Privacy Policy

Effective 17 October 2026

NiNav ("NiNav", "we", "us") is an app that reminds you about renewals, expiry dates, bills, warranties and services. It is made by Design Blues, an independent developer based in India. This policy explains what information NiNav handles, why, where it goes, and the choices you have. If anything here is unclear, write to ninav.support@gmail.com.

1. What stays on your phone

The things you add to NiNav are stored in the app on your phone:

• Items and their names, categories and places (for example "Home" or "Office"; NiNav never uses your location).
• Dates, reminders, repeat settings, amounts and currencies, links and notes.
• Details you add to an item (for example a model or serial number), including the few that NiNav tags as sensitive.
• People you add to an item (a name, phone number and email).
• Photos of your items and files you attach (bills, policies, warranty cards).

Without an account, none of this is sent to us. Reminders are scheduled by your phone itself; we do not send them.

If you are signed in, NiNav can also send the words it reads from a scan, a shared page or what you say to our server to be understood (section 2), never the item you then save.

2. Phone features NiNav uses, and only when you use them

Reading by AI when you are signed in. To fill in a new item more accurately, NiNav sends the words it read from your scan, shared page or speech to our server, run on Cloudflare, where an AI model hosted by Cloudflare (Workers AI) says what they mean: the item's name and kind, its dates, the amount and how often it repeats. Before the words leave your phone, NiNav blanks emails, long numbers (phone, card, account, policy, Aadhaar, PAN and IMEI numbers) and the name a page labels as yours. Passport and driving licence pages are never sent; they are read on your phone. Only the words are sent, never a picture or a recording. Each reading carries Google's confirmation (Firebase App Check with Google Play Integrity) that it comes from the real NiNav app from Google Play on a genuine phone, so others cannot misuse the service; Google checks this on your phone under its own terms. Neither we nor Cloudflare keep the words or the answer, and Cloudflare does not use them to train AI models. The server keeps only a count of how many readings your account made today, so the free allowance is shared fairly; it is removed when you delete your account. You always see what was read and can change anything before saving. Signed out, or once the day's readings are used, everything is read on your phone as before.

3. Backups

• Android backup. Android can back up NiNav's data and the photos of your items (not your attached files, which go to your own Google Drive if you connect it) to your Google account, as it does for most apps. This is run by Google under its own terms and can be turned off in your phone's settings. We cannot see it.
• Backup file, encrypted end to end. In Settings you can save everything to a file and choose where it goes. The file is encrypted (AES-256) with a key that only your own devices hold, so nobody who finds the file can read it, and neither can we. The first time, NiNav shows you a recovery key to save: it opens your backups on any phone. NiNav never stores your recovery key and cannot recover it for you. A copy of your key is also kept in Google's Block Store, end-to-end encrypted with your phone's screen lock (Google cannot read it), so a new phone set up from your Google backup can open your backups too.
• Weekly backup in your own Google Drive. If you connect Google Drive and do not use Premium sync, NiNav saves the same encrypted backup file to NiNav (do not delete) › Backups in your own Drive about once a week and keeps the newest three. It is encrypted end to end like any backup file: Google and we cannot read it. You can turn it off, back up now or restore from it in Settings, Drive backups.

4. Your own Google Drive (optional)

Google Drive is optional and separate from signing in: you connect it yourself, from an item's files or from Settings. Once connected, the files you attach in NiNav are copied to a folder called NiNav (do not delete) in your own Google Drive, arranged by category and item (for example NiNav (do not delete) › Vehicle › Honda City), so they are safe if you change phones. NiNav asks only for permission to the files it creates there (the "drive.file" permission): it cannot see or change anything else in your Drive. We never receive copies of your files. You can stop using Drive in Settings; files already in your Drive stay there until you delete them.

5. Your NiNav account (optional)

You can sign in with Google, or with a sign-in link we email to any address you choose. There are no NiNav passwords. Sign-in, and sending those emails, is provided by Google Firebase Authentication. It stores your email address, the name you choose (or your Google name), a unique account ID and when you signed in. Signing in on its own sends none of your items anywhere.

6. Sync, a Premium feature (optional)

If you have Premium and are signed in, NiNav keeps a copy of your items and places on our sync server, run on Cloudflare, so they stay the same on all your phones and come back on a new phone. The copy is linked to your account ID and encrypted end to end: each item is sealed on your phone (AES-256) with your own key before it is sent, so our server stores only text it cannot read, and so does anyone who could see it. Your key reaches your other phones through Google's Block Store or your recovery key. The server keeps a copy of your key only locked with your recovery key, which we never have. If you lose your recovery key and every phone that has the key, nobody can open that copy, not even us; you can start over from the items on your phone.

Unlock with fingerprint (optional). If you turn it on, NiNav saves a passkey for NiNav in your password manager (Google Password Manager). The passkey gives your phone a secret that never leaves it, and your key is locked with that secret on your phone. Our server keeps only that locked copy and the passkey's ID, so a new phone signed in to your account can unlock your items with your fingerprint or screen lock. We cannot open the locked copy. You can turn it off in Settings, Sync; deleting your account deletes it.

• What is copied (encrypted): item names, categories, places, dates, reminder settings, amounts, links, notes, details without the "Sensitive" tag (including any detail you name yourself), people you added, and each attached file's name, size, type and Google Drive ID.
• What is never copied: details with the "Sensitive" tag, photos of your items, and the files themselves (those stay on your phone and in your own Drive).
• When you sign out, NiNav asks whether to keep your items on the phone or remove them from it. The copy in your account stays until you delete your account.

Family sharing (part of Premium, optional)

Someone with Premium can start a family of up to five people and share chosen items with them. A shared item travels with its name, dates, amounts and reminders; its place, notes, details, people, photo and files stay with the person who shared it. Shared items are encrypted end to end with a family key that only the family's phones hold, so our server cannot read them. Each member's copy of that key is locked to their own key. An invite carries the family key locked with the invite code; our server finds the invite only by a scrambled form of the code, never the code itself, and deletes invites after 7 days. The server keeps each member's name (as they set it in NiNav) so the family can see who is in it. Leaving the family, being removed, or the family ending removes what others shared from your phone; your own items stay. While you are in a family, our server keeps your phone's Firebase Cloud Messaging address and which family member last changed each shared item, so it can ping the others' phones when something changes. The ping carries nothing readable: your phone fetches the change and shows the notification ("Ravi marked EB bill paid") itself. Signing out or deleting your account removes that address.

Letting a phone back in. If your phone can no longer open the family key (for example a new phone), it asks your family to let it back in: our server keeps that request (a new public key, nothing readable) and tells the others' phones. Both phones show the same six-digit code. Another member checks the code with you and allows it on their phone, which locks the family key to your new phone. Our server cannot let anyone in by itself.

Invite a friend (optional)

When you are signed in, you can invite a friend with a link; when they sign in to NiNav from it, you both get 5 more free reminders, at most 10 more each. To count this fairly, our server keeps your invite code, who joined from whose invite and when, and a scrambled form (a keyed hash) of NiNav's own ID on each phone involved, so one phone can only count once. The phone's ID itself never leaves in a form anyone can read back; it is Android's ID for NiNav on that phone, not an advertising ID, and is used only to stop invites being misused. The server also asks Firebase Authentication when the new account was made, since invites are for people new to NiNav, and a claim carries Google's confirmation (Firebase App Check with Google Play Integrity) that it comes from the real app. When a friend joins, your phone is told their first name ("Ravi joined from your invite"). If your friend installed NiNav from your link, Google Play passes the invite code to NiNav on their phone (the install referrer). Deleting your account removes your code and your name from these records; the scrambled phone mark stays, so the same phone cannot be rewarded again.

7. Purchases

Premium is bought through Google Play, which handles payment. We never see your card, UPI or bank details. We use RevenueCat to confirm your purchase with Google Play; RevenueCat receives the purchase record (the plan, its dates and its status) and your NiNav account ID if you are signed in, so that Premium works on all your phones.

8. App settings from our server

NiNav uses Firebase Remote Config to receive a few settings (for example the sync server's address). To deliver them, Firebase uses an app installation ID that does not identify you personally.

9. Analytics and crash reports

NiNav does not currently collect analytics. If we add anonymous usage statistics later, they will never include what you type or store (no names, dates, amounts, notes or files), we will update this policy first, and there will be a switch in Settings to turn them off. Google Play may share crash reports with us if you allow it in your phone's settings; these help us fix problems and do not include your items.

10. What we never do

• We do not show ads, and we do not use advertising IDs.
• We do not sell or rent your information to anyone.
• We do not track you across other apps or websites.
• We do not use your location.

11. Who we share information with

Only the service providers that make NiNav's features work, and only for those features: Google (Firebase Authentication, Firebase Remote Config, Firebase App Check with Google Play Integrity, Google Drive at your request, Google Play), Cloudflare (sync server, Premium, Invite a friend, and reading scans and speech for signed-in people) and RevenueCat (purchases). We may also disclose information if the law requires it. These providers may store information in countries other than yours, under their own security and privacy commitments.

12. How long information is kept

• On your phone: until you delete it, use "Delete all my data" in Settings, or uninstall NiNav.
• Your account and synced copy: until you delete your account. Deleting it in the app (Settings, then tap your name: Account, Delete account) removes both straight away; if you ask by email, we delete them within 30 days.
• Purchase records: kept by Google Play and RevenueCat as the law and their own policies require.
• Invite a friend: who joined from whose invite, until either account is deleted; the scrambled phone mark is kept so a phone cannot be rewarded twice.

13. Security

Information sent between NiNav and our server is encrypted in transit (HTTPS). Every request to the sync server is checked against your sign-in, and each account can reach only its own data. Details with the "Sensitive" tag never leave your phone. Backup files, weekly Drive backups, synced items and shared family items are encrypted end to end. Whether you have Premium is checked by our server with the store, never taken from the app. No method of storage or transfer is perfectly secure, but we work to protect your information and will tell you if a problem affects it.

14. Your choices and rights

• See and change: everything is visible and editable in the app.
• Delete everything on the phone: Settings, Your data, Delete all my data.
• Delete your account and synced copy: Settings, tap your name at the top, then Delete account. See Delete your NiNav account or data for every way, including deleting your data but keeping your account.
• Withdraw permission: sign out, disconnect Google Drive, or turn off notifications, camera, microphone or contacts access in your phone's settings at any time.
• You can ask us what information we hold about you, ask us to correct or erase it, or raise a complaint, under India's Digital Personal Data Protection Act, 2023, and similar laws where you live (such as the GDPR in Europe). Write to ninav.support@gmail.com; we reply within 30 days.

15. Children

NiNav is not meant for children under 13, and we do not knowingly collect information from them. If you are under 18, please use NiNav with a parent's or guardian's permission.

16. Changes to this policy

If we change how NiNav handles information, we will update this page and its date, and tell you in the app before an important change takes effect.

17. Contact and grievances

Design Blues, India. Email ninav.support@gmail.com. This address is also our contact for grievances about personal data.