Kubear Privacy Policy

1. Who we are and what this policy covers

Kubear is operated by KUBEROS INNOVATIONS PRIVATE LIMITED, an Indian company, CIN U62099GJ2026PTC177330 (“Kuberos”, “we”, “us” or “our”).

Registered office: A-1001 Shyam Palace, VIP Road, Near Shrungar Residency, Athwalines, Surat City, Surat-395001, Gujarat, India
Business location: Surat, Gujarat, India
Telephone: +91 7874664514
Privacy: privacy@kuberos.in
Grievance contact: Sidharth Bothra, grievance@kuberos.in
General enquiries: support@kuberos.in

This policy covers Kubear accounts, the Kubear Android app when you install it from Google Play, associated support and the processing described below. Kubear's earlier web app at kubear.kuberos.in is no longer updated or supported. Where this policy describes the web app, it applies to information from earlier use of it, which used the same account, servers and service providers. Where the Android app works differently on your phone, section 16 says so. A separate website or third-party service may have its own notice. It does not make those services part of Kubear.

Kubear is an India-only service for adults to keep track of their personal and Family Room money. It organises facts you provide, produces calculations and offers optional explanations. If you ask, Kubear Chat can also do a job for you, such as adding several entries, after you confirm it (section 5A). It does not access a bank account merely because you add its balance, move money, execute investments, issue credit or insurance, file tax returns, or provide personalised financial, tax or legal advice.

2. Information we process

Files and free-text entries may contain more information than Kubear needs, including another person's details, health information or identifiers. Redact unnecessary information before uploading. Do not submit bank passwords, OTPs, card security codes, full payment-card details or unnecessary identity documents. We do not need your banking credentials to keep track of your money.

What Kubear does not access. Kubear does not read your contacts list, SMS inbox or call logs, does not track GPS location, does not use an advertising ID and does not listen in the background. The microphone is used only while you hold or tap the mic button. Technical services can still receive an IP address; that is not a promise that network-derived location information never exists.

Device features used only when you start them.

• Sign-in code. On the web, some Android browsers can offer to fill in the sign-in code from the SMS you have just received; this happens inside the browser and only if you allow it. In the Android app, Google Play services can pass the code from that one sign-in SMS to the app so you do not have to type it. This is Firebase Phone Auth's own automatic code detection (Google Play services SMS Retriever); it does not give Kubear access to your SMS, and you can always type the code yourself. Kubear does not have permission to read your SMS inbox and does not see other messages.
• Inviting someone. On the web, your browser may show a contact picker and Kubear receives only the one contact you pick. The Android app does not read your contacts and has no contact picker: to invite someone, it can hand the invite link to WhatsApp or to your phone's share sheet, or copy it. Kubear does not see which app you send it with. The invite sheet asks for the person’s name and mobile number, and Kubear stores them with the invitation so only that number can accept it.
• Camera, photos and files. On the web, the camera is used only when you scan a code or take a photo of a receipt or document. In the Android app, a photo, scan or file reaches Kubear only when you choose it, and Kubear receives only the item you choose. The Android app's document scanner and code scanner are Google screens that run in Google Play services (section 16).
• Microphone. Only after you tap the mic, agree to Kubear's microphone notice and, in the Android app or a browser, allow the microphone permission (section 5).

Paying through UPI. Kubear does not make payments and is not a payment service. When you choose to pay someone or settle a split, Kubear opens a UPI app on your device with the payee's UPI ID and the amount filled in. The payment happens entirely inside that UPI app: Kubear never sees your UPI PIN or card details, and does not treat anything the UPI app reports back as proof of payment. Kubear adds a payment only after you confirm in Kubear that it went through, and that entry is marked as added by you. If you save a UPI ID to be paid back for splits, it is kept on Kubear's servers against your account, shown only to people you invite to settle a split with you, and removed when you clear it or delete your account.

Invite links. A Family Room or split invite link works for whoever holds it. A split invite link shows, before anyone signs in, the group name, your first name, the amount the invited person owes, the number of items and the UPI ID you chose to be paid on. It does not show item titles, other members, phone numbers or other entries; those need a sign-in with the invited number. Share invite links only with the person they are for.

Starter budget and monthly plan update. If you ask for a starter budget, Kubear asks a few questions: who is in your family, your city, your type of home, the money that comes in each month and some lifestyle choices. From your answers it works out starting amounts for each line of your monthly plan, using published public figures: the Household Consumption Expenditure Survey 2023-24 of the Ministry of Statistics and Programme Implementation (MoSPI), price changes since then from the Consumer Price Index (CPI), and middle (median) rents from public property listings. These amounts are shown as "Typical for similar households". They describe what similar households spend on average; they are not advice and not a judgement about your own spending, and you can change any line. The answers you give are kept as part of your entries, so you can see, correct, export or delete them like any other entry. If you switch on the optional monthly plan update, Kubear updates your plan from the spending you added, and it changes only the lines you did not set yourself; a line you set or changed stays as you left it. You can switch the update off at any time.

