Privacy notice
What OnlyWallet stores, what we can and cannot read, who processes it, how long we keep it and how you can see or delete it. Written in plain language.
Effective 22 October 2026
This notice explains how Beyond Basics ("we", "us"), based in Bengaluru, Karnataka, India, handles personal data when you use the OnlyWallet apps, the web app at app.onlywallet.in, the OnlyWallet browser extension for Chrome and Edge (together, the "App") and this website, onlywallet.in (the "Website"). It is given under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules") and the Information Technology Act, 2000 and the rules made under it.
Summary
- We cannot read your vault. Document details, card numbers, passwords, notes, scanned text and file names are encrypted on your device with a key that only your master password (or your 24-word recovery phrase) can unlock. We never receive your master password or recovery phrase.
- Some details are readable to us so the App can sort, remind and sync: for example titles you have not marked private, categories, dates and amounts. The full list is in section 2.
- Your files live in your own Google Drive, encrypted before upload. We do not store them.
- We do not sell your data. There are no ads, analytics, advertising SDKs or crash-reporting tools in the App.
- You can export an encrypted backup and delete your account yourself in the App. Questions and complaints go to our Grievance Officer.
1. Who is responsible
Beyond Basics is the Data Fiduciary for your OnlyWallet account, the readable details listed below, support emails and Website visits. We decide why and how that data is processed.
You decide what you store in your vault, including details about family members (for example a child's profile or a parent's insurance policy). Because that content is encrypted on your device, we cannot read or use it. See Data processing for how responsibilities are split.
2. What we process, why, and on what basis
We process personal data on the basis of your consent (Section 6 of the DPDP Act), which you give when you create an account, or for a legitimate use (Section 7), such as data you send us voluntarily for a specific purpose or data we must keep by law.
| Data | What it includes | Can we read it? | Why |
|---|---|---|---|
| Account | Your Google account name, email address and user ID, through Firebase Authentication. OnlyWallet uses Google sign-in only; we never see your Google password. | Yes | Sign-in and syncing your devices. Basis: consent. |
| Vault keys | Your vault key, wrapped (encrypted) under a key derived from your master password with Argon2id, a second copy wrapped under your recovery phrase, a check value, and your sharing key pair (the private half encrypted). | No. These are only useful with your master password or recovery phrase, which we never receive. | Unlocking your vault on any device. Basis: consent. |
| Vault content | Every document field (for example Aadhaar, PAN and passport numbers, card numbers, CVVs and PINs, logins and passwords, policy numbers, addresses), custom fields, notes, scanned text, private titles, attachment file names and payment notes. Encrypted with AES-256-GCM on your device before it is sent. | No | Storing your vault. Basis: consent. |
| Readable item details | Titles you have not marked private, tags, category and template, issue and expiry dates, amounts and currency, repeat schedule, the profile an item belongs to, links between items, status and edit history stamps. | Yes | Sorting, search filters, the dashboard, reminders and sync. Basis: consent. Mark a title private if it is revealing. |
| Profiles | Names, relation and date of birth of the profiles you create in your personal vault, such as family members. | Yes | Grouping items by person. Basis: consent. |
| Payments and reminders | Due dates, amounts and status (due, paid, skipped) of EMIs, rent, premiums, bills and subscriptions; reminder dates and kind; your reminder settings. Payment notes are encrypted. | Yes, except notes | The payments calendar and reminders. Basis: consent. |
| Attachment records | For each file: its Google Drive file ID, type and size, and an encrypted file key and name. The file itself is encrypted and stored in your own Google Drive, not with us. | Type and size only | Finding and opening your files. Basis: consent. |
| Google Drive connection | The email of the connected Google account and the ID of the "OnlyWallet Vault" folder. On the web, a Google refresh token, stored encrypted on our server so Drive stays connected between visits. The App asks only for the drive.file permission, so it can see only files it created. | Email and folder ID, yes | Uploading and downloading your encrypted files. Basis: consent. |
| Spaces (family and groups) | Each member's email address, user ID and role, join requests (with the name the requester gave), invitations by email, join-code expiry. Space names, member display names, managed-member names and all content are encrypted with the space's key. | Emails, roles and request names, yes | Sharing a space with the people you choose. Basis: consent. |
| Emergency access | The email addresses of you and your trusted contact, the waiting period, the status of the grant and request times. Your vault key is sealed to your contact's key and cannot be opened by us. | Emails, wait and status, yes | Running the emergency access process. Basis: consent. |
