Who this is

Aviary is developed and operated by an individual developer based in India. For any privacy question or request, write to support@useaviary.com.

What we collect

  • Account information. Email address, display name, profile picture URL, and a device description (e.g. “Pixel 8 · Android 15”), collected when you sign in with Google or an emailed one-time code. Authentication is handled by our identity provider, WorkOS.
  • The financial data you enter. Categories, budgets, transactions, item names, notes, subscriptions, and investment holdings you add. Amounts, item names, notes, and AI chat text are encrypted at rest with AES-256-GCM before they reach our database. Dates, category names, payment methods, subscription and holding names are stored as plain text so search and filtering work; we don't encrypt those.
  • Receipt photos, for bill scanning only. If you use the scan-a-bill feature, the photo is sent to Google's Gemini model to read the amount and merchant off it, and is not stored by us afterward. Screenshots and PDF statements you upload to catch up go to Gemini the same way.
  • Ask Aviary / AI chat. If you ask our AI assistant a question, we send it your recent transactions, category balances, and subscription and investment summaries so it can answer accurately, along with the text you type. Conversations are stored in our database so you can revisit them, and you can delete them at any time.
  • Product analytics. The mobile app and the web app send your email and name, the screens and pages you open, and product events (e.g. signing in, each step of setup, logging an expense, moving money, scanning a bill, viewing plans) to PostHog, an analytics provider based in the United States. No amounts, item text or category names are included in these events, and we don't record your screen. On the website, visitors who aren't signed in are counted anonymously. Analytics is on by default. You can turn it off at any time in Settings → Your data → Share usage analytics, on either app; turning it off stops new data from being sent from that device or browser.
  • Push notifications. A push token identifying your device, used to send budget alerts, bill reminders, and digests. Notification text can include category names and amounts (e.g. “You've overspent ₹500 in Food”), delivered through Google's and Apple's push services.
  • Bug reports and ideas. If you report a bug, we store what you write with your app version, device model and the screen you were on, and AI sorts it by area and severity. Only our team sees bug reports. Ideas you post on the feedback board and your votes are stored with your account. Other signed-in users see your idea with your first name, but never who voted. Deleting your account removes both.
  • iPhone waitlist. If you join the iPhone waitlist on our website, we store the email you enter and when you joined. We use it only to email you once when the iPhone app launches, and delete it after that. To be removed sooner, contact us.

How we use it

To run the budgeting features you use, to answer questions you ask our AI assistant, to send the notifications you've enabled, to fix bugs, and to understand which features are actually used so we can improve them. We don't sell your data, and we don't use it for advertising.

Who we share it with

Data only goes to the services that make the app work:

  • WorkOS — sign-in and account identity.
  • MongoDB Atlas — where your data is stored, with the encryption described above.
  • Google Gemini — receives transaction and budget context for Ask Aviary, AI briefs, Insights explanations and coaching notifications, a habit's item, category and usual time for habit nudges, and receipt photos and statements you upload. Google does not use this data to train its models under our API agreement with them.
  • PostHog — product analytics, U.S.-hosted, toggleable off as described above.
  • Expo / Google Firebase — delivers push notifications.
  • Vercel — hosts the app and its API, and stores data exports you request.
  • TypeSafe AI, through Vercel's AI Gateway: receives what you type to Ask Aviary, the budget and spending summary behind AI briefs, item names, amounts and categories for category suggestions, duplicate and one-off checks and Wrapped, those plus your notes for the recurring-payments scan, payee names and sample columns from files you import, and the title and details of bug reports. Your name and email aren't included. Requests are set to disallow prompt training. See what the AI sees.
  • Razorpay — takes payment when you subscribe on the website. Your card or UPI details go to Razorpay, not to us. We keep your subscription's id, plan and renewal dates.
  • PayPal — takes payment when you subscribe on the website from outside India. Your PayPal account and card details stay with PayPal. We keep your subscription's id, plan and renewal dates.
  • Google Play and RevenueCat — take payment when you subscribe in the Android app. We keep the purchase id, plan and renewal dates, never your payment details.

Some of these providers are located outside India, including in the United States, so using Aviary means your data may be processed there.

How long we keep it

Deleting a category, transaction, or your whole account moves it into a recoverable, inaccessible state for 7 days — enough time to undo an accidental deletion by signing back in — after which it is permanently deleted from our active systems, including your account with our identity provider. The one exception is your subscription record (its id, plan and payment dates, never your budgeting data), which we keep so a late refund or renewal from the payment provider can still be matched to the purchase.

Your rights

You can access, correct, export, or delete your data at any time from Settings → Your data, or the account page on the web. You can withdraw consent for analytics at any time (see above). Under India's Digital Personal Data Protection Act, you have the right to access, correct, and erase your personal data, to nominate someone to exercise these rights on your behalf, and to file a grievance with us at support@useaviary.com — we'll respond within 30 days. If you're in the EU/UK or California, you have equivalent rights under GDPR or the CCPA, including the right to data portability; we don't sell personal information, so there's nothing to opt out of there.

Security

Financial values, item names, notes, and AI chat text are encrypted at rest with AES-256-GCM before they're written to our database, so a leaked backup or exposed connection string only turns up ciphertext. This isn't end-to-end encryption — our server decrypts your data to run your budget and answer AI questions — so it protects you if the database leaks, not if our server itself is compromised. All traffic between the app and our servers is encrypted in transit (HTTPS).

Children

Aviary isn't directed at children, and we don't knowingly collect data from anyone under 18. If you believe a child has provided us data, contact us and we'll delete it.

Changes to this policy

If this policy changes materially, we'll update the date at the top and, for significant changes, note it in the app.

Contact

Questions, requests, or complaints about your data: support@useaviary.com.