Reminders and notifications. Kubear's servers keep a list of your coming reminders, made from the dates you added (such as a bill, loan payment, card payment, policy renewal or goal date), and Kubear shows them to you in the app. The list is updated when your app syncs. Push notifications are off until you turn reminders on. If you turn them on, Kubear's servers also update the list once a day, so reminders keep coming even if you do not open Kubear for a while, and send them as push notifications to the devices where you allowed notifications. A push uses a fixed sentence with no names, amounts or dates; the details are only inside Kubear. Reminder, month, Family Room and scheduled-job pushes together are limited to two a day (India time), and none is sent during quiet hours: 9 pm to 8 am India time, unless you set your own quiet hours in Kubear's notification settings. A scheduled-job push says only "Something you scheduled is ready to review. Open Kubear to see it." A notice that an account deletion was requested or cancelled is sent when it happens, outside that limit, with a fixed sentence and no date. Turning reminders off stops the pushes and the daily server update; turning off notifications for Kubear on a device stops them on that device.

Phone sign-in sends your mobile number to Google/Firebase to send the verification SMS and authenticate you. Google also stores numbers supplied for authentication to improve spam and abuse prevention across its services. Review the Google Privacy Policy before requesting an OTP. Control of your SIM or an unlocked signed-in device can allow access to your account; tell us promptly if your number is lost or reassigned.

3. Purposes, consent and required processing

We process information to provide the functions you request: secure sign-in, keeping track of Personal and Family Room money, review and confirmation, server receipts, sync and restore, calculations, export, optional file/AI features, support and account controls. We also administer service limits, investigate abuse, maintain security and meet applicable legal requirements.

Where consent is required, it must cover the stated purpose before processing begins. Accepting the Terms is not permission for unrelated advertising, new uses of sensitive information or every optional feature. An operating-system or browser permission is not a substitute for an appropriate explanation and consent.

You can decline to provide optional information. If you withhold or withdraw information necessary for a particular service, we may be unable to provide that service; we will not treat that as consent to another purpose. Withdrawal does not retrospectively undo lawful processing. Any continuing retention must have a specific lawful justification, not merely that the information might be useful.

See the Consent Notice for feature choices. We do not sell personal information or use your financial information for targeted advertising.

4. Personal and Family Room information

Your Personal entries are private to you and are kept separate from Family Room entries. Joining a Family Room does not by itself share any of your Personal entries; other members see only what you deliberately put in the shared space. Information deliberately placed in a shared space is accessible to members according to server-enforced membership, roles and the feature's permissions.

Other members may see shared financial facts, participants and relevant activity, and may retain copies or exports they lawfully obtained. Removing access cannot retrieve a screenshot or export already held outside Kubear. A Family Room owner is not entitled to another member's private credentials or unrestricted Personal account access.

If you supply another person's information, have an appropriate basis to do so, explain the relevant use to them and share only what is necessary. Membership alone does not establish consent for all information about everyone in the Family Room. A person whose information was supplied by someone else can contact us directly at privacy@kuberos.in; they do not need to create an account.

Shared ownership and the legitimate entries of other members need special handling when an account is deleted. They do not justify indefinite retention of all information about the departing member.

5. AI, document review and voice

When you request an AI explanation, Kubear sends the prompt and the server-authorised account or Family Room facts needed for that request to an AI provider: Anthropic (Claude API). Document extraction can send the selected file's content to the provider. Context may contain sensitive financial information. Do not type passwords, OTPs or card numbers into Chat. Kubear does not keep your chat text on its servers. When you ask Chat to do a job, what you typed for it is held only while the job runs and is deleted when the job ends, or 24 hours after the last activity if the job is left unfinished; the job record keeps the steps, typed fields and receipts, not the chat text (section 5A). There is no chat history to export; job records are in your data export. Usage and security logs about AI requests (for example counts and times, not your message) may be generated.

Kubear asks for your agreement before your first AI request. In the web app, a question you type in Chat shows a short notice titled "Before Kubear answers", and a file you choose to have read shows the document notice. Both notices sum up this section and save the same AI choice, so agreeing to one covers the other. You can turn this choice off at any time in the privacy controls (see the Consent Notice, section 5).

Password-protected PDFs. In the web app and in the Android app, if a bank statement, policy or other PDF you choose is locked, Kubear asks for its password and opens the file on your device. By default that password is used once in your device's memory to open the file; it is not stored, logged or sent to Kubear's servers or to the AI provider, and the locked file itself is not uploaded. In the Android app only, you can choose to keep it on your phone (section 16). The opened content of the file is then sent for reading as described above, so the file's content does leave your device. A CDSL depository statement can be read on your phone: Kubear opens it and reads it there, the password you type is used once and not kept, and nothing is sent to CASParser or anywhere else. When CASParser is on for you, mutual fund and depository statements are instead sent to CASParser together with the password you type, or the one you chose to keep (section 6).

Reporting an AI answer. In the web app and in the Android app, you can choose Report this answer under an AI answer. The report goes to Kubear support as a support case, with the reason you choose, any note you type, a reference to that answer and its time, and the app version. The text of the answer is attached only if you tick the box that allows it. Support cases follow section 11.

AI can make mistakes. It is a read-only explanation or review aid, not authority to change your entries, execute transactions or make decisions about creditworthiness, insurance eligibility or legal rights. Review extracted facts before you confirm them.

Anthropic’s Claude API is the only AI provider Kubear uses. Anthropic states in its commercial terms that prompts and responses are not used to train its models and that it may keep them for a limited period for safety and abuse checks; those are Anthropic's statements, not a promise by Kubear. AI processing by Anthropic may happen outside India (for example in the United States). Kubear's main database (Google Cloud SQL through Firebase Data Connect) and its server functions are set up in Google Cloud's Mumbai region (asia-south1). We have not confirmed in writing where our file storage, our other server-side data, sign-in data, logs and backups are held, so do not assume they are in India. See Anthropic's commercial terms and privacy information. This is not a zero-retention or India-only processing promise.

Kubear’s Google Gemini backup is switched off: Kubear does not use Google Gemini or Google Search to answer you or to read your documents. If that ever changes, this policy will be updated first.

Voice input is optional. When you tap the mic, speech is turned into text by your device's own speech service: your browser or operating system on the web, and Android's built-in speech recognition (normally Google speech services) in the Android app. Kubear receives only the recognised text, shows it in an editable draft before you send it, and handles it like text you type. Before the recognised text appears, Kubear checks it for what looks like a card number, a code or a PIN and hides what it finds. This check can miss something, so do not say passwords, OTPs or card numbers aloud. In the Android app, voice input is set up for English, Hindi and Hinglish, with no language setting to choose. Kubear does not make or keep a recording of your voice, and Kubear does not send audio to its servers or to Anthropic. The speech service on your phone or browser may process the audio on the device or on its supplier's servers, under that supplier's own terms and privacy policy; Kubear cannot promise how long that supplier keeps audio. You can type instead at any time, and you can turn off the microphone permission in your phone or browser settings.

5A. Jobs Kubear Chat does for you

You can ask Kubear Chat to do a job, for example "add my rent and electricity bills". Kubear works out the steps and shows you one card with what will be saved. Nothing is saved until you tap Confirm. One Confirm normally covers the job. A step that involves buying or selling through a partner is always on a card of its own and needs its own Confirm, every time.

Kubear acts on your instruction; it does not advise. Kubear does only what you asked. It does not suggest a job, choose a product, amount, partner or timing for you, rank options or say whether a job is a good idea.

What is sent to Anthropic. To plan and run a job, Kubear sends Anthropic (section 5) your request, the entries the server allows for that job, the list of steps Kubear can take, and the result of each step (for example "saved" or "failed: try again"). No step Kubear can take asks for a statement password, OTP, UPI PIN, card number or partner login. Before your words reach Anthropic, Kubear hides what looks like a card number, a code or a PIN; this check can miss something, so do not type them in Chat. Anthropic does not carry out any step; Kubear's servers do, and only after your Confirm.

Partners. Chat can open OroPocket for you at its buy or sell screen (section 7). It sends OroPocket no amount and places no order. Chat does not send statements to CASParser; statement import stays in its own screen (section 6). Tax filing with TaxBuddy is not yet available (section 7A).

What Kubear keeps. For each job Kubear keeps two things on its servers, against your account only. The job conversation: what you typed for that job, any answer you gave to the agent's question, and the AI's working messages and step results. It is kept only while the job runs, so the job can carry on if you close the app. It is deleted when the job ends, or 24 hours after the last activity if a job is left unfinished. The job record: what kind of job it was, its steps, the fields on each card with your Confirm or decline, amounts, status, any partner reference and the receipt for each step. The job record holds no chat text. It is kept until you delete your account, you can see your jobs and their receipts in Chat, and it is included in your data export. Entries a job saved are ordinary entries you can correct or delete.

Scheduled jobs. You can ask Kubear to prepare one of a few set jobs on a schedule: close the month, add your salary, list the bills due this week, or update your balances. It can run on a day each month, on payday, weekly or yearly, between 8 am and 8 pm India time. At that time Kubear's servers prepare the job up to its card, using Anthropic as described above with fixed wording that Kubear writes (not your own words), and send you one notification. Nothing is saved, paid or sent to a partner until you open Kubear and tap Confirm. For each schedule Kubear keeps which set job it is, how often it runs, the account it is for if you picked one, whether it is Personal or for one shared space, and the outcome of its last 12 runs. It keeps no amounts, names or words you typed. A schedule runs only while your AI choice is on. You can see, pause, resume or delete your schedules in the app at any time; they are in your data export and are deleted with your account. A look-only member of a Family Room cannot create a schedule for it, and a schedule pauses if you lose permission to change that space.

