Privacy Policy

What we collect — and what we don't

Riqo is built on a local-only architecture. In ordinary use, the app does not communicate with any server operated by Vibhutix or any third party. Below is a precise record of what data exists, where it lives, and who can access it.

Data we do not collect

How your data is used

All processing happens on your device, only for the features you use. The purposes are narrow and user-directed:

Your data is not used for advertising, profiling, or training of any kind — and since it never reaches us, it could not be.

Data stored on your device

Riqo stores the following data locally on your phone only, inside a database encrypted with AES-256 (SQLCipher) and in your device's secure storage:

Cloud backup — the only network feature

Default state: no network activity. With cloud backup off (the default), Riqo makes no network connections — no analytics, no update checks, no exchange-rate fetches, nothing. Settings shows a network status indicator that reflects the app's actual state.

If you choose to turn on cloud backup:

• Encryption happens first, on your device. The backup is encrypted with AES-256 using a key derived from a recovery key or passphrase that only you hold. Vibhutix never receives this key and cannot decrypt your backup.
• Google Drive — Riqo uses Google's app-data scope only: it can access its own backup folder and nothing else in your Drive.
• Apple iCloud — backups are stored in Riqo's own iCloud container (iCloud.com.vibhutix.riqo).
• Currencies are labels only. Riqo never fetches exchange rates and never converts amounts online.

Permissions

Not requested: location, contacts, camera, microphone, SMS, phone, or calendar. Biometric data is handled entirely by your operating system — Riqo never sees or stores it.

Payments & purchases

The current version of Riqo contains no in-app purchases. The features that protect your data — encryption, app lock, export, encrypted local backup, and restore — are free.

If a paid feature is introduced in a future version, purchases will be processed exclusively by Google Play on Android and the Apple App Store on iOS. This means:

• Vibhutix would not receive, store, or process your card number or any payment credentials.
• Billing, cancellation, and refunds would be handled through your Google or Apple account under their respective policies.
• This policy will be updated before any purchase feature ships.

Children's privacy

Riqo is a personal-finance app intended for general audiences. It does not contain features targeted at children and does not knowingly collect any personal data from anyone, including persons under the age of 13 (or the equivalent minimum age in your jurisdiction).

Because the app collects no personal data at all — from any user — there is no special risk to minors beyond standard device data-handling practices. If you are a parent or guardian and have concerns, you may contact us at the address in Section 14.

Your rights & controls

Because Riqo holds no personal data on any server, your data rights are exercised directly on your device — instantly, with no request to us required:

If your jurisdiction grants you additional statutory data rights, you may contact us at any time and we will respond within the timeframe required by applicable law.

Data retention

Vibhutix retains no data about you on any server. All data retention decisions are therefore yours to make:

• Your records — kept on your device until you delete them, via in-app erase or by uninstalling the app.
• Cloud backups — kept in your own Drive/iCloud account until you delete the file there. Riqo keeps only the destination setting and last-upload time, locally.
• Keys and PIN hash — kept in your device's secure storage and removed with the app.

Vibhutix does not retain logs, usage records, or any derivative of your activity — there is nothing on our side to retain.

Third-party services

No analytics library, advertising network, tracking SDK, or data broker is included in the app. The only third parties involved are the cloud storage providers you may choose to connect:

Google's and Apple's handling of your accounts is governed by their own privacy policies, over which we have no control. We have deliberately limited integration to the narrowest storage scope each platform offers.

Legal compliance

India — Digital Personal Data Protection Act, 2023

Riqo is built in India, for India first. Because of its local-only architecture, personal data is not transferred to Vibhutix in ordinary use — processing happens on your device, under your control. You retain all rights available under the DPDP Act, including grievance redressal. For any grievance, contact our Grievance Officer:

Grievance Officer: Happy Mishra · info@vibhutix.com

Other regions

For users in jurisdictions with data-protection legislation — such as the EU/UK GDPR, California CCPA/CPRA, Brazil LGPD, and similar frameworks — Riqo does not sell or share personal information, does not use it for advertising, and does not transfer it to Vibhutix infrastructure. Rights of access, correction, deletion, and portability are available directly in the app as described in Section 08. For any request under applicable law, contact us via Section 14 and we will respond within the legally required timeframe.

Security

Riqo employs the following technical and architectural safeguards:

• Encryption at rest — the entire database is encrypted with AES-256 (SQLCipher). The key is generated on your device and kept in the Android Keystore / iOS Keychain.
• Verified at launch — the app checks that encryption is active and will not run on an unencrypted database.
• App lock — the app sits behind a PIN (stored only as a salted hash) with an optional biometric shortcut.
• Encrypted backups — backups are encrypted on-device with a key only you hold (Section 04).
• Minimal network surface — with cloud backup off, the app makes no outbound connections. There is no channel through which your data could be sent to a server by the app itself.

No software can be guaranteed absolutely secure, but Riqo's architecture means that even in a worst case there is no server-side copy of your data to be exposed. If we become aware of a security issue affecting your data, we will make reasonable efforts to inform affected users and provide guidance.

Changes to this policy

We will update this Privacy Policy when Riqo's features change in ways that affect how data is handled, when applicable laws change, or when we need to clarify our practices.

When we make a material change — for example, if a future version introduces a paid cloud feature — we will:

• Update the "Effective date" at the top of this document;
• Post the new policy at the same URL before the change takes effect;
• For changes that introduce new data processing, require your explicit opt-in before the feature activates.

Continued use of Riqo after an update constitutes acceptance of the revised policy.

Contact us

Questions, requests, or concerns about this Privacy Policy or Riqo's data practices should be directed to: