Coinloom Privacy Policy
In short
- You type in your money records. We keep them so the app can work for you and the people you choose to share a household with. Nobody else sees them.
- We do not sell your data. Coinloom has no ads, no ad networks, no analytics or tracking tools, and does not read your SMS or link to your bank.
- The AI Money Coach and receipt scan (Pro) send data to an AI company in the USA only after you say yes, and you can take that yes back.
- You can download all your data and delete your account inside the app at any time, or ask us by email.
- Questions or complaints: J JAI AKASH, support@nvexis.com. We confirm we got your message within 24 hours.
1. Who we are
Coinloom is a money-tracking app for people and households. It is made by J JAI AKASH, a sole proprietor trading as NVEXIS, a Udyam-registered micro enterprise in Tiruttani, Tamil Nadu, India ("we", "us").
For the personal data you give Coinloom, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). We are also the "body corporate" responsible for your data under the Information Technology Act, 2000 and its rules.
Contact and Grievance Officer: J JAI AKASH, support@nvexis.com. This person answers questions about how we use your data and handles complaints. If you need our postal address to send a formal legal notice, write to support@nvexis.com and we will give it to you.
This policy covers the Coinloom apps (Android, iPhone and iPad, Windows) and the website https://coinloom.nvexis.com. The NVEXIS company site https://nvexis.com has its own short privacy note.
2. What we collect
2.1 What you give us
| What | Examples | Why we need it |
|---|---|---|
| Account | Your email address and password (we keep only a scrambled "hash" of the password, never the password itself). If you sign in with Google or Apple: the sign-in token and the email and name the provider gives us. Your login sessions | To create your account, sign you in and keep it safe |
| Profile | Display name, picture, country, the goals you pick at sign-up, an optional expected monthly income, language, look and Easy mode settings | To show the right currency, country rules (for example Indian tax sections) and screens |
| Your money records | Accounts and balances, income, expenses (amount, date, note, category, tags, how you paid, "need or want", mood if you add it), transfers, budgets, bills, subscriptions, repeating items, goals, debts and payments, insurance policies (provider, policy number, insured name, cover, premium), investments and sales, retirement planner inputs (including your current age and retirement age), net-worth history, monthly reports, wishlist, letters to your future self, chit funds, udhaar (money lent and borrowed), shared-pot entries | This is the app: to add up your numbers and show totals, forecasts and reports |
| Names of other people you type in | "Ravi owes me 500", a chit organiser, a member of a shared pot | Only so you can keep your own ledger. See section 9 |
| Receipts and proof files | Photos and PDFs you attach (up to 10 MB each) | To keep a proof with a record. Stored privately; only your household can open them |
| Household data | Household name, members, roles (owner, editor, viewer), invite codes, split expenses, settle-up records, approvals | So a family or group can keep shared records |
| Circles and games | Circle name, members, points, active days, streaks, no-spend days, challenges, family quests | For friendly challenges. Circles show points only, never money amounts |
| Plan and billing | Your plan (Free, Pro, Family), where it came from (Google Play, App Store, Microsoft Store, free trial, referral), status and dates, store purchase events, your referral code and who joined with it | To give you what you paid for and to stop trial and referral abuse. We never see your card or bank details: the app store takes the payment |
| Questions to the AI Coach and receipt photos for scanning (only if you use them) | What you type into the Coach; the receipt photo you pick | To answer you (section 6) |
| Feedback, poll answers and feature votes (only if you choose to give them) | A message you send from the app; the answer you tap on a poll; ideas you vote for | To fix problems and decide what to build next (section 7) |
| Messages to support | Emails you send to support@nvexis.com | To answer you |
| Your consent record | The date and the version of the Terms and this policy you accepted; whether you allowed the AI features | To prove what you agreed to, as the law expects |
| Optional Zerodha link | Your Kite API key and the date you connected | Only if you choose to import your holdings from Zerodha. The API secret and the access token stay only in your device's secure storage; they are not sent to our servers |
2.2 What we collect automatically
| What | Why |
|---|---|
| A scrambled device code: the app makes a random code on first start; our server receives only a salted hash of it (not your phone's IMEI, serial number or advertising ID) and the platform name (Android, iOS, Windows) | One free trial per device, and to spot fake accounts made for referral rewards |
| AI usage counters: how many Coach questions and receipt scans you used this month, and what each AI call cost us | To keep the monthly limits and our spending cap |
| Technical logs kept by our hosting providers: IP address, time, the kind of request, error codes, sign-in events | To keep the service secure, find faults and investigate misuse |
| Message activity (when the in-app news and polls feature is live): whether a news card or poll was shown, skipped, dismissed or answered | So the same card is not shown to you again, and to count answers |
2.3 What stays on your device only
Your app-lock PIN (kept only as a salted hash in your device's secure storage), your fingerprint or face (checked by your device; we never receive it), language and look settings, saved exchange rates, reminder times, the Zerodha secret and access token, and the files you export.