What Kubear remembers. When you tell Chat a habit, for example "chai is always Food", "salary goes to HDFC", "Riya's share is half" or "rent is due on the 5th", Kubear can offer to remember it. It is saved only if you tap Confirm on the card; you can also save the entry and keep the habit out. Kubear keeps each habit as a short entry (what kind it is, the word you used, the value, and which job it came from), not the words of your chat. Kubear uses these habits only to fill in the agent's drafts, and every filled value is shown on the card before anything is saved; your own words in a job always win. They are never used for advice, ranking, scoring or marketing. Kubear refuses to remember passwords, codes, PINs, card, account, phone or ID numbers, email or UPI IDs, and health, religion, caste, sexual life, political, legal or credit-score facts that it recognises; this check works on words and numbers and can miss something, so do not tell Chat to remember them. Habits are kept on Kubear's servers and are sent to Anthropic only as part of your own jobs. Only you can see or use them: a habit saved in a Family Room applies only to your own jobs in that room, and other members cannot see it. You can see, change or delete every habit in You > Privacy > What Kubear remembers; a deleted habit is not used again. Habits are kept until you delete them or your account, are in your data export and are deleted with your account. If you name another person in a habit, share only what you are entitled to share (section 4).

How to stop. Before you confirm, tap Cancel or decline the card; nothing is saved or sent. A job left waiting for 30 minutes ends on its own, and nothing waiting on a card is saved. While a job runs, tap Cancel: Kubear takes no further step. Steps already saved keep their receipts and can be corrected or deleted like any entry. What you do on OroPocket's own screens is between you and OroPocket. To stop all jobs, turn off the AI choice in Privacy; Chat jobs need it, as AI answers do.

6. Statement import (CASParser)

You can choose to bring in a mutual fund, share or depository statement (a "CAS" from CAMS, KFintech, CDSL or NSDL). This is optional. Kubear asks for your consent the first time, and nothing is read until you agree.

CASParser receives a statement only when you import it through CASParser. A CDSL statement read on your phone is not sent to it.

What is sent. For a statement you upload, Kubear sends the PDF and the statement password you type to CASParser (casparser.in), an Indian statement-reading service, so that it can read the file. For a statement found through Gmail (below), Kubear sends CASParser the time-limited link to that statement and the password you type. The password is often your PAN, so treat it as sensitive. Kubear uses the password once; it is not saved, logged or sent back to your device. This is also true when you chose to keep the password on your phone (section 16): that copy stays on the phone, and each import sends the password to CASParser again, through Kubear's servers, which do not save or log it.

What comes back. CASParser returns the holdings it read. Kubear removes your PAN, mobile number, email address, address and pincode from that result before it reaches your screen. You then see a draft and can correct or untick lines. Nothing is saved to your entries until you review and confirm it.

What Kubear keeps. The uploaded PDF is held only long enough to be sent for reading. Kubear deletes it after every attempt, whether the reading worked or failed, and a scheduled clean-up in section 11 removes anything left behind. Kubear keeps a small import log: statement type, period, as-of date, a fingerprint used to spot duplicate imports, a one-way fingerprint of the statement's PAN made with a key only Kubear's servers hold (used only to notice a statement that belongs to a different investor), counts, status and CASParser's request reference. Kubear does not keep the PAN itself. After you confirm, the holdings become ordinary Kubear entries that you can correct, export or delete. Each person is limited to a small number of statement reads per day.

CASParser's own handling. CASParser describes itself as deleting the file after reading, not storing the password or result, and hosting in India. Those are CASParser's statements, not a promise by Kubear. CASParser handles your statement under its own terms and privacy policy.

Reading statements from Gmail (separate, optional). If you choose Gmail, you are sent to a Google sign-in screen that belongs to CASParser's app ("Import your Portfolio"), not to Kubear. Kubear never sees your Google password or your inbox. The permission you give Google is read-only access to your email (Google describes this as the ability to read your email) plus your email address. It cannot send, delete or change email. CASParser looks only for statements from CDSL, NSDL, CAMS and KFintech. Kubear stores a connection token (it stays on Kubear’s servers and is never sent to your device), your email address in masked form, and a list of the statements found (type, date, an internal message reference and a statement link that lasts about a day). Kubear checks on the 3rd, 10th and 17th of each month, and you can ask for a check once a day. You can disconnect at any time: Kubear then revokes the connection with CASParser and deletes the token and the list of waiting statements. Holdings you already saved stay until you delete them. You can also remove access in your Google account. Gmail connection and statement upload each need their own consent.

7. Digital gold and silver (OroPocket)

Kubear offers an optional link to OroPocket, a digital gold and silver service run by a separate company. OroPocket, not Kubear, handles buying, selling, savings plans, KYC, bank details and payments, under its own terms and privacy policy. Digital gold and silver are not bank deposits and are not regulated by SEBI or RBI. Gold and silver prices go up and down. Kubear always shows the Gold & silver area; whether you can buy or sell depends on OroPocket being available. Kubear is paid by OroPocket, not by you, for gold and silver bought after you open OroPocket from Kubear.

What Kubear shares. Only after you read a consent screen and tap to continue, Kubear sends OroPocket your mobile number (from your verified sign-in) and your name (from your profile) so that your OroPocket account can be opened. Kubear does not send your balances, entries or goals, and does not pre-fill any amount, grams or plan inside OroPocket. OroPocket may contact you about your account.

