Privacy Policy — PerkVault

PerkVault is a personal coupon management app. We collect only what is strictly necessary to make the app work. We do not sell, rent, or trade your personal data to anyone. This policy is written in plain language to help you understand your rights.

1. Who We Are

PerkVault is operated as an independent application. For any privacy-related matters, contact us at perkvault.support@gmail.com. We act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Data We Collect and Why

The table below lists every category of data we collect, the legal basis, and how long we keep it.

Data	Purpose	Legal Basis	Retention
Phone number	Authentication (OTP sign-in), if you sign in with a phone number	Consent at sign-up	Until account deleted
Email address	Authentication, if you sign in with Google or with an email address and password	Consent at sign-up	Until account deleted
Google profile name and photo	Shown as your name and avatar in the app, if you sign in with Google	Consent (you choose Google sign-in)	Until account deleted
Display name (optional)	Personalisation within the app	Consent (voluntary)	Until you remove it
Account identifier (a random ID created when you sign up)	Links your coupons, usage events and crash reports to your account. It is not derived from your phone number or email, and it is meaningless outside PerkVault.	Consent at sign-up	Until account deleted
Coupon data (code, store, category, expiry, discount, notes)	Core app functionality — saving and managing coupons	Consent at sign-up	Until you delete them or your account
Screenshots (transient)	AI-powered field extraction via Google Gemini API	Consent (you initiate the scan)	Not stored — processed in real time only
Shared text (transient)	AI-powered field extraction via Groq API, when you share a message or text into PerkVault	Consent (you initiate the share)	Not stored — processed in real time only
Usage events (e.g. "coupon added", "scan used"), linked to your account identifier	Understanding feature usage to improve the app. Events may include the coupon's category, its internal ID, and a brand name you typed yourself if it was not already in our built-in list. They never include coupon codes.	Legitimate interest / consent	Up to 14 months (Firebase Analytics default)
Crash reports (device type, OS version, stack trace), linked to your account identifier	Diagnosing and fixing app crashes	Legitimate interest	90 days (Firebase Crashlytics default)
IP address (AI scanning only)	Our scanning server counts requests per IP address to stop automated abuse of the AI service. It is also written to our server logs when a request is blocked for exceeding those limits.	Legitimate interest (security and abuse prevention)	Held in memory for up to 24 hours for counting; log entries are retained by our hosting provider on its own schedule
Device and app information collected automatically by Firebase Analytics (e.g. device model, operating system version, app version, approximate country)	Understanding how the app performs across devices and regions	Legitimate interest / consent	Up to 14 months (Firebase Analytics default)
Scan counter	Counting how many AI scans your account has used, to enforce fair-use limits	Legitimate interest	Until account deleted

      Screenshots and shared text sent for AI scanning are never stored by PerkVault. A screenshot is transmitted to Google's Gemini API; text you share into the app (for example from an SMS or email) is transmitted to Groq's API. Both are processed immediately and discarded. We save only the coupon details the AI extracts — such as the code, store, discount, minimum order value, expiry date and any notes — never the image or the original message.
    

3. App Permissions

PerkVault requests the following Android permissions:

Camera

To take a photo of a coupon for AI scanning. Permission is requested only when you tap "Scan". The camera is never accessed in the background.

Storage / Media

To pick an existing screenshot from your gallery for AI scanning. Used only when you choose "Choose from Gallery".

Notifications

To send local expiry reminders for your coupons. All notifications are scheduled on-device — no push servers are involved. You can disable this at any time in device settings.

Internet

To sync your coupons to Firebase cloud storage, process AI scans, and send analytics events.

Share target

PerkVault appears in Android's share sheet so you can send a coupon to it from another app, such as a message or an email. It receives only what you explicitly choose to share, at the moment you share it. It cannot read any other app's content, and it does not run in the background.

4. Data Storage and Security

On-Device Storage

Your coupons are held in Firebase Firestore (see Cloud Storage below). A copy is kept in an on-device cache so the app keeps working offline; that cache is readable only by the PerkVault app and is cleared when you uninstall it.

The app also stores small amounts of data in your device's local storage: your notification preferences, a count of OTP sign-in codes requested per phone number per day (used to prevent abuse of the SMS service), and any custom brand names you have added. The notification preferences and the OTP counts never leave your device. A custom brand name stays on your device as a suggestion, but if you save a coupon using one, that name is also included in the usage event described in Section 2.

Cloud Storage

Coupon data is synced to Google Firebase Firestore. Access is restricted by Firebase security rules — only your authenticated account can read or write your data. Firebase uses HTTPS/TLS encryption for all data in transit.

