Privacy

Where your data lives

On the web, Malai runs in your browser and keeps its database in your browser’s own storage (IndexedDB) on that device. On Android, it runs inside the app’s private storage, which other apps can’t read. Android’s cloud backup is switched off for Malai, and so is the phone-to-phone copy when you set up a new phone, so your data isn’t copied to Google or to another phone that way. To move to a new phone, make a backup file in Settings and restore it there.

Statements

When you choose a statement, your browser reads the file on your device. The file isn’t uploaded. If a PDF is locked, the password you type is used to open it and is never stored. Malai keeps the rows you approve and throws the file away.

Bank texts, on Android

If you say yes, Malai reads texts on your phone and keeps only the ones about money. Before anything is saved, it drops texts from personal numbers, promotional texts and anything that looks like a one-time password. Say no and the app still works with statements and things you add by hand.

The original text of a bank message stays on your phone so you can check it with Show original text, and so Malai can read it again when its reader improves.

What Android permissions are for

Read and receive SMS

To read bank texts already on the phone and new ones as they arrive. Only the version of the app that reads texts asks for this.

Biometric

For the optional lock, using your fingerprint or screen lock.

Notifications

For reminders the day before a bill. They are made on the phone.

Run at start-up

So those reminders survive a restart of the phone. The app does nothing else at start-up.

Malai doesn’t ask for internet or network access, and it doesn’t send usage reports from the system’s web view. You can check this yourself, below.

Check it yourself

Two ways to see it for yourself, a couple of minutes each.

The Android app

1. Once it’s on Google Play, open its listing, then About this app, then App permissions. “Full network access” isn’t there.
2. On your phone: Settings, Apps, Malai, Permissions, the three dots, All permissions. Same answer.
3. If you like reading manifests: aapt dump permissions malai.apk

The web version

1. Open Malai on a laptop, press F12 and go to the Network tab.
2. Choose a statement and let Malai read it.
3. You’ll see Malai load its own code from its own address. Nothing goes anywhere else, and your file is never in a request.

When something does leave your device

Only when you do it, one action at a time:

• Backups and exports. A backup is a file you save, locked with a password you choose, and it goes where you put it. Exports (CSV or Excel) are plain files, so keep them somewhere sensible. We can’t open or recover either.
• Nudges. Send a nudge opens WhatsApp or your share sheet with a short message. You read it and send it yourself.
• Emails to us. Request your bank shows you a sample with the details blanked out, which you review before it opens in your own email app. If you write to us, we’ll see whatever you send.

This website

The public pages (home, help, privacy, terms) count visits with Footfall, a small first-party tool Anirudh Goel runs. For each view it stores the page, where you came from, a rough location worked out from your network, your network’s name, device type, browser, screen size, language, how long the page stayed visible and how far you scrolled. It keeps a random id in your browser to tell repeat visits apart. It stores a one-way hash of your IP address, never the address itself. Nothing about your money is involved, because the app isn’t part of this.

The app at /app/ has no Footfall and no analytics, and it loads no code from any other site: the readers for PDF and Excel files come from Malai’s own address. Its security policy stops it from talking to any address but its own.

The site is served by Cloudflare, which processes requests as any web host does, under its own privacy policy. Google Play will have its own install records once the Android app is listed there.

How to delete everything

• In the app: Settings, then Delete everything. It asks you to type a confirmation, then removes the whole database from that device.
• On Android, uninstalling the app also removes its data.
• In a browser, clearing this site’s data does the same.

Backups and exports you saved are yours to delete. We hold no copy of your data, so there’s nothing for us to delete on our side. To have visit records or emails removed, write to us.

Contact

Anirudh Goel runs Malai. Questions, or anything on this page you think is wrong: hello@anirudhgoel.xyz. If this page changes, the date above changes with it.