Privacy Policy
1.1 This Privacy Policy (the "Policy") sets out the manner in which Divipayy ("Divipayy", "we", "us" or "our") collects, uses, stores, discloses and otherwise processes Personal Data in connection with the Divipayy mobile application for Android (the "App") and the website located at www.divipayy.com (the "Website", and together with the App and all related services, the "Services").
1.2 This Policy applies to all persons who access or use the Services ("you" or "User"). By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you shall not access or use the Services.
1.3 This Policy shall be read together with the Terms of Service published at www.divipayy.com/terms.
2.1 "Personal Data" means any data about an individual who is identifiable by or in relation to such data, within the meaning of applicable law, including the Digital Personal Data Protection Act, 2023 (the "DPDP Act").
2.2 "Processing" means any operation performed on Personal Data, including its collection, recording, organisation, storage, use, sharing, disclosure, restriction, erasure or destruction, and "Process" shall be construed accordingly.
2.3 "Group" means a group created within the App for the purpose of recording shared expenses, and "Member" means any person included in a Group, whether as a registered User or as a guest without an account.
2.4 "Service Providers" means the third parties identified in Section 7 that Process Personal Data on our behalf.
3.1 Account information: your name and email address. Where you register with an email address, your password is processed solely by Google Firebase Authentication and is at no time received or stored by us. Where you sign in with Google, we receive the name, email address and profile photograph associated with your Google account.
3.2 Profile information: any profile photograph you upload, and any Unified Payments Interface ("UPI") identifier and UPI QR code image you elect to add.
3.3 Group and expense information: Group names and icons; the Members you add to a Group, including the names of guests and, where entered, their email addresses; for each expense, its name, amount, currency, category, date, note, payer and division among Members; receipt photographs you attach; settlements; and personal budgets you set.
3.4 Friends and invitations: friend requests, your friends list, email addresses you enter to locate friends, and referral codes you share or enter.
3.5 Purchases: where you purchase premium for a Group, or a Buy me a chai item, through Google Play, we receive from Google the product identifier, the order number and a purchase token, which we retain in association with your account and, in the case of premium, the Group concerned. Your card, UPI and bank details are processed exclusively by Google and are at no time received by us.
3.6 Feedback and correspondence: reports submitted through Settings → Report a problem, comprising your message, any screenshot you attach and the versions of the App and of Android installed on your device, together with your name and email address; and any correspondence you send to us.
4.1 Notification token: a token issued by Firebase Cloud Messaging and your device platform, used to deliver the notifications you have enabled and to keep your data synchronised across devices. Your notification preferences are stored with your account.
4.2 Security and abuse prevention: your IP address and account identifier, counted for a limited period not exceeding one (1) hour, to restrict repeated requests such as sign-in or invitation attempts.
4.3 Device identifier: when you sign in or apply a referral code, the App transmits the Android ID of your device (an identifier specific to the App on that device), together with a Google Play Integrity attestation obtained through Firebase App Check confirming that the request originates from the genuine App. Only a one-way hash of the Android ID is stored, for the purposes of limiting the number of accounts that may be created on a single device and permitting one referral code per person.
4.4 Server logs: technical request logs (including time, address requested and errors) recorded by our hosting provider for the purpose of operating and maintaining the Services.
4.5 Crash reports: in the event of an App crash, Firebase Crashlytics transmits a report comprising the error, the App version, your device model, the Android version and a random installation identifier. Such reports do not include your name, email address or any content entered in the App.
4.6 App updates: on launch, the App queries the servers of Shorebird for code updates. Such query transmits the App version and update number, your device platform and a random installation identifier; Shorebird additionally receives your IP address in the ordinary course of the download. It does not include your name, email address or any content entered in the App.
4.7 We do not collect your location, contacts, SMS messages, call logs, list of installed applications or advertising identifier, and the App does not contain any advertising or analytics software development kit.
5.1 Divipayy records the amounts owed between Members and does not process, hold or transfer money between Users. Upon selection of Pay via UPI, the App opens a UPI application installed on your device (such as Google Pay, PhonePe or Paytm) with the amount pre-filled; any resulting payment is effected entirely within that application, subject to its own terms, and we do not receive your bank details, card details or UPI PIN. Any UPI identifier you add is displayed to the Members of your Groups to enable them to make payments to you.
5.2 Purchases made within the App, namely premium for a Group and Buy me a chai, are made through and charged by Google Play, subject to the terms of Google Play.
6.1 We Process Personal Data for the following purposes: (a) to create, verify and secure your account, including verification of your email address; (b) to operate Groups, including the calculation of shares and balances, the display of Group activity and the recording of settlements; (c) to synchronise your data across your devices and to deliver the notifications you have selected; (d) to connect you with other Users, to administer Group invitations, and to administer referral rewards and coins; (e) to verify, apply and record purchases made through Google Play; (f) to prevent abuse, to diagnose and resolve faults, and to maintain the security of the Services; and (g) to respond to reports and correspondence you send to us.