2.4 What we do not collect
Your location, contacts, call logs, SMS or other messages, notifications from other apps, bank log-ins, card numbers, microphone recordings, advertising ID, browsing history, or crash reports through our own tools. Coinloom does not read your SMS and does not link to your bank account. The app stores may give us anonymous crash statistics of their own.
3. Why we use it, and on what legal basis
| Purpose | Legal basis under the DPDP Act |
|---|---|
| Running Coinloom for you: storing your records, calculating, reminders, reports, export | Your consent at sign-up (the short notice you see before you create an account) |
| Sharing records with the household members you invite | Your consent, and your own choice each time you invite someone |
| Your account, plan, subscription, free trial and referral rewards | Your consent at sign-up |
| AI Money Coach and receipt scan | A separate consent you give in the app before the first use (section 6) |
| Zerodha import | Your consent when you press "Connect Zerodha" |
| Feedback, polls and feature votes | You give these voluntarily for that purpose (section 7(a) of the DPDP Act); answering is never required |
| Keeping the service safe, stopping fraud and abuse, keeping logs | Your consent at sign-up, and where a law requires it (for example CERT-In directions and the DPDP Rules) |
| Answering courts, the police or regulators, and keeping records a law requires | Legitimate uses allowed by section 7 of the DPDP Act (complying with a law, a court order or a lawful request) |
We do not use your money records for advertising, to build a profile to sell, to decide credit or insurance, or to train AI models.
4. Who receives your data
We use service providers ("Data Processors"). They handle data only to provide their service to us, under their own contracts and security terms.
| Provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | Everything in section 2.1 and 2.2 | Data stored in Mumbai, India (region ap-south-1). Server functions may run briefly in another Supabase region |
| Resend | Sends sign-up, login-code and password emails | Your email address and the email itself | USA company; sending servers in Tokyo, Japan |
| Zoho Mail | Our support mailbox support@nvexis.com | Emails you send us | Zoho Corporation, India |
| Cloudflare | Hosts our websites and protects our admin page | Visitors' IP address and normal web logs | USA company; worldwide network |
| Anthropic, PBC | AI Coach answers and receipt reading, only after your consent | See section 6 | USA |
| RevenueCat | Connects store purchases to your account | Your random account ID, plan and store purchase records | USA |
| Google Play, Apple App Store, Microsoft Store | Sell and bill subscriptions. They are separate data fiduciaries for your payment, under their own privacy policies | Your purchase (they already have your payment details); we receive the plan, status and dates | Worldwide |
| Google and Apple sign-in (if you choose them) | Confirm who you are | Your sign-in request; they tell us your email and name | Worldwide |
| Frankfurter and the fawazahmed0 currency API (via the jsDelivr network) | Exchange rates | Only a currency code. No personal data. Like any website, they see your device's IP address | Worldwide |
| Zerodha (only if you connect it) | Your broker, which sends your holdings to your device | Your own Kite login on Zerodha's site | India |
We do not sell, rent or trade personal data. We share it with others only:
- with the household members you choose (section 8);
- when a law, a court order or a lawful request from a government authority requires it, and only what is required (we check that the request is genuine);
- if NVEXIS or Coinloom is ever sold or transferred to someone else. The new owner must keep this policy or ask for your consent, and we will tell you in the app before it happens.
5. Data sent outside India
Your records are stored in India. Some providers in section 4 are in, or reach your data from, other countries (mainly the USA and Japan). Under the DPDP Act, data may go abroad unless the Government of India restricts a country. As far as we could find on 18 October 2026, no country has been restricted. If one is, we will stop sending data there.
6. AI features (Pro, optional, only with your consent)
- You choose. Before your first Coach question and your first receipt scan, the app asks for your permission and says what will be sent. If you say no, nothing is sent and the rest of Coinloom works as before.
- Money Coach sends: the question you type (up to 500 characters) and a numbers-only summary of your last 90 days (your currency and country, totals, spending by category, monthly totals, budgets, and goal and debt totals). It does not send your name, email, notes, shop names or account names. Category names you made yourself are sent as "Other (custom)". Whatever you type in the question is sent, so do not type names, account numbers or other private details.