| Shared document links | An encrypted snapshot of the item you share, its expiry and permission, and a record of each time someone else opens it (their account ID and time), visible only to you. Half of the key is in the link itself after the #, which browsers never send to a server. | Expiry, permission and view log, yes. Content, no. | Letting you share one document safely. Basis: consent. |
| OnlyWallet Card | Only the fields you choose to publish on a public card, with your Google email. | Yes. Anyone with the card link can see them. | Showing the card you publish. Basis: consent. You can unpublish it. |
| Public sharing key | Your sharing public key and your verified Google email, so people can invite you to spaces or name you as an emergency contact. | Yes | Inviting by email. Basis: consent. |
| Devices and notifications | Push notification tokens for your devices (Firebase Cloud Messaging) and a log of which reminder or emergency pushes were sent, so they are not repeated. Notifications carry generic text only, such as "A payment is due soon". | Yes | Sending reminders and security alerts. Basis: consent. |
| App integrity | Firebase App Check tokens that show a request comes from a genuine copy of the App. | Yes | Protecting the service from abuse. Basis: legitimate use (security). |
| Support and grievance emails | Your email address and your message. | Yes | Answering you and keeping a record of requests. Basis: legitimate use (you sent it to us). |
| Website visits | Standard request data handled by Cloudflare (IP address, browser, pages viewed). Our analytics are cookieless and do not identify you. | In aggregate | Delivering pages, keeping the site secure, counting visits. Basis: legitimate use (you asked for the page). |
Data we do not collect
- Your master password and your recovery phrase. They never leave your device.
- Your location, contacts or photo library, except a photo or file you choose to add.
- The text of documents you scan or upload while it is being read. Text recognition runs on your device (ML Kit on phones, a self-hosted reader in the web app). Only text you save is kept, encrypted.
- Bank, biller or insurer messages you paste into Import bill. They are read on your device and are not saved unless you switch on "Attach the original text", in which case they are stored encrypted.
- Usage analytics, advertising identifiers or crash reports. The App contains no analytics or crash-reporting SDK.
- Website favicons for your logins. Sites are shown with letter avatars so no third party learns which sites are in your vault.
3. Device permissions
- Camera: to scan documents and take photos you attach. Images are processed on the device.
- Photos and files: only the file or photo you pick, to attach it or read it.
- Biometrics (Android and iOS): optional fingerprint or face unlock. The biometric data stays with your phone's operating system; we never receive it.
- Notifications: to show reminders and emergency access alerts.
- Exact alarms (Android): optional, so reminders arrive on time.
- Autofill service (Android): only if you choose OnlyWallet as your autofill service, to fill and save logins.
- Internet: to sign in and sync.
4. Data stored on your device
The App keeps an offline copy of your vault (encrypted content and the readable details above) so you can view and edit without a connection, plus edits waiting to sync and your settings. In the web app at app.onlywallet.in this is held in browser storage (IndexedDB and localStorage) along with your Firebase sign-in session. Decrypted content is kept in memory only and cleared when the vault locks. Signing out clears the offline copy, pending edits and uploads, the clipboard and temporary files. More on the Cookie policy page.
5. Who processes data for us
We use these service providers (Data Processors). They may only process data on our instructions.
| Processor | Service | Data involved |
|---|---|---|
| Google LLC (Firebase, Google Cloud) | Firebase Authentication, Cloud Firestore (stored in the Mumbai region, asia-south1), Firebase App Check | Account data, encrypted vault content and the readable details in section 2 |
| Google LLC (Firebase Cloud Messaging) | Push notifications, delivered through Apple's push service on iPhone and iPad | Device push tokens and generic notification text |
| Google LLC (Gmail) | Our support and grievance mailbox | Emails you send us |
| Cloudflare, Inc. | Hosting of the Website and web app, the serverless functions that send reminders and alerts, exchange Google Drive tokens and release shared-link keys, security, cookieless Web Analytics | Request data such as IP address and browser; the encrypted Drive token; the data those functions handle |
Google Drive is your own storage. Your encrypted files are kept in your Google account under Google's terms with you. We only place encrypted files there and cannot read them without your keys. App stores you download the App from handle your data under their own privacy policies.
6. Transfers outside India
Your Firestore database is located in Mumbai, India. Google and Cloudflare also run servers in other countries, so some data (for example sign-in, push delivery and website requests) may be processed outside India. The DPDP Act allows this, except to countries the Central Government restricts by notification. We will follow any such restriction.
