The short version
Your cards, spends and plans live in a database on your phone, backed up to your Krediit account so they can follow you to a new phone — readable by your account alone. We show no ads and no advertising or tracking SDKs, and never sell or share your data. We count anonymous screen views to see which parts of the app get used — never tied to you or to what is in your wallet. If you choose to connect Gmail, your card emails are read on your phone and never reach our servers.
Who we are
Krediit (“we”, “us”) is a credit-card rewards optimizer for India-issued cards, available on Android and iOS. For anything in this policy, contact support@krediit.app.
Data stored on your device
The cards you add to your wallet, spend amounts you enter or import, planned purchases, reward-point balances, Pro status and app settings are stored in a local database on your device. This data never leaves your device unless you sign in (see Backup & sync). Deleting the app deletes it.
Account
Using Krediit requires an account — it keys the backup that lets your wallet follow you to a new phone. If you sign in with Google or Apple, we receive your name and email address from that provider; if you sign up with email, you give them to us directly. Our authentication provider (Supabase) assigns your account an identifier. We use these only to show you're signed in and to key your backup.
Krediit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Backup & sync (only when signed in)
When you're signed in, your wallet, spends, planned purchases and Pro status are backed up to our database (hosted by Supabase) so they can follow you to a new phone. Row-level security ensures this data can be read and written only by your own account. Spends and reward-point balances read from your email are the exception: they stay on the phone and are not backed up (see Email statement reading). Syncing can be turned off in Settings, and signing out stops it; to have your backed-up data deleted, email support@krediit.app.
Statement import (optional, Pro)
If you import a statement PDF, it is read entirely on your device: the app extracts only the results — card name, last 4 digits, transaction amount, merchant, date and reward-point balances. The file itself is not uploaded, stored or shared, and no human reads it.
One narrow exception, off by default: if a statement can't be read by the on-device rules or on-device AI model and smart extraction is enabled, the relevant text excerpt is sent over an encrypted connection to our server function, which uses Anthropic's Claude API to return only the structured fields above. The excerpt is processed transiently, never stored, and used for nothing else.
Email statement reading (optional)
If you connect Gmail, Krediit asks Google for read-only access to your mailbox and uses it for one thing: finding the card alert and statement emails your banks send you, to spot the cards you hold, your spends and your reward-point balances. Nothing else in your mailbox is looked at. Krediit never sends, deletes, changes or labels an email.
Everything is read on your device. The emails, their statement attachments and the spends and balances read from them are never sent to a Krediit server or to any AI service, no human reads them, and they are not included in your account backup. To open a password-protected statement, the app may use details found in those emails — such as your name, date of birth, mobile number, PAN or card digits; these are stored only on your phone and never synced.
One thing does reach your backup: if a card found in your email is added to your wallet, that wallet entry — which card it is and its last digits — is backed up like any card you add yourself. No email content travels with it.
Access to Gmail is granted by you on Google's own consent screen and is never requested without you asking for it. If you also switch on automatic reading, the app checks for new card emails in the background, roughly once a day and when you open it, and may add a card it finds to your wallet; that switch is off until you turn it on. “Disconnect Gmail” in the app revokes Krediit's access at Google, and you can also remove it at any time from your Google Account's security settings. Signing out removes everything read from your email from the phone.
Krediit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is not used for advertising, not sold, not shared with anyone, and not used to develop or train AI or machine-learning models.
Card catalog & news
The app periodically downloads its card database, themes and the Pulse news feed from our servers. These requests carry standard network metadata (such as your IP address) but no account identifiers, and we don't log or profile them.
Anonymous usage statistics
To learn which screens are worth improving, the app records that a screen was opened — the screen's name only, such as “wallet” or “card detail”. It never records which card, goal, offer or amount you were looking at, what you tapped, or anything you typed.
These counts are processed by Aptabase, a privacy-focused analytics service, and carry no account id, device id, advertising id or any other identifier that persists. Each event includes only your app version, OS version, device model and language, plus a random session id that is discarded after an hour of inactivity — so sessions cannot be joined together into a profile of you, by us or by anyone else. Nothing here is used for advertising.
Purchases
The Krediit Pro subscription is processed by Google Play or the Apple App Store. We never see your payment details; we only record that Pro is unlocked.
What we never collect
No full card numbers, CVVs, PINs, OTPs or banking credentials — Krediit never asks for them and cannot access them. No location, contacts or advertising identifiers. No ad or cross-app tracking SDKs of any kind, and nothing that profiles you across other apps or websites. We do not sell, rent or share your personal data with anyone.
Security
Local data is protected by your device's storage sandbox. Anything synced travels over TLS and is protected by per-user row-level security in our database. Statement passwords — whether you save them or the app finds them — stay on the device and are never synced. Access to Gmail is held in your phone's secure storage (the iOS Keychain, or Google Play services on Android) and never passes through our servers.
Deleting your data
On-device data: uninstall the app or clear its storage. Backed-up data: sign out to stop syncing, and email support@krediit.app from your account address to have your backup and account deleted — we complete deletion within 30 days.
Children
Krediit is a credit-card tool and is not directed at anyone under 18.
Your rights & grievances
Under India's Digital Personal Data Protection Act, 2023 you may request access to, correction of, or deletion of your personal data, and withdraw consent at any time. Write to our grievance contact at support@krediit.app; we respond within 30 days.
Changes to this policy
If we change what data is handled or how, we'll update this policy in the app and revise the effective date above before the change takes effect.