Privacy policy
Your payments stay on your phone.
Daak has no internet permission. It can't send your data anywhere, so it doesn't. This page explains what the app touches on your phone and why.
Last updated 31 October 2026 · applies to the Daak Android app (dev.roshanramani.daak)
- Daak collects no personal data. There are no accounts, no servers, no analytics, no ads and no trackers.
- The app has no internet permission. Android itself stops it from going online.
- Your UPI PIN never enters Daak. You type it into the 123Pay call, which NPCI and your bank run.
- Your payment history is kept only on your phone and is never backed up.
- Your settings, favourites and My QR go into your phone's Android backup, but only when Google can encrypt it end to end with your screen lock. A reinstall or a new phone then picks up where you left off. Daak itself never sees that backup.
- Phone calls. To call the UPI 123Pay number for you. Daak only dials when you tap Pay, Balance or Set up. With this permission Daak starts the call and presses 123Pay's menu keys for you. If it's off, Daak asks for it when you tap Pay.
- Phone state. To show your SIM's carrier name and to follow the 123Pay call while it rings, connects and ends, so the screen can tell you what to do next. Calls are not recorded and call logs are not read.
- Incoming SMS. To spot your bank's debit alert after you pay, so Daak can mark the payment paid. Each new SMS is checked on the phone when it arrives. Daak only keeps details from a bank alert that matches a payment you started in the last 15 minutes: the amount, reference number, the payee name the bank shows, and the bank's name. All other messages are ignored and nothing is stored from them. Daak never reads your old messages and never sends SMS. You can switch this off any time in Settings › Auto-confirm; Daak then ignores your SMS and asks you after each payment instead.
- Contacts. Optional. To let you search and pick someone to pay. Names and numbers are read when you open the list and are not copied or kept, except the name and number of the person you actually pay.
- Camera. Optional. To scan UPI QR codes. Codes are read on the phone by Google's on-device ML Kit model. No photos are taken or saved.
- Notifications. To tell you when your bank confirms a payment.
- Fingerprint or screen lock. Optional, only if you turn on App lock. Daak asks Android to check your fingerprint, face or phone PIN when it opens. Daak never sees or stores them; Android only tells it whether the check passed.
What is stored on your phone
- Your payment ledger: payee name, mobile number or UPI ID, amount, note, time, status and, once confirmed, the bank's reference number, payee name and bank name.
- Your favourites: the names and mobile numbers you star, so they can show on Home.
- My QR: the UPI ID and name you type, used only to draw your QR on the phone.
- Your settings: language, light or dark mode, app lock and auto-confirm on or off, whether you finished setup, and whether your SIM is signed up for 123Pay.
- Quick amounts are worked out from your own ledger each time you open Pay. Nothing extra is saved for them.
- This data lives in the app's private storage. Other apps can't read it.
- Android backup includes only your settings, favourites and My QR, and only when the backup is end-to-end encrypted with your screen lock. The payment ledger is never backed up. To stop backups for the whole phone, turn off Backup in your phone's Settings.
- To delete it all, uninstall Daak or clear its storage in Android Settings › Apps › Daak › Storage.
- Daak shares nothing with anyone, including the developer. It has no way to.
- The payment itself is made by your bank over NPCI's UPI 123Pay service through your mobile carrier. They handle your payment under their own privacy policies. Daak is not linked to NPCI or any bank.
- Updates come through Google Play. If you installed Daak from Play, Play's own app checks for a new version and downloads it when you tap the update banner. Daak asks Play on the phone; Daak itself still has no internet permission. Google's handling of that is covered by Google Play's privacy policy.
- Daak uses Google ML Kit's bundled, on-device barcode model. Daak removes the internet permission ML Kit would normally add, so it can't send anything either.
- daak-theta.vercel.app uses no cookies and no analytics. Like any website, the host (Vercel) may keep standard server logs, such as IP addresses, for security.
- Daak is for people who have a bank account with UPI. It is not meant for children and does not knowingly handle children's data.
- Daak is made by Roshan Ramani, an independent developer in India. It isn't a bank or a payments company and never holds your money; it calls the UPI 123Pay service that works on every SIM.
- If this policy changes, the new version will be posted here with a new date.
- Questions? Write to Roshan Ramani at roshanramani.dev@gmail.com.