Privacy Policy

Welcome to Align. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our app ("Align", "we", "us", or "our"). By using Align you agree to the practices described in this policy.

Short version: We collect only what we need to run the app. We do not sell your data. Gmail access is optional and read-only. You can delete your account and all associated data at any time.

This policy applies to the Align Android application and all associated backend services hosted on Supabase. It was last updated on 25 June 2026.

1Information We Collect

1.1 Account Information

When you sign in with Google we receive:

Your name and email address
Your Google profile photo URL
A unique Google account identifier (sub)

We do not store your Google password.

1.2 Profile Preferences

Display currency preference (one of: INR, USD, EUR, GBP, JPY, CAD, AUD)
Payment currency used for Pro subscription
Preferred timezone (for notification scheduling)
App theme preference (Light, Dark, or Auto)
Language preference (currently English only)
Notification enabled/disabled toggle
Onboarding completion flag

1.3 Financial Data You Enter

All financial data is entered manually by you or imported via Gmail (see §4):

Expense reminders: title, amount, currency, category, due date, recurrence, notes
Income entries: title, amount, currency, source, date, recurrence, notes
Discretionary manual expenses: amount, category, date, notes
Payment history logs for each recurring or one-time entry

1.4 Device & Technical Information

Expo push notification token (to deliver reminders)
Device timezone (used to schedule notifications at correct local time)
App version and build number (for debugging)

1.5 Payment Information

Subscription payments are processed by Razorpay. We store only non-sensitive payment metadata: Razorpay order ID, payment ID, plan type, amount, and currency. We never store or transmit your card number, CVV, or bank credentials.

2How We Use Your Information

Purpose	Data used	Legal basis
Provide the app & sync data across sessions	Account info, financial data	Contract performance
Send bill & income reminder notifications	Push token, reminder schedule, timezone	Contract performance / consent
Process Pro subscription payments	Email, payment metadata, selected currency	Contract performance
Display analytics, charts & CSV exports	All financial entries you created	Contract performance
Gmail Smart Import (optional, Pro only)	Gmail OAuth token, email snippets	Explicit consent
Enforce free-tier limits & Pro plan rules	Plan status, entry counts	Contract performance
Improve app quality & fix bugs	Anonymised technical logs	Legitimate interest
Automated data cleanup after account deletion	All stored data	Legal obligation & contract

We do not use your data to serve advertisements. Align is entirely ad-free.

3Google Sign-In & OAuth

Align uses Google Sign-In as the only authentication method. We request only the minimum OAuth scopes required:

openid — verifies your identity
profile — your name and photo
email — your email address

The Gmail read scope (gmail.readonly) is a separate, optional consent collected only inside the app when you choose to use Gmail Smart Import (see §4). It is never requested during sign-in.

Your Google credentials are managed entirely by Google. Align receives only a secure session token via Supabase Auth and never handles your Google password.

4Gmail Smart Import (Pro Only)

Optional feature. Gmail Smart Import is available to Pro subscribers only and requires your explicit in-app consent before any Gmail access occurs. You can revoke access at any time.

What we access

When you grant Gmail access, Align reads a limited set of recent email snippets (sender, subject, short body preview) to detect billing confirmations, subscription renewals, and payment receipts. We request read-only access (gmail.readonly scope) — we cannot send, delete, or modify emails.

What we extract

Provider or merchant name
Payment amount and currency
Due date or transaction date
Detected category (Subscriptions, Utilities, etc.)
Confidence score (high / medium)

What we do NOT store

Raw email body text — never stored after extraction
Email subjects or sender addresses beyond the scan session
Any email content that is not related to billing

How to revoke

Go to Settings → Smart Import → Disconnect Gmail in the app, or visit myaccount.google.com/permissions and remove Align's access.

Align's use of Gmail data complies with Google's API Services User Data Policy, including the Limited Use requirements.

5Financial Data You Enter

All financial data in Align is entered by you. We store it securely in our Supabase PostgreSQL database to sync your entries across sessions and provide analytics, reminders, and reports.

