1. Who we are
Manoj Narasimha Modugala ("we", "us") operates NeuralSpend. We are the data controller (data fiduciary) for the personal data described here. Contact: support@neuralspend.app.
This policy is written to meet India's Digital Personal Data Protection Act 2023 and similar laws such as the GDPR, so the same rights are described for everyone.
2. What we collect
- Account details: your name, email address and sign-in method (email and password, or Google). If you use Google sign-in we receive your name and email from Google, never your Google password.
- Financial information you enter or import: accounts and balances, transactions, categories, budgets, goals, debts, recurring items, notes and merchant names.
- Subscription information if you buy a plan: which plan, when it started and ends, whether it renews, and purchase identifiers from Google Play. We keep this so your plan works and to meet tax and accounting rules.
- Documents you choose to upload: receipt photos, bank statements and loan documents (Key Fact Statements).
- AI usage: the questions you ask Neuro, and the parts of your data needed to answer them, only if you allow AI features. We also record how many credits you use.
- Device and app data: app settings (currency, theme, app lock on or off), the app version and error information needed to keep the Service working. App lock uses your device's biometrics; your fingerprint or face never leaves your device and we cannot see it.
We do not collect your contacts, location, advertising ID or browsing history, and we do not sell personal data.
3. Why we use it
- To provide the Service: store and sync your data, calculate balances, budgets and forecasts, and detect duplicates when you import.
- To run the AI features you switch on: answer your questions, read documents you upload, and produce insights.
- To keep the Service secure and prevent abuse: sign-in checks, two-step verification and rate limits.
- To meet legal obligations and to respond to your requests.
Our legal basis is your consent (for AI processing and for the optional items you choose) and the need to provide the Service you asked for.
4. Who receives it
We share data only with providers that help us run the Service, under contracts that restrict their use of it:
- Supabase: database, file storage, sign-in and server functions. Your data is stored with them and encrypted at rest.
- OpenAI: processes AI requests when you allow AI features. We send the minimum needed (your question, and the relevant transactions, accounts or the document you uploaded). Under OpenAI's API terms, data sent through the API is not used to train their models unless the customer opts in, and we have not opted in. OpenAI may keep API requests for a limited period (currently up to 30 days) to detect abuse, then deletes them.
- Google: if you choose Google sign-in.
- ExchangeRate-API: currency conversion. Only currency codes are sent, no personal data.
- Google Play: downloads and subscription payments. We do not see your card or payment details.
- RevenueCat: manages subscriptions for us. It receives your account ID and your purchase records (the plan, when it started and ends, and Google Play's purchase identifiers) so we can tell which plan you have. It does not receive your financial data.
We may also disclose data if required by law or to protect rights and safety. If we are ever involved in a merger or sale, we will tell you before your data is transferred.
5. Your device and security
Data is encrypted in transit (HTTPS). Your records are stored in a database protected by per-user access rules, so one user cannot read another's data. Access to your account can be protected with app lock and two-step verification.
The app keeps a copy of your data on your device so it works offline. Signing out removes that copy from the device.
No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.
6. How long we keep it
We keep your data while your account is open. When you delete your account, your profile, financial records and uploaded files are deleted. Backups roll off within a short, limited period, and we may keep minimal records where the law requires (for example consent and billing records).
AI chat history is stored on your device only, and AI requests are not kept by us beyond what is needed to deliver the answer and count credits.
7. Your rights
You can, at any time:
- see and correct your data in the app;
- export your transactions (Profile → Export CSV);
- withdraw consent for AI features (Profile → AI assistant), and review these documents again;
- delete your account and data (Profile → Delete account);
- ask us for a copy of your data, ask a question or make a complaint by emailing us. Where the law gives you the right, you can also complain to the data protection authority (in India, the Data Protection Board).
Withdrawing consent does not affect what was done before you withdrew. If you withdraw a consent we need to provide the Service, we may not be able to continue it.
8. Children
NeuralSpend is not for anyone under 18, and we do not knowingly collect their data. If you think a child has an account, contact us and we will delete it.
9. International transfers
Our providers may process data in other countries, including outside India. We rely on their contractual safeguards and security standards when this happens.
10. Changes
We will update this policy as the app changes. For material changes we will ask you to review and accept again. The version and date at the top show when it last changed (this version: 9 November 2026).