Cross-Border Data Transfer

Firebase, Google Gemini and Groq servers may be located outside India, including in the United States. By using PerkVault, you consent to your data being processed in these locations. Google adheres to applicable data protection frameworks and maintains appropriate safeguards under GDPR and other international standards. Groq processes the text you share under a Data Processing Addendum that incorporates the EU Standard Contractual Clauses.

5. Third-Party Services

PerkVault uses the following third-party services. Each processes data under its own privacy policy:

Service	Provider	Purpose
Firebase Authentication	Google LLC	Sign-in by phone OTP, Google account, or email and password
Firebase Firestore	Google LLC	Cloud storage of coupon data
Firebase Analytics	Google LLC	Usage analytics, linked to your account identifier
Firebase Crashlytics	Google LLC	Crash reporting, linked to your account identifier
Google Sign-In	Google LLC	Signing in with your Google account, if you choose that method
Google Gemini API	Google LLC	AI-powered coupon detail extraction from screenshots
Groq API	Groq, Inc.	AI-powered coupon detail extraction from text you share into the app

      Beyond the services listed above, we do not share your personal data with any third parties, advertisers, data brokers, or marketing services.
    

6. Notifications

Expiry reminders are scheduled entirely on your device using the operating system's local notification APIs. No data leaves your device for this purpose. You can revoke notification permission at any time from Android Settings → Apps → PerkVault → Notifications.

7. Your Rights (DPDP Act 2023 & General)

Under India's Digital Personal Data Protection Act, 2023, and general privacy principles, you have the following rights:

Right to Access — All your coupon data is visible directly within the app at all times.
Right to Correction — You can edit any coupon detail directly in the app.
Right to Erasure — You can delete individual coupons within the app, or request full account and data deletion by contacting us.
Right to Data Portability — Export all your coupons as JSON or CSV from Settings → Backup & Cleanup.
Right to Withdraw Consent — You may withdraw consent at any time by signing out and requesting account deletion. Withdrawal does not affect prior processing.
Right to Grievance Redressal — You may raise a complaint with our Grievance Officer (see Section 10). We will respond within 72 hours.
Right to Nominate — You may nominate another individual to exercise your rights in the event of your incapacity or death, as permitted under the DPDP Act.

To exercise any of these rights, contact us at perkvault.support@gmail.com. We will respond within 72 hours of receiving a verifiable request.

8. Data Retention

We retain your personal data only as long as your account is active or as needed to provide the service. Upon account deletion request:

Your coupon data will be permanently deleted from Firestore within 30 days
Firebase Authentication records will be removed within 30 days
Analytics and crash-report records carry your account identifier while your account exists. On deletion that identifier is no longer tied to any account, so the remaining records cannot be linked back to you; they age out on the Firebase retention schedules below
Analytics events are retained for up to 14 months, and crash reports for 90 days, per Firebase defaults

9. Children's Privacy

PerkVault is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

10. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, a Grievance Officer is appointed to address concerns regarding your personal data.

Grievance Officer — PerkVault Email: perkvault.support@gmail.com
Response time: Within 72 hours of receipt of complaint

If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India once it is established under the DPDP Act, 2023.

11. Changes to This Policy

If we make material changes to this privacy policy, we will update the effective date at the top of this page. For significant changes, we may notify you within the app. Continued use of the app after the updated policy is posted constitutes your acceptance of the changes.

12. Intended Audience & International Users

PerkVault is designed primarily for users in India. If you are accessing the app from outside India, please be aware that your personal data will be processed and stored under Indian law, and may be transferred to servers outside your country (including India and the United States via Firebase, Google and Groq).

Your local laws may provide additional rights beyond those described in this policy. We will honour reasonable requests made under applicable local law to the extent we are able to do so.

European Union / EEA Users (GDPR)

If you are located in the EU or EEA, the following additional information applies:

Lawful basis: We process your personal data on the basis of your consent (given at sign-up) and legitimate interest (analytics, crash reporting).
Data transfers: Your data may be transferred outside the EEA to Google's servers and, when you share text into the app, to Groq's servers. Transfers to Google are governed by Google's Standard Contractual Clauses (SCCs) in accordance with GDPR Article 46. Transfers to Groq are governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two) incorporated into Groq's Data Processing Addendum.
Right to object: You may object to processing based on legitimate interest at any time by contacting us.
Supervisory authority: You have the right to lodge a complaint with your local data protection authority (e.g. ICO in the UK, CNIL in France).

13. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023. Any disputes shall be subject to the jurisdiction of courts in India.

14. Contact Us

For any questions, data requests, or complaints about this Privacy Policy:

PerkVault — Privacy Team 📧 perkvault.support@gmail.com
We aim to respond to all privacy queries within 72 hours.

When you contact us by email for support, your message content and contact details may be retained solely for the purpose of resolving your query. This information is not used for any other purpose.