Data categories stored

Expense Reminders — title, amount, currency, category (Subscriptions, Business, Card & EMI, Insurance, Utility, Other), due date, recurrence frequency, reminder settings, notes, payment history
Income Entries — title, amount, currency, source (Salary, Freelance, Business, Rental, Other), date, recurrence, notes, payment history
Manual Expenses — amount, currency, category, date, notes
Payment Logs — occurrence dates and amounts paid, linked to parent reminder or income entry

Multi-currency display

Align displays amounts in the currency you select for each entry. We do not perform live currency conversion. Your profile stores a default display currency preference used across the app.

Offline access

Align caches your data locally on your device using MMKV encrypted storage so the app works when you are offline. Pending changes are queued and synced to the server when connectivity is restored.

6Payment Processing

Align Pro subscriptions are processed through Razorpay, our payment partner. Razorpay accepts the following currencies for V2:

Indian Rupee (INR)
US Dollar (USD)
Euro (EUR)
British Pound (GBP)
Japanese Yen (JPY)
Canadian Dollar (CAD)
Australian Dollar (AUD)

What Razorpay collects

Razorpay collects and processes your card or UPI details directly. Align never receives, stores, or transmits raw payment instrument details (card numbers, CVV, UPI PINs, or bank credentials).

What Align stores

We store only the following non-sensitive payment metadata:

Razorpay order ID and payment ID
Plan type (Quarterly or Yearly)
Amount charged and currency
Payment status and timestamp

This metadata is used to display your subscription history in Settings → Plan Details and to verify Pro plan status.

Subscription plans

Align Pro is available in two plans:

Quarterly — billed every 3 months
Yearly — billed annually (best value)

Prices are fixed per currency and are not calculated using live exchange rates. You can view pricing for your selected currency on the Sales screen.

Razorpay Privacy Policy

Razorpay's privacy practices are governed by their own policy: razorpay.com/privacy.

7Push Notifications

Align uses Expo Notifications to deliver bill reminders and income alerts. Notifications are scheduled locally on your device based on:

Your configured reminder-before preferences (same day, 1 day, 3 days, 7 days)
Your selected reminder time (e.g. 9:00 AM)
Your account timezone (set in Settings → Timezone)

Permission

We request notification permission during onboarding. You can grant or deny permission, and you can change this at any time in your device Settings. If you deny permission, reminders are delivered only to the in-app Notification Inbox.

Push token

Your Expo push token is stored in our database linked to your account and the specific reminder it belongs to. It is used only to deliver your own scheduled reminders. We do not use push tokens for marketing messages.

Disabling notifications

You can disable all notifications in Settings → Notifications. Toggling this off cancels all scheduled local alarms. Notifications can be re-enabled at any time.

8Analytics & Export Reports

All analytics displayed in the Analytics tab and all CSV export reports are generated entirely from your own financial data that you entered into Align. We do not share this data with analytics services or advertising platforms.

CSV Export (Pro only)

Pro subscribers can export their financial data as a CSV file covering up to 12 months. Exported files are generated on demand, delivered directly to your device, and are not retained on our servers after delivery.

No third-party analytics SDKs

Align does not embed third-party analytics SDKs such as Firebase Analytics, Mixpanel, Amplitude, or similar tools. We do not track your in-app behaviour for marketing or advertising purposes.

9Data Retention & Deletion

Active account

We retain your data for as long as your account is active and for a reasonable period thereafter to allow you to reactivate.

Notification logs

Notification logs are automatically deleted after 90 days.

Soft-deleted entries (Archive → Delete Permanently)

When you permanently delete a reminder or income entry, it is soft-deleted (flagged as deleted) and hidden from the app immediately. The underlying database record is retained for 30 days for internal recovery purposes, then permanently purged along with all related payment logs.

