How Xciah handles your data.
This policy explains what we collect, where it is stored in India, what goes to cloud AI, and how your Vault is protected. It matches the in-app privacy policy updated on 17 October 2026.
Want a simple visual breakdown?
See our three-column diagram: what stays on your phone, what backs up to your account, and what goes to AI.
Contents
What we collect
In plain language
We collect your email for your account, the entries you create, and the receipts or voice notes you submit. We do not read your SMS, bank alerts, or notifications.
Account information: When you create an account or join our waitlist, we collect your email address to authenticate you and send product updates.
Entries you log: Spending, income, reminders, calendar events, habits, mood, sleep and health readings, notes, and goals that you type, speak, or scan into the app.
Vault items: Passwords, payment cards, identity documents, private notes, and document photos that you choose to store in the Vault.
Media: Photos of receipts and voice recordings that you submit in chat for transcription or expense scanning.
What we never collect: Xciah does not read SMS, bank alerts, UPI messages, or notifications from other apps. There is no automatic bank import. We never access your contacts, GPS location history, or call logs.
Where it is stored
In plain language
Logging works offline on your phone. Backups are stored in Google Firebase in India (asia-south1 region).
On your phone: The app understands most logging (amounts, dates, reminders, habits, mood, notes) directly on your phone. Logging works offline, and your entries sync to your account when your phone reconnects to the internet.
Backed up to your account: Entries, chats, habits, tasks, photos, and files are stored in Google Firebase (Firestore and Cloud Storage) in India (asia-south1 data region). This ensures your entries survive if you change phones.
Team access: The Xciah team can access non-Vault data only for customer support, security reviews, and resolving technical bugs. Vault items cannot be read by our team.
What is sent to AI and why
In plain language
The AI runs in the cloud over TLS encryption. Content is used only to answer your request and is never used to train AI models.
Cloud AI processing: The AI is not on your phone. Requests are sent over an encrypted connection (TLS) through Xciah's own server to our AI provider in the cloud.
The three things sent to AI: (1) Chat messages, recent conversation context, and a short summary of your own entries (recent spending, upcoming plans, open tasks, habits, and goals) to write the reply; (2) Voice notes, to transcribe spoken audio into text; (3) Photos, receipts, and documents sent in chat, to read their contents.
Zero model training and no sale: User content is processed only to return your result. Xciah does not use user content to train AI models and never sells personal data.
The Vault
In plain language
Vault items are encrypted with AES-256 on your phone before backup. The key never leaves your phone.
Phone-side encryption: Vault items are encrypted with AES-256 (CBC with HMAC-SHA256) on your phone before backup.
Key derivation: The Vault encryption key is derived from your PIN directly on your phone and never leaves your device. Xciah servers and staff cannot read your Vault items.
Biometric security: PIN unlock and optional fingerprint or face unlock run through your phone's biometric system. Xciah never receives your raw biometric data.
Chat sharing exception: If you explicitly choose to share a Vault item with Xciah in chat, that specific item is decrypted on your phone and sent to the cloud AI for that single query.
Analytics and crash reports
In plain language
We use Firebase Crashlytics and Firebase Analytics for pseudonymous diagnostics and stability.
Firebase Crashlytics: Collects technical stack traces, device model information, and operating system versions when unexpected crashes occur. This helps us quickly identify and resolve bugs.
Firebase Analytics: Collects pseudonymous usage statistics to understand overall feature engagement and improve app reliability.
No personal logs: These diagnostic tools do not receive your financial transactions, Vault records, or personal chat contents.
Your choices
In plain language
You control calendar access, notifications, and can permanently delete your account and all cloud data anytime.
Calendar access: The phone's own calendar can be displayed inside Xciah. This is strictly read-only and functions only if you explicitly enable it in settings.
Reminders and briefings: You can turn morning briefings, evening check-ins, and scheduled reminders on or off at any time.
Camera and microphone: The microphone activates only while you hold the voice button. The camera activates only when you tap to scan a receipt or take a document photo.
Account deletion: You can delete your account directly inside the app under You -> Data and privacy -> Delete account. This permanently deletes your account, all cloud data and uploaded files in Firebase, and clears local data on your phone.
Contact
In plain language
Reach out to our privacy team anytime with questions about your data.
For questions about this Privacy Policy or your personal information, email us directly at [email protected].
Company: Auxzon Solutions, India.
Governing jurisdiction: India.
Auxzon Solutions · Xciah Personal Life OS
Need help or have security concerns? Email [email protected] or [email protected].