Why Daak has no internet permission (and why that's the point)
A payments app that can't go online sounds odd. Here's why Daak removed internet access completely, what it does on your phone instead, and how to check it for yourself.
Here's a fun fact about Daak: it can't connect to the internet. Not "doesn't by default". Can't. The permission isn't there.
When people hear that, the first reaction is usually "Wait, how does a payments app work without internet?" The second is "...and why would you do that on purpose?" Both fair questions.
How it works without internet
Daak never moves money. Your bank does. Daak just calls UPI 123Pay, NPCI's offline UPI service, which works over an ordinary phone call on every SIM. (It used to open *99# too, until that proved too unreliable.)
Your PIN goes into that call, straight to your bank. Then your bank sends you an SMS, and Daak reads it on your phone to mark the payment paid. Not a single step of that needs the internet.
Why remove it completely?
Because a payments app sees sensitive stuff: who you pay, how much, your bank's messages, maybe your contacts. The safest data is data that can't leave.
Plenty of apps promise they won't send your data anywhere. That's a promise. Removing the internet permission is different: Android itself blocks the app from ever opening a connection. You don't have to trust me. The phone enforces it.
There's one small technical twist. Daak reads QR codes with Google's ML Kit, which normally adds internet permission to an app so it can send usage stats. Daak strips that permission back out when it's built. The QR reader is bundled inside the app and runs entirely on your phone.
What stays on your phone
- Your payment history. Who, how much, when, and the bank's reference number. It's kept in the app's private storage, and cloud backup is switched off for Daak.
- Bank SMS. Daak checks each new message as it arrives. If it's a debit alert that matches a payment you just made, it keeps the amount, reference number, payee name and bank name. Everything else is ignored and not saved. Daak never reads your old messages and never sends any.
- Contacts. Only read when you open the contacts list. Only the person you actually pay gets saved, with that payment.
Check it yourself
You don't have to take my word for any of this:
- Long-press the Daak icon, tap App info, then Permissions. You'll see Phone, SMS, Contacts, Camera and Notifications. No network.
- Turn off mobile data and Wi-Fi, then make a payment. Daak works exactly the same.
- Read the privacy policy. It's short, because there isn't much to say.
The trade-offs
No internet means no cloud sync, no account and no "restore on your new phone". If you switch phones, your Daak history stays on the old one. (Your bank still has every transaction, of course.) It also means no crash reports, so if something breaks, I only find out when you tell me.
I'll happily take that deal. A payments app that physically can't leak your data is worth a few missing features.
Curious how Daak knows a payment went through without a server? That's all in your bank's SMS is the receipt.