7. Sharing
We do not sell or rent personal data. Data is shared only:
- With the people you choose: members of a family or group space you belong to, a trusted contact once emergency access is granted, and anyone who has a document link or OnlyWallet Card link you created.
- With the processors listed above, to run the App and Website.
- When you choose to export, for example sending a document as a file through another app. Exported files leave OnlyWallet's encryption.
- When required by law, a court order or a government authority with legal power to ask. Encrypted content is all we hold, so we cannot hand over what we cannot read.
8. How long we keep data
| Data | How long |
|---|---|
| Account, vault keys, items, payments, profiles and reminders | Until you delete them or your account. In-app account deletion removes them straight away. |
| Items you delete | Kept in Recently deleted for 30 days so you can restore them, then removed the next time you unlock. |
| Encrypted files in your Google Drive | Until you delete them or your account. Disconnecting Drive does not delete them. |
| Your membership of a space and items you added there | Until you leave the space, are removed, or the space is deleted. Items stay with the space. |
| Emergency access grants | Until either side removes the grant or you delete your account. |
| Shared document links | Until they expire (31 days at most), are revoked or are used up. The content key and files are deleted then, and the record 30 days after expiry. |
| Support and grievance emails | Until the matter is closed, then up to one year as a record of how it was handled. |
| Security and access logs kept by our cloud providers | For the periods those providers keep them, generally up to 400 days for administrative records. |
| Backups held by Google | Residual copies are overwritten within a limited period after deletion. |
| Copy on your device | Until you sign out, uninstall the App or clear the site data. |
9. Security
- Vault content is encrypted on your device with AES-256-GCM. The vault key is protected by Argon2id key derivation from your master password. See Security for the full design.
- Data is encrypted in transit (HTTPS/TLS) and at rest by Google.
- Server-side security rules let only you, and the people you have shared with, read your records.
- The vault locks automatically, and locking clears the key and decrypted data from memory.
- Your master password cannot be reset by us. If you lose both your master password and your recovery phrase, your vault cannot be recovered by anyone, including us.
No system is completely secure. Please choose a strong master password and keep your recovery phrase offline.
10. If there is a data breach
If a personal data breach affects you, we will tell you without delay: what happened, when, the likely impact, what we are doing about it, what you can do to protect yourself, and who to contact. We will also report it to the Data Protection Board of India within 72 hours of becoming aware of it, or within any longer time the Board allows, as Rule 7 of the DPDP Rules requires. Encrypted vault content in a breach stays protected by your master password.
11. Your rights
Under the DPDP Act you can:
- Access your data. Everything in your vault is visible to you in the App, and Settings, Backup exports a complete encrypted backup file. You can also ask us for a summary of the readable data we hold and who we have shared it with.
- Correct and update it. Edit any item, profile or setting in the App. For anything else, email us.
- Erase it. Delete items, or your whole account in Settings, Danger zone, Delete account. See Delete your account.
- Withdraw consent at any time, as easily as you gave it. OnlyWallet cannot store your vault without processing your data, so withdrawing consent means deleting your account. Withdrawal does not affect processing done before it.
- Nominate another person to exercise your rights if you die or become unable to. Email us the nominee's name and contact details from your registered email address. A nominee cannot unlock your vault without your keys; to give someone access to its contents, set up emergency access.
- Have your grievance redressed. We acknowledge within 72 hours and resolve within 30 days, well inside the 90 days the DPDP Rules allow. See Grievance redressal.
- Complain to the Data Protection Board of India under the DPDP Act (details are published by the Ministry of Electronics and IT at meity.gov.in) if you are not satisfied with our response.
To use any right by email, write to beyondbasicstech@gmail.com from the Google account email you sign in with, so we can verify it is you.
12. Children
You must be 18 or older to create an OnlyWallet account. We do not knowingly create accounts for children. Parents and guardians may store their children's documents in their own vault or a family space; that content is encrypted and decided by the parent. If you believe a child has created an account, contact us and we will delete it.
13. Language
This notice is in English. You can ask for it in Hindi, or another language listed in the Eighth Schedule to the Constitution, by emailing beyondbasicstech@gmail.com.
14. Changes to this notice
We will post changes on this page and update the effective date. If a change is significant, or we start using data for a new purpose, we will tell you in the App and ask for your consent again where the law requires.
15. Contact and Grievance Officer
Grievance Officer / Data Protection contact, Beyond Basics
Bengaluru, Karnataka, India
Email: beyondbasicstech@gmail.com
Website: www.beyondbasics.global