How it opens. Kubear asks OroPocket for a single-use link that works for 10 minutes and opens it in a browser tab, outside Kubear's own screens. What you do there happens on OroPocket's pages, not inside Kubear. Closing it, or coming back to Kubear, is never treated as a completed purchase. If you ask Kubear Chat to buy or sell gold or silver, Chat shows a card, and only after you tap Confirm does Kubear open OroPocket at its buy or sell screen in the same way. Kubear sends no amount and places no order; you choose the amount, pay and complete any order on OroPocket's own screens.

What comes back and what Kubear keeps. OroPocket sends Kubear signed status messages about your account: completed gold and silver buys and sells (rupee amount and grams), savings-plan set-ups and instalments, and payment status. Kubear stores these on its servers against your account only, together with details of the link and a code used to match messages to you. Kubear shows them as "Provider-sourced as of" a date: a "Digital gold (OroPocket)" holding, a "Digital silver (OroPocket)" holding if you buy silver and, if you have one, a gold or silver savings-plan commitment. They are not treated as bank money movements, and Kubear knows only the events it received after you connected.

Published rates. Kubear also fetches the gold and silver rates OroPocket publishes, about every 30 minutes, and keeps the latest copy and a short price history on its servers. This request carries no personal data and no information about you. Kubear shows the rate with the time OroPocket published it, values the gold and silver you hold on OroPocket at its published sell rate, and does not treat the rate as a market price.

Your controls. Choose Disconnect OroPocket: Kubear marks the link disconnected and notes that your consent is withdrawn, so you are asked again before it reopens. Kubear keeps the codes that match messages to you, so a message OroPocket sends later is still matched to you and counted, but it is not shown in Wealth until you connect again. Disconnecting does not delete the history Kubear already received, or your OroPocket account; Kubear's copy follows account deletion or a request to privacy@kuberos.in, and OroPocket's own data is governed by OroPocket. What Kubear received is included in your data export.

7A. Tax filing (TaxBuddy): not yet available

Tax filing with TaxBuddy, a separate company, is not yet available in Kubear, and Kubear shares nothing with TaxBuddy today. Before it is switched on, Kubear will ask for your consent and this policy will say exactly what is shared.

8. Will drafting

The will feature is an optional form that puts your answers into a fixed template. Kubear is not a law firm and does not give legal advice; see the Terms.

What is collected. What you enter, which can include: your details; the names and addresses of beneficiaries, guardians, an executor and witnesses; your religion or personal-law choice (used to choose the correct route); the assets you choose to list (which can be taken from entries you already have in Kubear); gifts and shares; and where you keep the paper original. If you upload a signed copy, that scan or photo is stored too. A will can contain information about other people and sensitive information, so include only what you are entitled to share.

Where it is stored and who sees it. Will versions are stored in your own account on Kubear's servers (Google Cloud) and can be reached only through your signed-in account. A signed scan is kept in private file storage for your account and shown back to you through a short-lived link. Family Room members cannot see any of it, even in a shared Family Room. It is not part of the information sent for AI explanations. Kubear does not send your will, or any part of it, to any other person or company. Downloads and witness-slip sharing happen on your device; if you use your device's share sheet, Kubear sends nothing and the recipient is whoever you choose.

Delete and export. Use Delete will records in the will screen to delete every version and every uploaded signed copy from Kubear. Your paper original is not affected. Account deletion also removes your will drafts and signed copies, and they are included in your data export.

9. Optional app analytics (Google Analytics for Firebase)

Usage analytics is off by default. It starts only if you turn on Usage analytics in Privacy & data, and it stops when you turn it off. When it is on, Kubear uses Google Analytics for Firebase to count anonymous app interactions from a fixed list: app opened, sign-in completed, onboarding completed, a screen, drawer or sheet opened (by name), the type of entry saved (for example "spend" or "goal"), an upload started (statement, CAS, policy or receipt), an invite sent, an export requested, an account deletion started, and the general kind of chat message sent (for example "question"). Events never carry rupee amounts, names, notes, merchants, entry identifiers, phone number, email, chat text or documents. Kubear does not set a user ID for analytics, switches off Google signals and advertising personalisation, and does not use analytics for advertising. Google may still receive technical information that comes with any internet request, such as an IP address and device and browser details, and Google Analytics may keep identifiers on your device while it is on. It does not run on test or development builds. Analytics is separate from the authentication, security and error-reporting processing described elsewhere, which turning it off does not stop.

This section covers the Kubear web app at kubear.kuberos.in and the Kubear Android app. In the Android app the same fixed list and rules apply. It is off until you turn on Usage analytics in You > Privacy, and it also needs a switch on Kubear's side to be on; if either is off, nothing is counted. Turning it off stops counting at once and asks Google to delete the counts it holds for your phone. The Android app does not read or send your advertising ID, sets no user ID, switches off Google signals and advertising personalisation, and never counts on a test or development build. The company website at www.kuberos.in has its own cookie and analytics information.