- Receipt scan sends: the receipt photo and your category names, to read the total, shop, date and category. A receipt can show names or card digits. We do not keep the photo on our servers unless you also attach it to a record.
- What Anthropic does with it. Anthropic processes it to give us the answer. Its commercial terms say it does not train its models on this data, and it deletes API inputs and outputs within 30 days (it may keep them longer, up to 2 years, if its safety systems flag a request as breaking its usage policy, or if a law requires).
- AI answers are generated by a computer. Every answer is labelled AI-generated. No person reviews the answers before you see them. They can be wrong. They are general education, not financial, tax, legal or investment advice (see the Terms of Use).
- Withdraw any time: Settings > Account and privacy > AI features permission. After that the app asks again before any AI use.
7. Polls, feature votes, news and messages (optional)
- From time to time the app may show a short poll, a feature vote or a news card about Coinloom. Each one can be skipped or closed. Answering never gives or takes away anything (no points, no Pro days), and nothing is blocked if you skip.
- What is stored: your answer or vote, linked to your account only so you cannot answer twice and so that deleting your account deletes it too; and whether a card was shown, skipped or closed.
- Who sees results: only NVEXIS, and only as counts and percentages. Groups smaller than 5 people are shown as "fewer than 5". Answers are never joined with your money records. Polls never ask about health, religion, caste, politics, sexual life, your income or debts, or children.
- Who gets which message: a message may be shown to everyone, or only by plan, app language, country, platform, app version or sign-up date. Never by your money data.
- News about other NVEXIS apps (such as Aurora) is listed in Settings > More from NVEXIS. It is the same list for everyone, chosen by nobody's data. Coinloom shows no ads.
- Turn it off: Settings > News and polls > "Show polls and feature votes" off. Coinloom news about outages, security or changes to these terms may still be shown, because you need to know them.
- These messages appear only inside the app. We do not send marketing emails or marketing push notifications.
8. Households, Family plan and circles: who sees what
- Your personal space is private to you.
- A household (shared space): every member sees that household's entries, accounts, budgets, goals and pot. Owners manage members and roles, editors can add and change, viewers can only look. Members never see your personal space, your expected income or your sign-up goals. The owner can hide member names on shared screens.
- Family plan: the payer sees who is covered and which household, not your personal records.
- Circles: members see your display name, points, active days and streak. Never money amounts.
- Tell people before you add them to a household. Anything you put in a household can be seen by its members.
9. Information about other people
If you type another person's name or details (a friend who owes you money, a chit organiser, a household member), you are responsible for having a good reason and their permission where needed. Enter only what you need for your own record (a first name is usually enough). If someone asks us to remove their details from another person's records, we will help where the law requires.
10. Children
Coinloom is only for people aged 18 or older. The sign-up screen asks you to confirm your age. The DPDP Act treats anyone under 18 as a child and needs a parent's verifiable consent, which Coinloom does not collect, so we do not knowingly create accounts for children and Coinloom has no children's profiles. If we learn that an account belongs to someone under 18, we will close it and delete its data, after giving a short chance to show the age is wrong. Parents can write to support@nvexis.com.
11. How long we keep data
| Data | How long |
|---|---|
| Your account and records | Until you delete them, or delete your account |
| After you delete your account | Your login, profile and records are deleted from our live database at once (see 12.3 for what stays with a household) |
| Our backup copies | We keep our own database backups (on our own computer and an offline drive) for up to 90 days, then delete them. If we ever restore a backup, we delete again any account that was deleted after that backup was made |
| Receipt files | Until you delete the record, the file or your account |
| Technical and security logs | As long as our providers keep them (often only days) or longer when a law requires (for example the CERT-In directions and, from 13 May 2027, at least one year under the DPDP Rules) |
| Consent records | As long as your account is open, then as long as the law needs them as proof |
| Support emails and complaint records | Up to 3 years after the matter is closed, unless a law needs longer |
| A scrambled device code on our abuse list (only if a device was flagged for misuse) | Until it is reviewed, at most 3 years. It cannot identify you |
| Purchase and tax records | The app stores keep their own. We keep what tax law requires |
| Accounts nobody uses | We do not delete unused accounts today. If we ever start, we will tell you at least 48 hours before (by email or in the app) |
12. Your rights and how to use them
12.1 Your rights
Under the DPDP Act you can:
- get a summary of the personal data we hold about you, what we do with it, and who we shared it with;
- correct, complete or update it;
- have it erased (delete it);
- withdraw your consent as easily as you gave it;
- have your complaint answered by our Grievance Officer;
- nominate another person to use these rights for you if you die or cannot act yourself.