After Pro expiry or subscription cancellation

Your data remains visible for 180 days after your Pro plan expires or your account is deactivated.
After 180 days your data is hidden from the app but retained in the database for up to 365 days to allow reactivation.
After 365 days, all reminders, payment logs, and notification logs for your account are permanently purged from the database by an automated nightly cleanup job.

Account deletion

You can request full account deletion at any time from Settings → Delete Account or by visiting: dev-dhavalp.github.io/align-docs/account-deletion.html.

When you delete your account, we immediately mark your account as deactivated. All personal data is permanently erased within 30 days. Payment transaction metadata may be retained for up to 7 years as required by applicable financial recordkeeping laws.

Our automated cleanup schedule runs nightly:
• 1:00 AM — plan expiry sweep
• 1:30 AM — inactive reminder archiving
• 2:00 AM — permanent purge of soft-deleted and expired records

10Data Security

Encryption in transit — All communication between the app and our servers uses TLS 1.2 or higher (HTTPS).
Encryption at rest — Your data is stored in Supabase's PostgreSQL database with encryption at rest enabled on the underlying infrastructure.
Local storage — Data cached on your device is stored using MMKV, which uses platform-level encryption (Android Keystore).
Row-level security — Supabase Row-Level Security (RLS) policies ensure each user can only read and write their own data. No user can access another user's records.
Auth tokens — Supabase manages session tokens using secure JWT-based authentication. Refresh tokens are rotated automatically.
Webhook verification — Razorpay payment webhooks are verified using cryptographic signature checks to prevent payload forgery.
ReDoS protection — Regular expressions used in Gmail email parsing use bounded quantifiers to prevent event-loop blocking attacks.
No third-party data brokers — We do not share, sell, or rent your personal data to any third party for commercial purposes.

11Third-Party Services

Service	Purpose	Data shared	Privacy policy
Supabase	Database, authentication, edge functions	All app data	supabase.com/privacy
Google OAuth	Sign-in authentication	Name, email, photo URL	policies.google.com/privacy
Gmail API	Smart Import — billing email scanning (optional, Pro)	Read-only email snippets (not stored)	policies.google.com/privacy
Razorpay	Payment processing for Pro subscriptions	Email, plan, amount, currency	razorpay.com/privacy
Expo	Push notification delivery	Push token, notification payload	expo.dev/privacy

Align does not use advertising networks, social media tracking pixels, or analytics data brokers.

12Children's Privacy

Align is not directed at or intended for use by children under the age of 13 years (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children.

If you believe a child has provided personal information through Align, please contact us at alignapps4@gmail.com and we will promptly delete the information.

13Your Rights

Depending on your country or region, you may have the following rights regarding your personal data:

Access — Request a copy of the personal data we hold about you.
Correction — Ask us to correct inaccurate or incomplete data.
Deletion — Request deletion of your account and associated data (see §9 and our Account Deletion page).
Portability — Pro users can export their financial data at any time as a CSV file from the Export Reports screen.
Withdraw consent — You can revoke Gmail access at any time (see §4). You can disable notifications at any time (see §7).
Object — Object to processing of your data where we rely on legitimate interest as the legal basis.

To exercise any of these rights, email us at alignapps4@gmail.com. We will respond within 30 days.

14International Users & Multi-Currency

Align V2 is available globally. Your data is stored on Supabase infrastructure which may be hosted in data centers outside your home country. By using Align you consent to the transfer and processing of your data in accordance with this Privacy Policy.

Align displays financial amounts in your chosen currency (INR, USD, EUR, GBP, JPY, CAD, or AUD). No live currency conversion is performed. Currency symbols are used for display purposes only. The app stores amounts as entered by you in whatever currency you select for each entry.

Subscription pricing is fixed per currency and is not calculated using live exchange rates. Your selected payment currency is stored in your profile and used consistently for all billing.

15Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the app, our practices, or applicable law. When we make material changes, we will:

Update the "Effective date" at the top of this page
Display an in-app notice or banner informing you of the update

We encourage you to review this policy periodically. Continued use of Align after changes are posted constitutes acceptance of the updated policy.