6.2 We do not sell Personal Data, use Personal Data for advertising, or compile advertising profiles.
7.1 Other Users: (a) Members of your Groups may view your name, profile photograph, email address, UPI identifier and UPI QR code image (if added), and may download the QR code image to pay you, together with the expenses, receipts, notes and settlements in Groups shared with you; (b) your friends may view your name, email address, profile photograph, UPI identifier and UPI QR code image (if added) and the balances between you across shared Groups; (c) signed-in Users who open a Group invitation link or enter its code may view the Group's name, icon and number of Members, and the names of guests not yet linked to an account, so as to join the Group or claim a guest position; and (d) your personal budgets are visible only to you.
7.2 Service Providers: we engage the following Service Providers, which Process Personal Data solely for the purpose of providing the Services on our behalf: (a) Google Firebase (Authentication, Cloud Messaging and Crashlytics), for sign-in, the codes used in email verification and password reset, push notifications and crash reports; (b) Microsoft Azure, for database hosting of accounts, Groups and expenses, located in India; (c) Vercel, for hosting of our servers and the Website; (d) Cloudinary, for storage of profile photographs, UPI QR code images, Group icons, receipt photographs and read-only copies of archived Groups; (e) Google Play, for distribution of the App and payment processing for premium and Buy me a chai purchases, it being noted that a premium purchase carries the identifier of the relevant Group within Google Play so that it may be applied to that Group; (f) Brevo, for the sending of account emails (email verification and password reset) from divipayy.com and the delivery of feedback reports to our support inbox; (g) Cloudflare, for the forwarding of email addressed to our support address; and (h) Shorebird, for the delivery of code updates to the installed App between releases on Google Play.
7.3 Our servers obtain currency exchange rates from public rate providers. No Personal Data is transmitted with such requests.
7.4 We may disclose Personal Data where required by applicable law or by order of a competent authority, where necessary to protect the safety of any person, or in connection with a merger, acquisition or sale of all or part of Divipayy, in which event this Policy shall continue to apply to the Personal Data so transferred.
8.1 Personal Data is stored with the Service Providers identified in Section 7, whose servers may be located outside your country of residence, including outside India. Personal Data transmitted between the App and our servers is encrypted in transit using HTTPS.
9.1 Personal Data, including feedback reports, is retained for as long as your account remains in existence.
9.2 Upon deletion of your account, we shall delete your profile, profile photograph, UPI QR code image, friends list, personal budgets, feedback reports (including screenshots), device tokens and sign-in account. Within Groups shared with other Users, your name shall be replaced with "Deleted user" and the associated expenses and settlements shall be retained so that the balances of the remaining Members remain accurate. Groups left with no other registered Members shall be deleted together with their expenses and photographs.
9.3 Upon deletion of a Group, its expenses, receipt photographs, activity history and budgets shall be deleted.
9.4 Groups that are settled and have recorded no activity for thirty (30) days, and Groups archived by an administrator, are archived: they are removed from our database, and a read-only copy of the information already visible to their Members (the Group, its Members, balances, expenses and settlements), together with its photographs, is retained as a file so that each Member may continue to view it in the App. A Member may remove their copy at any time.
9.5 To prevent the same person from claiming referral rewards repeatedly by deleting and re-creating an account, one-way hashes of your device identifier and email address are retained after deletion of your account. Such hashes cannot be reversed to reveal your email address or device identifier and are used solely for this purpose.
9.6 Records of purchases (product identifier, order number, purchase token and the Group concerned) are retained after deletion of your account, so that the same purchase can never be applied twice, and for the maintenance of our accounts.
9.7 Security counters expire within one (1) hour. Backups and logs maintained by our Service Providers are deleted in accordance with their standard schedules.
10.1 You may view and edit your profile, UPI identifier and notification preferences in the App at any time, and may remove your profile photograph or UPI identifier.
10.2 You may delete your account within the App (Settings → My profile → Delete account). Further details are available at www.divipayy.com/delete-account.
10.3 Subject to applicable law, including the DPDP Act, you may request access to, correction of, or erasure of your Personal Data, and may nominate another individual to exercise your rights in the event of your death or incapacity, by writing to support@divipayy.com. You may further have the right to lodge a complaint with the Data Protection Board of India or another competent authority.
11.1 Access to Personal Data requires a signed-in account, and Group information may be read only by Members of that Group. Connections are encrypted, and passwords are processed by Firebase Authentication and at no time by our servers. No method of transmission or storage is entirely secure; you shall keep your sign-in credentials confidential and notify us without delay of any suspected unauthorised use.
12.1 The Services are not directed at children, and we do not knowingly collect Personal Data from any person below the age of eighteen (18) years or such other age of digital consent as applies in your jurisdiction. Where you believe that a child has provided Personal Data to us, you may contact us and such Personal Data shall be deleted.
13.1 We may amend this Policy from time to time. Amendments take effect on the date stated as "Last updated" at the top of this page. Where an amendment materially affects the Processing of your Personal Data, we shall additionally notify you, including by notice within the App.
14.1 Any query, request or grievance concerning this Policy or the Processing of your Personal Data may be addressed to support@divipayy.com. Grievances shall be acknowledged and addressed within the time prescribed under applicable law.