Privacy Policy — ShriCredit Tracker

1.Introduction & Statutory Framework

Welcome to ShriCredit Tracker. We are committed to offering robust credit card management solutions while strictly securing your personal data. Operating in compliance with India's Digital Personal Data Protection Act (DPDPA), 2023, and applicable directives from the Reserve Bank of India (RBI), our data privacy principles prioritize transparency, explicit consent, user control, and data minimization. We enforce strict administrative and technical safeguards to prevent unauthorized access or disclosure. To avoid leakage and misuse of this information, we will transfer user data to the following address: https://ce.shricredittracker.com.

2.Personal Data Collected, Purpose, and Protection Protocols

To enable intelligent credit tracking, prevent fraud, and optimize application resilience, we collect specific data categories. Optional items are supplied strictly at your discretion.

Phone Number (Mandatory)

Purpose: Essential for primary user authentication, generating OTPs, linking credit profile updates, and sending critical security alerts.

Usage & Protection: Encrypted at rest using AES-256 and stored in restricted database segments inaccessible to third parties.

Email Address (Optional)

Purpose: Facilitates secondary security recovery, monthly billing summary digests, and customer support communications.

Usage & Protection: Processed via secure cryptographic tokens to prevent spam or unauthorized communication outreach.

Camera & Image Access (Optional)

Purpose: Allows capturing physical billing statements, identity verification documents, or receipt uploads.

Usage & Protection: Activated solely during explicit, foreground user operations. No background capture occurs, and images are processed transiently over encrypted streams.

Emergency Contact Details (Mandatory)

Purpose: Formulates an out-of-band verification channel utilized exclusively during critical account lockouts or high-risk identity theft investigations.

Usage & Protection: References are hashed, heavily restricted, and never utilized for telemarketing or commercial outreach.

Digital Identity Tokens (User ID, Device ID, Ad ID) (Optional)

Purpose: User & Device IDs ensure persistent session integrity and defend against Account Takeover (ATO) attacks. Advertising IDs assist in context-aware UI settings.

Usage & Protection: De-identified and decoupled from your primary financial profile. Ad IDs can be reset anytime in OS settings.

Approximate Coarse Location (Optional)

Purpose: Verifies that financial requests originate within authorized geographical limits inside India, protecting against foreign fraudulent transactions.

Usage & Protection: Converted into low-resolution regional zones without storing real-time continuous movement logs.

System Crash Logs (Mandatory)

Purpose: Captures unexpected runtime errors to assist our engineering team in resolving software bugs and ensuring system uptime.

Usage & Protection: Stripped of all personal identifiers (PII anonymization) before being uploaded to secure analytics servers.

Installed Application Information (Mandatory)

Purpose: Scans for malicious overlays, illegal remote access tools, or malware aimed at capturing credit card information.

Usage & Protection: Analyzed ephemerally via cryptographic hashes on-device; no permanent inventory of your installed apps is compiled.

Comprehensive Device Environment Metrics (Storage, Battery, Bluetooth, Hardware, RAM, Network, Sensors) (Mandatory)

Purpose: Assesses storage state, battery stats, Bluetooth state, hardware model, RAM usage, network connection status, and sensor parameters to build a secure device fingerprint.

Usage & Protection: Used to block automated bot exploits and optimize display rendering. Aggregated into non-reversible security tokens.

SMS Permissions (Optional)

Purpose: Parses financial transaction notifications (such as credit card spend alerts, due dates, and bank balances) to automatically populate credit tracking dashboards.

Usage & Protection: Localized client-side processing extracts only relevant financial numeric values. Personal or conversational texts are completely ignored and unread.

Call Log Permissions (Optional)

Purpose: Accesses call logs solely to verify your account activity, authenticate device identity, and prevent financial fraud or unauthorized transactions during high-risk operations.

Usage & Protection: Processed securely with strict privacy controls. Call history is analyzed in real time for security validation only and is never stored permanently, shared with third parties, or used for tracking personal communications.

3.Data Retention, Transfer & Erasure Rights

Data Protection in Transit: All data transmissions are locked with TLS 1.3 encryption.

Statutory Retention: Basic transaction logs are archived for a mandatory statutory period as prescribed by Indian financial regulations.

User Deletion Rights: You may request the full erasure of your personal data at any time. Non-statutory records will be deleted within 15 working days.