10. Providers, recipients and processing locations

We use providers for infrastructure and features, including:

• Google/Firebase and Google Cloud: phone authentication, anti-abuse/integrity services, hosting and server execution, databases, file storage and, when enabled, notifications (Firebase Cloud Messaging).
• Google Play services on Android phones (Android app only): Play Integrity (helps check that requests come from a genuine Kubear app on a genuine device), passing the sign-in code from the sign-in SMS and, when you use voice, Android's speech recognition. These run on your phone as part of Google Play services and may exchange information with Google under Google's terms (section 16).
• Your browser's or phone's speech service, if you use voice: turns your speech into text (section 5).
• Anthropic (Claude API): AI explanations, chat proposals, planning the jobs you confirm and document reading described in sections 5 and 5A; processing may happen outside India.
• Error reporting: Kubear's private crash-report feature is currently disabled. If it is enabled in a future release, a report will be sent to Kubear only after you opt in: either by turning on Send crash reports to Kubear in Privacy or by answering Send to the one question after a crash, which records one-time consent for that crash. Reports will not be sent before that choice. You can withdraw an ongoing consent in Privacy; withdrawing stops reports and deletes any that are waiting. A report contains the name of the error, the lines of Kubear's own code where it happened, the app and Android versions, a rough phone size class (not the model), the screen name and a random install ID that is replaced when you sign out. It does not contain amounts, names, phone numbers, account numbers, PAN, anything you typed or any document. If the feature is enabled, reports are kept for 30 days and then deleted.
• CASParser (casparser.in), if you use statement import: reads the statement you choose and, if you connect Gmail, finds statements in your inbox (section 6).
• OroPocket, if you open digital gold or silver: a separate company that runs the gold and silver service and receives your mobile number and name (section 7).
• Google Analytics for Firebase, only if you switch usage analytics on (web app and Android app): anonymous app-interaction counts (section 9).
• Google Workspace business email and support handling: correspondence, support attachments, privacy requests and their resolution.
• Authorised Family Room participants: information shared within their permissions.

Your UPI app, WhatsApp and any app you share to through your phone's or browser's share sheet are not Kubear's providers. When you choose to open them, what you send or pay there is handled by that app under its own terms.

Access by staff or contractors must be limited to authorised support, security and operating needs. Providers are not all interchangeable: their processing roles and terms must be assessed for the particular service.

Information may be processed outside India by suppliers or their support infrastructure. A database configured in an Indian region does not mean that authentication, AI, diagnostics, email, backups and support all remain in India. Transfers of sensitive information must meet applicable safeguards and consent or necessity requirements; this policy does not waive them.

We may disclose necessary information when required by law or a valid legal process, to address security or fraud, or to establish or defend legal claims, subject to applicable restrictions. Any business transfer involving personal information remains subject to privacy obligations and appropriate notice; it is not an unrestricted licence to sell your information.

11. Retention

We keep information for the purpose it was collected for and for what the law requires, then delete it. The table says what is true today. "Automatic" means a scheduled job or a provider setting removes it; where nothing removes it automatically, we say so instead of giving a period.

Note 1. The clean-up jobs for the rows marked “Not yet” run every day, but for now they only count what they would remove and delete nothing. We are switching on automatic deletion. Until it is switched on, those rows are kept beyond the planned limit. This policy will be updated when each one is live.

Note 2. Server logs are kept for the period set by our cloud provider’s default, which we have not confirmed.

Deleting your account. When you ask for deletion in the app, there is a 48-hour wait during which you can cancel. After that, erasure starts. Our target is to finish within 30 calendar days of verifying that the request is yours. That is a target, not a promise of instant removal. Shared Family Room entries that other members still rely on are not removed until a reviewed decision is made; we explain this when it affects your request. A legal deadline takes priority over our target.

Backups. Backup copies of our database are kept for up to 14 days, then deleted. Before a release that changes how data is stored we may make one extra copy; we delete it within 30 days. Files deleted from our file storage can be recovered by us for up to 7 days. If you delete your account, we keep a deletion marker for 35 days: a scrambled code made from your account and two dates, with none of your entries. If a backup is ever restored, we use the markers to remove deleted accounts again before the restored copy is used, so a deleted account does not come back. Server logs are not backups and follow note 2.

Security logs and your deletion request. Security logs are kept for their purpose and for what the law requires. Keeping legally required security logs does not mean we keep your financial entries for as long. Where something is kept after your request, we will tell you what, why and for how long, unless the law prevents us.

Legal holds. A legal hold lasts only while its reason lasts, and we review open holds at least every 90 days.

12. Your controls and requests

You may use available account controls or email privacy@kuberos.in to request information about processing, access or export, correction, deletion or withdrawal of consent. Not every right has identical scope or timing under every law. Statutory rights apply as their provisions come into force; service controls can also be offered voluntarily.

We will seek proportionate verification before disclosing or changing private information. Do not email an OTP, password or unredacted identity document. We will explain any necessary additional verification, relevant limits and reasons for refusing or restricting a request.

