Security

​

Protections in place

For our full security programme, see the Information Security Policy and the Access Controls Policy.

​

Connected accounts

When you connect a bank (via Plaid) or your Zerodha account, we never receive your login credentials — authentication happens directly with the provider. We store only an access token, encrypted with AES-256-GCM, which you can revoke at any time by disconnecting. See What we store.

​

Payments

Purchases happen entirely inside the Apple App Store or Google Play. We never see your card number, billing address, or payment details. What reaches us is only whether an active subscription exists and when it expires. See Plans & billing.

​

Telemetry

Our server-side monitoring is instrumented with OpenTelemetry and forwarded to Grafana Cloud through a collector we run ourselves — nothing in the app pushes telemetry directly to a vendor. Sensitive fields are removed at the source, before anything is exported, using a deny-by-default allowlist: only an explicitly permitted set of technical fields may be emitted, so a new field added later cannot silently start leaking. Names, amounts, balances, email addresses, tokens and free text are never on that list. Crash reports from the app are stripped the same way — the error type and code locations are kept, the message and any runtime values are not.

​

What we do not do

• We do not store passwords in plaintext — passwords are one-way hashed
• We do not receive or store your bank or brokerage login credentials
• We do not receive or store your card or payment details
• We do not have access to your authentication tokens after they are issued to your device
• We do not receive your biometric data — the app lock is handled entirely by your device
• We do not record or transmit audio — voice questions are transcribed by your device’s own speech recognition
• We do not send your financial data (balances, transactions, holdings), name, or email to our analytics tool (PostHog); it only records pseudonymous usage events and stripped crash reports, and you can turn it off in Settings
• We do not store AI Chat answers or conversation history on our servers
• We do not use any advertising SDK or cross-app tracking

​

Limitations

No system is perfectly secure. Transmission over the internet carries inherent risk. If you discover or suspect a security issue, contact us immediately at support@recontrol.money.

​

Data breach notification

In the event of a personal data breach, we will notify affected users and the relevant authorities under the laws that apply to them — the Data Protection Board of India under the Digital Personal Data Protection Act, 2023 and its Rules, 2025; state authorities and affected residents in the United States under applicable state breach-notification laws; and the Office of the Privacy Commissioner of Canada (and the Commission d’accès à l’information for Quebec) where a breach creates a real risk of significant harm. Our incident-response process is described in the Information Security Policy.

​

Storage location

Your data is stored at rest in AWS us-east-1 (Northern Virginia, United States). There is no secondary copy or offsite backup in another region. Our API server is also hosted in the United States (Railway), so your data is stored and processed in the same country. If you use Recontrol from outside the United States — including Canada, India, or elsewhere — your data is stored and processed in the United States. See the Privacy Policy for the cross-border disclosure and your regional rights. If you connect a bank using Plaid, your banking data is processed by Plaid in the United States before reaching us — this only happens if you choose to use the bank-connection feature.