12.2 Most of it you can do yourself, in the app
- See and change your records: any screen.
- Download all my data: Settings > Account and privacy (a ZIP with all your records as CSV files).
- Delete my account and data: Settings > Account and privacy.
- AI permission: Settings > Account and privacy.
- Polls: Settings > News and polls.
12.3 What account deletion does
- Your login and everything you entered are erased and cannot be brought back. Download your data first if you want a copy.
- If you own a shared household with other members, hand it over or remove the members first.
- In a household someone else owns, your own entries, debts, investments and files are deleted. Shared bookkeeping that the others rely on (accounts, transfers, shared-pot lines, invites, insurance entries, monthly reports) stays with the household owner, with your link removed.
- Deleting your account does not cancel a store subscription. Cancel it in Google Play, the App Store or the Microsoft Store first (see the Refunds and subscriptions page).
- No app? Use https://coinloom.nvexis.com/delete-account or email support@nvexis.com from the address you signed up with.
12.4 Asking us
Write to support@nvexis.com from the email address of your account. Say what you want (a summary, a correction, deletion, a nomination or a complaint). We may ask you to confirm it is you, and we never ask for your password.
- We confirm we received it within 24 hours (an automatic reply).
- We answer within 30 days, and sooner where a law sets a shorter time (for example within 7 days for a complaint about something another user shared, see the Community Rules). If we cannot do something, we tell you why.
- There is no fee.
12.5 Nominating someone
Email support@nvexis.com from your account's address with the name and email of the person you nominate. You can change or cancel it the same way. If you die or cannot act, that person can ask us for a summary of your data or for deletion. We will ask them for reasonable proof (for example a death certificate or a doctor's letter).
12.6 If you are not satisfied
First write to our Grievance Officer (support@nvexis.com); the DPDP Act asks you to try this before going further. If our answer does not satisfy you, you can complain to the Data Protection Board of India in the way the Board publishes. You also keep every other right you have in law, including going to a consumer commission.
13. Security
What we do (only true things):
- Everything the app sends travels encrypted (HTTPS).
- Your data sits with Supabase in India, on servers that encrypt stored data.
- Every table in our database has row-level security switched on: the database itself refuses to show your rows to anyone who is not a member of your space.
- Passwords are stored only as hashes. Receipt files are in a private store and open only with short-lived links.
- The AI key and other secrets are kept on the server, never inside the app.
- Our admin page shows counts only, never anyone's records, and is protected by an email check, a password and a second-factor code.
- You can turn on an app lock (PIN, fingerprint or face).
- We keep our own backup copies of the database (section 11), kept on our own computer and an offline drive, never in email or online drives.
No system is perfect. Keep your password and your device safe, and use the app lock on a shared device.
14. If something goes wrong (data breach)
If a breach affects your personal data, we will:
- tell you without delay, in plain words: what happened, when, what data, what it may mean for you, what we are doing, what you can do, and whom to contact;
- tell the Data Protection Board of India without delay and send a full report within 72 hours, as the DPDP Rules require;
- report it to CERT-In (India's cyber-security agency) within 6 hours of noticing it, as its directions require.
15. Changes to this policy
If we change this policy, we change the version number and date below. For an important change (for example a new kind of data, a new purpose or a new provider that receives your records) we show a notice in the app before it applies and, where the law needs it, ask for your consent again. Earlier versions are available on request.
16. Languages
This policy is in English. The short notice on the sign-up screen is also in Tamil and Hindi. If you want this policy in any language listed in the Eighth Schedule to the Constitution of India, write to support@nvexis.com and we will provide it. If a translation and the English text differ, the English text applies.
17. Laws we follow
The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025; the Information Technology Act, 2000 and its rules (including the Reasonable Security Practices and Sensitive Personal Data or Information Rules, 2011, and the CERT-In directions of 28 April 2022); and the Consumer Protection Act, 2019. Parts of the DPDP Rules start on 13 November 2026 and 13 May 2027; we follow them now.
Coinloom is offered in India first. Before we offer it in other countries we will update this policy for their laws.
18. Contact
J JAI AKASH, trading as NVEXIS · Tiruttani, Tamil Nadu, India · support@nvexis.com (support and Grievance Officer).
Version 1.0, effective 18 October 2026.