Privacy Policy
Last updated: 31 July 2026
Mona is developed by Arunachalam P / Skynite ("the Developer"). This policy explains what Mona accesses, where it is stored, and what is never shared.
The short version
- Mona has no backend server. The Developer holds no copy of your data and cannot access it.
- Your data lives on your device, and — if you sign in — in an app-created folder inside your own Google Drive.
- We do not sell your data, and we use no advertising or analytics SDKs.
Data we access and why
| Google account (name, email, profile) | Sign-in, to create your Mona folder in Drive. Stored in secure device storage. Shared with Google for sign-in only. |
|---|---|
| Google Drive files (app-created folder only, drive.file scope) | Sync and backup of documents, expenses, journal, recipes and family data. Stored in your own Google Drive. Mona can never touch the rest of your Drive. |
| SMS messages (Android, READ_SMS) | Optional. Detects bank and UPI transaction alerts to auto-track expenses. Parsed on-device only. Mona does not read, store, or transmit non-transactional SMS. Never shared. |
| Camera | Scanning documents and receipts, journal and recipe photos, and camera translation. Stored on device, optionally synced to your Drive. Camera Translate sends the image to Google Cloud Vision/Translation for that feature only. |
| Photos and files you pick | Attachments for vault documents, expenses, journal and recipes. Stored on device, optionally synced to your Drive. Never shared. |
| Microphone and audio | Voice journal entries and voice expense entry. Stored on device, optionally synced to your Drive. Never shared. |
| Email credentials (IMAP app password, Subscriptions, opt-in) | Scans your inbox for recurring billing emails. Held in the device OS keychain and never transmitted to the Developer. Connects directly from your device to your mail provider. |
| Financial and expense data you enter or import | Expense tracking, budgeting and subscription detection. Stored on device, optionally synced to your Drive. Never shared. |
| Purchase status | Unlocks Premium features. Held by Google Play Billing and on your device. |
What we do not do
- We do not run a server or database — we cannot see your documents, expenses, journal entries, SMS content, or email content.
- We do not sell your data.
- We do not use third-party analytics or advertising SDKs.
- We never request full Google Drive access — only drive.file, which limits Mona to files it creates itself.
On-device processing
Receipt and recipe OCR, document scanning, SMS parsing and subscription email classification all run on-device. No image, message, or email content is sent to the Developer for processing — there are no Developer servers. Camera Translate is the one exception: it sends the captured image and detected text to Google Cloud Vision and Cloud Translation solely to produce the translation, governed by Google’s own terms.
Permissions and how to withdraw consent
Every sensitive permission is optional and is requested only when you use the feature that needs it, after an in-app explanation. You can withdraw consent at any time and Mona keeps working.
- SMS (READ_SMS, Android only) — used solely to detect bank and UPI transaction alerts and turn them into expenses. Parsing is entirely on-device; content, senders and metadata are never uploaded, sold, or shared. Personal messages and OTPs are ignored. Revoke at Android Settings → Apps → Mona → Permissions → SMS → Don’t allow. Afterwards you can still add expenses manually or import CSV, PDF and XLSX statements.
- Camera, Microphone, Photos and Files — revoke the same way, under Android Settings → Apps → Mona → Permissions.
- Google Drive — disconnect in Mona Settings, or revoke Mona entirely at myaccount.google.com/permissions.
Entitlement and billing boundary
Mona Premium is sold through Google Play billing only — never UPI, never bank transfer, never any other channel. Mona holds no payment instrument and never sees your card or bank details.
Mona operates no entitlement server today. If one is added, it will store identity, licence state, and verified purchase records only — never vault documents, expenses, journal entries, SMS content, email bodies, UPI VPAs, payment amounts, or payee details.
Your rights (GDPR, UK GDPR, and similar laws)
Data controller: Arunachalam P / Skynite, contact arunachalam.skynite@gmail.com. No data processor acts on our behalf, because we operate no servers.
Legal basis: Mona processes data on your device to deliver the functionality you ask for. Where the GDPR applies, the bases are performance of a contract (providing the app you installed) and consent (each optional permission — SMS, camera, microphone, files, mailbox — granted separately and withdrawable at any time). We do not rely on legitimate interest for tracking or profiling, because we do none.
Because Mona has no backend, the Developer holds no copy of your personal data — no account on our side, no database to query, nothing for us to disclose, correct, or erase. You hold all of it. Your rights are exercised directly and take effect immediately:
- Access and portability — export your records from within the app at any time; your Drive folder holds the synced copies in open JSON.
- Rectification — edit or delete any entry in the app.
- Erasure — Settings → Danger zone deletes from device and Drive; uninstalling removes the rest.
- Restriction and objection — revoke any permission in Android Settings, or disconnect Drive, and that processing stops.
- Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
- No automated decision-making — Mona does not profile you. Budgets and forecasts are calculations shown to you, not decisions about you.
International transfers: your data stays on your device and in your own Google Drive account. We transfer it nowhere. Google’s handling of your Drive and account data is governed by Google’s own policy.
Complaints: contact us first at arunachalam.skynite@gmail.com. You also have the right to lodge a complaint with your local data protection supervisory authority — in the EEA your national DPA, in the UK the Information Commissioner’s Office.
Other jurisdictions: the same self-service rights satisfy equivalent requirements under India’s DPDP Act and US state laws such as the CCPA/CPRA. We do not sell or share personal information as those terms are defined.
Data retention and deletion
- Local data can be deleted at any time by deleting entries in-app or uninstalling Mona.
- Drive-synced data can be deleted from your Google Drive directly, or by disconnecting Drive in Settings.
- IMAP app passwords are removed from the device keychain when you disconnect the mailbox.
- To delete everything, use Settings → Danger zone, then unlink Drive and uninstall. See the Delete Your Data page in this app.
Children
Mona is not directed at children and is not intended for users under 13, or the minimum age in your jurisdiction.
Changes to this policy
We may update this policy as the app changes. Material changes will be reflected by updating the "Last updated" date above.