See Account and Data Deletion. Signing out, uninstalling the Android app, clearing the app's data or clearing browser storage is not an account-deletion request. Clearing storage or uninstalling can also remove unsynced entries.

Phone permissions (notifications, microphone) can be turned off at any time in your phone's settings for Kubear, and browser permissions in your browser's site settings. Turning a permission off stops that feature on that device; it does not delete information already saved.

An authorised representative can contact us with evidence of authority. Adding a nominee to a policy or a continuity checklist does not automatically grant access to a Kubear account or create a statutory privacy nomination.

13. Adults and information about children

Accounts are for people aged 18 or older who can enter into a binding contract. Children must not create accounts. Kubear, including the Android app, is not designed for children. Adult-only registration does not mean every uploaded document is child-free.

Avoid unnecessary child identifiers, photographs, health details or other sensitive information in Family Room and policy entries. If information about a child is needed, appropriate authority and safeguards remain necessary; an adult's checkbox is not proof that all requirements have been met. Contact privacy@kuberos.in about a child account or inappropriate child-data collection so that we can investigate and restrict or remove it as appropriate.

14. Security and incidents

Kubear uses measures designed to protect information, including authenticated server access, access restrictions, app and device integrity checks and secure (encrypted) network communication. Kubear is not end-to-end encrypted: authorised server processing and selected suppliers can process readable information.

For sensitive actions (requesting account deletion, exporting your data and removing a Family Room member) Kubear asks you to confirm your phone number again with a fresh code if you have not signed in within the last 15 minutes.

App lock. App lock is optional and uses your phone's own biometric or screen lock on the Kubear Android app. Kubear stores no PIN, and the web app has no app lock. Your phone number remains your login, and the phone's check does not replace it.

Fingerprint or face unlock (Android app). In the Android app you can choose to open the app with your phone's fingerprint, face or screen lock. Android checks you. Kubear never receives, stores or sends any fingerprint, face or other biometric data; Android tells Kubear only whether the check passed. Signing out of the Android app removes the fingerprint or face unlock key from the phone.

No system is perfectly secure. Protect your device, mobile number and signed-in sessions, and report suspected unauthorised access to support@kuberos.in, subject “Kubear security report”. Do not include exploit data containing another person's private information.

We will assess incidents and make notifications required by applicable law. A security report is not a guarantee of continuous emergency support, immunity for unauthorised testing or a bounty.

15. Grievances and changes

Address privacy grievances to Sidharth Bothra, grievance@kuberos.in, telephone +91 7874664514, at the registered office above. Grievances covered by the applicable 2011 sensitive-personal-data rules will be addressed expeditiously and within one month of receipt. A shorter binding deadline takes priority. Verification or an internal queue does not automatically extend a statutory deadline.

Our Support and Grievances page explains submissions and escalation. Nothing here prevents use of a competent authority, court or other legally available remedy.

We will identify revised policies by version and effective date, explain material changes and obtain new consent where required before using information for a new purpose. A later website edit does not retrospectively change what a user previously accepted.

16. Android app

This section covers only what is different when you use Kubear through the Android app. Everything in sections 1 to 15 also applies to the Android app.

Permissions that ask you first.

Other permissions the app declares. These do not ask you a question; Android grants them when you install the app. Some are added by Google and Android software libraries that the app is built with.

The app does not request permission to use the camera, to read photos, videos or other files in your phone's storage, to read your contacts, to access your location, to read or send SMS, to read call logs or to read phone state, and it does not use an advertising ID. It does not read your contacts list, SMS inbox or call logs and does not track your location. These lists describe the release this policy was written for; Google Play lists every permission that the version of the app you install declares.

Photos, scans and files. A photo, scan or file reaches Kubear only when you choose it, and Kubear receives only the item you choose. The document scanner and the code scanner are Google screens (Google ML Kit) that run in Google Play services. Kubear receives only the scanned page images or PDF you choose to use, or the text of the QR code you scan. The code scanner is used only to read a UPI payment code, and nothing is paid by scanning. A scanned page is sent to Kubear's servers only after you review and confirm it. What happens to it afterwards is described in sections 5 and 6.

Sign-in and app integrity. Sign-in uses Firebase phone authentication, as on the web. Google Play services may pass the code from the one sign-in SMS to the app (section 2). The app uses Firebase App Check with Google Play Integrity so that Kubear's servers can check that requests come from a genuine copy of Kubear on a genuine Android device; this sends app and device integrity information to Google under Google's terms.

Notifications. If you turn reminders on, the app registers with Firebase Cloud Messaging and Kubear keeps the resulting delivery token (section 11). Kubear's notifications use fixed wording and never include names, amounts or dates. They are marked private, so Android hides their content on the lock screen when your phone is set to hide sensitive notifications. Turning reminders off, or turning off notifications for Kubear in your phone's settings, stops them. Signing out also stops them on that phone (see "Signing out" below).

