Honest privacy
Where your data goes
No marketing jargon. Here is the plain truth about what stays on your phone, what backs up to your account, and what is sent to the cloud AI to answer you.
Stays on your phone
These items live on your device and are never exposed to outside servers in readable form.
- Your Vault encryption keyDerived from your PIN on your phone. It never leaves your device.
- On-phone sentence understandingAmounts, dates, reminders, habits, and notes are understood right on the phone.
- Offline loggingWorks with zero signal. Saves locally first, then syncs once you reconnect.
- Biometric authenticationFingerprint and face checks run through your phone's operating system (Face ID, Touch ID, or Android biometrics). Xciah never receives biometric images.
Backed up to your account
Stored securely so your data survives when you switch to a new phone.
- Your daily life entriesExpenses, income, habit logs, task checklists, and journal reflections.
- Chat history & uploaded filesConversation records, receipt images, and attachments saved in your account.
- Encrypted Vault ciphertextVault items are scrambled with AES-256 before backup. Xciah holds only unreadable ciphertext.
- India data centerStored in Google Firebase (Firestore and Storage; region India, asia-south1).
Sent to AI to answer you
The AI runs in the cloud. Data is sent over TLS through Xciah servers strictly to generate the answer.
- Chat and recent summaryYour prompt, recent conversation, and a short summary of recent spending, plans, and open tasks so the AI can reply accurately.
- Voice notesAudio is sent to the cloud speech service to turn it into written text.
- Receipt photos & documentsSent to the cloud vision AI to extract amounts, dates, and merchant items.
- Never used for AI trainingContent is used solely to produce your answer. It is never used to train our own AI models.
Common privacy questions
Simple, factual answers with no evasive legalese.
Do you read my SMS or bank alerts?
No. Xciah never asks for SMS or notification access. There is no automatic bank scraping. You log spending by typing, speaking, or scanning a paper receipt.
Do you sell my data?
No. Never. We make money by selling optional subscriptions (Xciah Pro). We do not run ads, sell personal information, or share data with brokers.
Do you train AI models on my data?
No. Your chat messages, voice notes, and receipts are sent to our cloud AI provider only to generate the immediate reply. They are never used to train our own AI models.
Can Xciah read my Vault items?
No. Your Vault is encrypted with AES-256 on your phone before backup. The key never leaves your phone. The only exception: if you specifically choose to ask Xciah about a Vault item in chat, that single item is decrypted on your phone and sent to the AI for that one question.
How do I delete everything?
Inside the app, go to You > Data and privacy > Delete account. This permanently purges your account, all cloud files, and clears the local database on your phone.