Moray app
Moray is developed by Vlight Software Solutions (“Vlightsoft”), India, which is the Data Fiduciary (controller) for the personal data described here. Contact and Grievance Officer: admin@vlightsoft.com. We reply within 7 days and resolve grievances within 30 days.
1. The short version
- Your records are stored with Supabase in India (Mumbai region), encrypted in transit. Family members see only what your privacy settings allow; “Only me” stays private.
- Bank SMS capture is optional and starts only after you enable it and accept the consent explanation. OTPs and personal messages are skipped on the phone; OTPs never leave it.
- Moray AI is optional. Account numbers, references and phone numbers are masked before data is sent to AI, without family member names.
- Contacts stay on your phone. Moray does not store or upload your audio.
- Rewarded ads are Free-plan only, not personalised, and never shown on child profiles. Moray does not use the advertising ID.
- We never ask for your bank credentials or sell your data.
- You can export your data or delete your account. Account deletion has a 7-day grace period.
2. What we collect and why
| What | Examples | Why | Where it goes |
|---|---|---|---|
| Account | name, email address, Google account name and email if you sign in with Google, language | sign in, identify you to your family | our Supabase database in India |
| App lock | your MPIN | lock the app on your phone | stays on your phone, as a salted hash only |
| Household | members you invite, their roles, invite links, child profiles added by a parent, privacy settings | family sharing | our Supabase database in India |
| Money records | expenses, income, transfers, categories, payees, notes, budgets, bills, loans and EMIs, goals, events and splits, subscriptions, tax tags | the core features | our Supabase database in India |
| Bank, card and wallet accounts | account name, type, bank name, last 3–4 digits, card limit, statement and due day, balances and available limit as reported in bank messages, card bills, fees, reward points, suggested new accounts | balances, card bill reminders, utilisation, reports | our Supabase database in India; visible to you, and to family only as your privacy setting allows |
| Bank and payment messages (optional) | SMS from bank and payment sender IDs; notifications from payment apps | automatic capture of payments | read on your phone; see section 3 |
| Foreign-currency amounts | the original amount and currency, and the exchange rate used | convert to your base currency and show the rate used | our Supabase database in India |
| Receipts and attachments (optional) | photos or files you attach | proof of purchase, warranty reminders | our private cloud storage; read on your phone and sent to AI only when you request AI reading |
| Bank statements (optional) | PDF statements you pick | import past payments | read on your phone; if you use Moray AI, masked text from statement pages is sent for reading. Only the entries you confirm are saved |
| Place tag (optional) | place name and coordinates when you add an entry and allow location | “where did I spend” | stored on that entry; coordinates are only shown to you |
| Contacts (optional) | a payee's phone number or UPI ID looked up in your contacts | show a name instead of a number | looked up on the phone; only that payee name is saved; your contact list is never uploaded |
| Voice (optional) | “Hi Moray” wake word, spoken entries | hands-free entry | the wake word runs offline on the phone; spoken entries use your phone's speech service, and Moray receives only the text, never audio |
| AI requests (optional) | the data a feature needs (section 4) | AI features you turn on | our AI gateway and our AI provider |
| Referrals | your invite code, who used it, the first name of the friend who joined, the credits given; the code carried by a Google Play install link | give both of you referral credits, prevent abuse | our Supabase database in India; a friend's email is never shown to you |
| Purchases | plan, Google Play order ID, purchase state, expiry, credit packs (a one-way hash of the purchase token) | give you the plan you paid for | our Supabase database in India; payment is handled by Google Play and we never see your card or UPI details |
| Technical | app version, language, request times, security logs (such as sign-in and role changes) | security, abuse prevention, support | our Supabase database in India |
We do not collect your SMS inbox as a whole, OTPs, personal messages, call logs, contact lists, background location, the advertising ID, device identifiers for tracking, full card or account numbers, CVV, PINs or banking passwords. Moray uses Google AdMob for optional rewarded ads on the Free plan (section 6). Google Play may show us aggregated crash statistics.
3. Bank SMS and payment notifications
This feature is off until you turn it on after an in-app explanation, your consent and the required Android permission. You can switch it off at any time in the app (Me › Auto-capture) or by removing the SMS or notification access permission in Android settings.
- Only messages from bank or payment sender IDs (such as VM-HDFCBK) or payment apps are looked at. A message from a person's phone number is rejected without reading its text.
- OTPs, verification codes, promotions, payment requests and failed or declined payments are skipped.
- The phone extracts: amount and currency, paid or received, payee, last 3–4 digits of the account or card, bank name, reference number, date, balance or available limit, card bill amounts and due date, fees, reward points, refunds and EMI conversions.
- Uploaded: those fields, plus the message text (up to 480 characters) so you can check the entry on the review card. The text is deleted when you confirm the entry or mark it “Not mine” or “Duplicate”, unless you choose to keep it.
- If a message mentions a card or account ending we don't know yet, Moray suggests adding it. Nothing is created until you confirm, and suggestions are visible only to you.
- If AI is on and the phone's rules cannot read a bank message, the message may be sent to our AI (section 4) with every long number masked except its last 4 digits and amounts.
4. Moray AI
AI is optional and you choose which features run. You can switch it off in AI Center. Requests go from the app to our AI gateway, which checks your plan and credits, masks personal identifiers (account numbers, references, phone numbers, email addresses, UPI IDs, PAN, Aadhaar-like and other long numbers except their last 4 digits) without sharing family member names and sends the minimum needed to our AI provider (OpenAI, through its API). Income and notes are included only if you allow that in AI settings. Receipt photos sent for reading are not stored by the gateway.
Our provider processes the data only to return the answer and, under its API terms, does not use it to train its models; it may keep it for up to 30 days for abuse monitoring. We keep a log of each AI request (feature, model, time and credits, not the content) and your chat history, which is private to you and expires after 12 months or when you clear it. AI suggestions are suggestions: nothing is saved without your confirmation.
| AI feature you choose | What is sent |
|---|---|
| Bank SMS reading | Bank-message text with account numbers, references and phone numbers masked. OTPs never leave the phone. |
| Statement import | Masked text from the statement pages you choose to process. Only confirmed entries are saved. |
| Receipt reading | The receipt photo or text you request help with. Receipt contents can contain personal details; review what you choose to send. |
| Chat and insights | Your question and the financial context needed for the selected feature, with identifiers masked and without family member names. Income and notes are included only if you allow them. |
5. Phone permissions
| Permission | Why Moray asks | Your control |
|---|---|---|
| SMS | Read bank and payment messages for optional auto-capture, after consent. | Enable in the app; revoke in Android settings at any time. |
| Notification access | Read payment notifications if you enable capture. | Choose whether to grant Android notification access. |
| Contacts | Look up a payee name on your phone. | Optional; your contact list is never uploaded. |
| Location | Add a place to an entry when you request it. | Optional; no background location, and coordinates are not shown to other family members. |
| Microphone | Voice entry through your phone's speech service. | Optional; Moray receives text and does not store or upload audio. |
| Camera and selected photos | Scan a receipt or attach a photo you choose. | Optional; AI reading happens only when requested. |
| Notifications | Show bill, EMI and other reminders. | Choose whether to allow them in Android settings. |
6. Ads and rewarded credits
On the Free plan only, adults can choose to watch a Google AdMob rewarded ad for 4 AI credits, up to 5 ads per person per day. Ad credits expire after 30 days. Ads are not personalised, are never shown on child profiles, and do not appear on Plus or Pro. Moray does not use the advertising ID. Users in the EEA and UK are shown the applicable consent form.
The ad service processes technical information needed to deliver ads, measure interactions and prevent fraud. Your financial entries, SMS, receipts and AI chat are not provided for advertising. Reward verification is handled by Moray's server. See Google's privacy policy (opens in a new tab) for how Google handles data.
7. Who can see your data
- You.
- Your household, only as each entry's privacy setting allows (Only me, Amount shared, Category shared, Full details). Captured SMS entries, account suggestions and accounts you mark private are “Only me”.
- Our service providers, who process data only on our instructions: Supabase (database, authentication, file storage and server functions), OpenAI (AI features, only if you turn them on), Google (Google sign-in if you use it, Google Play billing and install referrer, AdMob rewarded ads on the Free plan, your phone's speech service if you use voice entry). Exchange rates are fetched from a public rates service (only currency codes are sent), and the offline voice model is downloaded from alphacephei.com (nothing about you is sent).
- Authorities, only when Indian law requires it.
We do not sell or rent your personal data. Financial records, bank messages, receipts and AI chat are not shared for advertising. The technical processing for optional ads is explained in section 6.
8. Where data is stored and how it is protected
Data is stored with our hosting provider, Supabase, in the India (Mumbai) region. Everything travels over HTTPS; the app refuses unencrypted connections and does not trust user-installed certificates. Data is encrypted at rest. Row-level security in the database means each request can reach only the rows your role and privacy settings allow; server keys never ship in the app. On the phone, your sign-in session is encrypted with a key kept in the Android Keystore, and none of this is included in Android backups or device-to-device transfer.
AI requests to our provider may be processed outside India (United States); we rely on the provider's contractual safeguards and send only masked data. If a personal-data breach happens we will inform you and the Data Protection Board of India as the law requires.
9. How long we keep data
| Data | Kept |
|---|---|
| Your records, accounts, budgets | while your account is active |
| Original SMS or notification text on a captured entry | until you review it, or as long as you choose to keep it |
| AI chat history | 12 months, or until you clear it |
| AI request log (no content) and security logs | up to 24 months |
| Purchase records | for the legally required tax and accounting retention period |
| After you ask to delete your account | a 7-day grace period in which you can cancel; after 7 days, your account and personal data are permanently erased, except records we must keep by law (see Delete your account) |
| Disaster-recovery backups | roll over within 30 days |
| Recently deleted items | 7 days before removal |
If you are the last member, the whole family and its entries, accounts, budgets, bills, loans, goals and receipts are deleted. Shared records remain with a family that still has other members.
10. Your rights
Under the Digital Personal Data Protection Act, 2023 (and, where it applies to you, the EU or UK GDPR) you can:
- access and export your data (Me › Privacy and data › Export my entries, as a CSV file; or write to us for a complete copy);
- correct it (edit any entry or your profile);
- delete your account (Me › Settings › Delete account (also under Privacy & data), or vlightsoft.com/moray/delete-account);
- withdraw consent for any optional feature (SMS capture, notification capture, contacts, location, voice, AI) in the app or in Android settings; this does not affect what was done before;
- nominate someone to exercise your rights if you die or are unable to (write to us);
- complain to our Grievance Officer at admin@vlightsoft.com and, if not resolved, to the Data Protection Board of India (or, for the GDPR, your local supervisory authority).
Our legal bases are your consent (optional features and AI) and performance of the service you signed up for.
11. Children
Moray is for adults (18+). Children cannot have their own login. A parent may add a child profile (a display name and optional birthday day and month) to track family spending; these profiles are managed by the parent and cannot sign in. Ads are never shown on child profiles.
12. Changes and contact
We will show a notice in the app before a material change takes effect and update the date at the top of this page.
Vlight Software Solutions (“Vlightsoft”), India · admin@vlightsoft.com · Moray support · Website privacy for vlightsoft.com itself is covered by the Vlightsoft privacy policy.
Clarity in every system.
Explore all Vlightsoft products
See SUKAI for an organised home, Moray for family finances and Passkey-X for your private digital vault.