admin or the Dependent can withdraw consent at any time. The Dependent's household data is then erased.
- If you believe a person under 18 has been added, write to [email protected] and we will remove the profile and its data.
7. Sharing
- We do not sell or rent your personal data, and we do not use it for advertising.
- We share it only with the service providers named in section 4. They act on our instructions as Data Processors.
- We also share it when a law or a lawful order requires it.
- Some providers, such as RevenueCat, Resend (feedback email) and the app stores, may process data outside India. We do not transfer data to any country the Government of India has restricted.
8. Your rights
You can: - Access a summary of your data and how it is processed. - Correct, complete or update it. - Erase it. - Withdraw consent. - Nominate another person to exercise your rights if you die or become unable to. - Complain to our Grievance Officer, and then to the Data Protection Board of India.
How to exercise these rights: - In the app: Settings > Data & privacy lets you export your data and delete everything, on the device, in the cloud and in backups. Deletion is permanent. - By email: write to [email protected] from your registered email, or include your registered mobile number. Never send passwords or your backup passphrase.
9. Grievances
- We acknowledge a grievance within 48 hours.
- We aim to resolve it within 30 days.
- In every case we respond within the 90 days allowed by DPDP Rule 14(3).
- If you are not satisfied, you may complain to the Data Protection Board of India.
10. Retention
| Data | How long we keep it |
|---|---|
| Data on your phone | Until you delete it or uninstall the app |
| Account and household data | Until you delete your account or leave the household. Then it is erased within 30 days |
| Encrypted backups | Until you delete them or your account |
| Feedback you send from the app | Until you ask us to delete it or you delete your account |
| Dependent consent records | For one year after consent is withdrawn, as proof that consent was obtained |
| Security and processing logs | At least one year, as DPDP Rules 6 and 8(3) require. Then deleted |
11. Security
- An encrypted database on your phone.
- Encrypted backups.
- Access rules that let each person see only their own data and their household's shared data.
- Encrypted connections, access controls, logs and monitoring, and backups of our cloud data.
- No system is perfectly secure.
12. Data breaches
If a personal data breach affects you, we will tell you without delay through the app or your registered contact. We will explain: - what happened - the likely effect - what we are doing - what you can do
We will report it to the Data Protection Board of India as the DPDP Rules require, including a detailed report within 72 hours.
13. Changes
We will tell you in the app before any material change to this policy. If a change needs new consent, we will ask for it.