Other apps Kubear can see. Android lets an app see other installed apps only for stated reasons. The Kubear app uses this only to check (a) whether WhatsApp or WhatsApp Business is installed, so it can offer to send an invite through WhatsApp, (b) whether an installed app can open UPI payment links, so it can open the UPI app you pick, and (c) whether a speech-recognition service is available on the phone, for voice input. These answers are used only to decide which buttons to show: Kubear does not send them to its servers or log them, and does not read the list of your apps.

UPI. Paying through UPI works as described in section 2. The UPI app you pick handles the whole payment; Kubear never sees your UPI PIN. When the UPI app closes, Kubear may read the status that app reports, only to pre-select the answer to the question "Did it go through?". Kubear always asks you, treats the status as your own statement and not as proof of payment, adds the payment only after you say yes and confirm, and does not save the UPI app's transaction reference. While that question is waiting, the payee, UPI ID and amount are kept in Kubear's own app storage on your phone for up to 24 hours.

Partner pages and links. When you open OroPocket or connect Gmail from the Android app, the page opens in a browser tab (a Chrome Custom Tab) outside Kubear's own screens, and Kubear does not see what you type there. The Android app accepts links to kubear.kuberos.in only for invitations and for the return from a Gmail connection. Such a link only opens a screen in Kubear, and the Gmail return is used once and then discarded. The Android app offers the same partner features as the website (OroPocket gold and silver, statement import by upload or Gmail, and will drafting), when they are switched on. A partner feature that is switched off is hidden in the Android app, exactly as on the website.

Information kept on your phone. The app keeps a copy of your saved entries, entries not yet sent and your settings in Kubear's own app storage on your phone, which Android keeps separate from other apps. The app's data is not included in Android cloud backup (Google Drive backup) or in transfer to a new phone; on a new phone, sign in and your entries are restored from Kubear's servers. If you turn on usage analytics, the Android app also lets Google Analytics for Firebase keep an app instance identifier on your phone; turning it off asks Google to delete it. Crash reports are off unless you turn them on (see Error reporting).

Statement passwords you choose to keep. When a locked statement PDF seems to come from a sender Kubear recognises (for example a bank, CAMS, KFintech or NSDL), the import screen offers a box, "Remember for that sender on this phone". It is off unless you tick it, and it applies only to that file. If you tick it and the password opens the file, the Android app keeps that password on your phone, one per sender, encrypted with a key held in Android Keystore. The key does not need your fingerprint or face, so anyone who can open Kubear on your unlocked phone can use a kept password; the app lock, if you turn it on, stops others opening Kubear. The kept password stays on your phone: Kubear does not upload, back up, transfer, export, log or sync it, and it is not part of any receipt or record. It is read only to fill in the password box for a file from that sender, where you can see it. For a mutual fund or depository statement, the password is then sent to CASParser as described in section 6, through Kubear's servers, each time, and Kubear does not store it. To forget one, tap "Forget it" when the app uses it. Signing out of the Android app removes every kept password, and so does clearing the app's data or uninstalling. The web app has no such box and keeps no statement password.

Screenshots and the screen. In the Android app you can take screenshots, record the screen and cast it, and the recent-apps preview can show what is on screen. Anything you capture or share this way is outside Kubear's control. On its confirmation screens and the Delete account screen, the app guards against other apps drawing over the screen: on Android 12 and later it asks Android to hide other apps' floating windows, and on Android 8 to 11 it ignores a tap while another app's window covers the screen. How well this works can depend on your phone.

Home-screen widgets. The Android app offers three home-screen widgets: "Left today", "Coming up" and "Goal ring". By default a widget shows words only, without rupee amounts. Amounts appear on a widget only if you turn on "Widget amounts"; then "Coming up" also shows each item's label, date and amount, and "Goal ring" shows the goal's name and saved amount. A widget does not use the network and sends nothing to Kubear or anyone else: it is drawn from a small private copy kept in Kubear's own app storage on your phone, made from the last picture the app saved. That copy is encrypted with a key held in Android Keystore on your phone. The key does not need your fingerprint or face, so that widgets can be drawn without opening Kubear; the encryption protects the stored copy, not what a widget shows on your home screen. With "Widget amounts" off, the copy holds no rupee amounts. Removing a widget removes it from your home screen. Widgets add no new kind of information collected about you.

Signing out. Signing out of the Android app removes this account's copy of your entries from the phone. Entries not yet sent stay on the phone unless you choose "Sign out and discard". Signing out also removes the fingerprint or face unlock key, removes any statement passwords you chose to keep, clears the copy used by widgets, removes files and invite links the app was still holding for you, deletes the phone's notification delivery token and asks Kubear's servers to remove that phone's notification registration, so reminders stop reaching it. Signing out does not delete your Kubear account or what is saved on Kubear's servers.

Uninstalling. Uninstalling the app removes the information it kept in its own storage on your phone, including entries that were not yet sent, any statement passwords you chose to keep and the copy used by widgets. It does not delete your Kubear account or what is saved on Kubear's servers; see Account and Data Deletion.

Google Play. You download the app through Google Play, which Google runs under its own terms and privacy policy. Google may receive information about your download and installed app version from Google Play. Kubear does not receive your Google account details from Google Play.