DocNest Privacy Policy

Last updated: 9 May 2026 Effective date: 9 May 2026

DocNest is a personal document vault built and operated by Rohit Kale (“we”, “us”, “DocNest”). This policy explains exactly what happens to information you put into the app — what we collect, where it is stored, who can read it, and what control you have. We have written it in plain English; the legal language is intentionally minimised.

If something here is unclear, email rohitkale523@gmail.com and we will fix the wording.

1. The short version

• Your documents belong to you. We never sell, license, advertise on, or share your documents with anyone outside the people you explicitly invite.
• Identity and Finance documents are end-to-end encrypted on your phone before they leave it. We literally cannot read them, even if compelled.
• Other categories are encrypted on our server (AES‑256) with TLS in transit. This is the same level of protection your bank uses for non-public records.
• All storage is in Mumbai, India (Supabase, Asia‑Pacific South‑1 / ap-south-1).
• You can delete everything any time from inside Settings → Delete account, and you can export everything as a JSON archive from Settings → Export data.
• AI processing is in-flight only. When DocNest extracts dates, issuer, and document numbers from your uploads, the file is sent to Google’s Gemini API. Per Google’s terms for paid Gemini API usage, your content is not used to train Google’s models and is not retained beyond the extraction request.

The rest of this document is the long version.

2. Who we are

3. What we collect

3.1 Account information

• Email address (required) — for authentication and to send the magic-link sign-in.
• Display name (optional) — pulled from your Google or Apple account if you sign in that way; you can clear it any time in Settings.
• User ID — a random UUID generated by Supabase Auth. This is the only “identifier” we use internally.

We do not ask for: phone number, postal address, age, gender, government ID, or payment information.

3.2 Documents you upload

• Photos, PDFs, audio recordings, and any other file you choose to add to a category.
• For categories marked as end‑to‑end encrypted (Identity, Finance, and any category you toggle to E2E in Edit Categories), the file is encrypted on your phone with a key derived from your vault password. We store only the ciphertext + a wrapped version of the document encryption key. We cannot decrypt these files even with full database access. Forgetting your vault password means permanent loss of those documents — there is no recovery.
• For categories without E2E (Health, Education, Insurance, Travel, etc., by default), the file is uploaded over TLS and stored encrypted at rest with AES‑256 by Supabase Storage. We can technically access these files; we do not, except when you explicitly request support.

3.3 Document metadata extracted by AI

After upload, each document is processed by Google’s Gemini API. We store the extracted fields: - Issuer (e.g. “Government of India”, “HDFC Bank”) - Issue date and expiry date - Document number (e.g. PAN, licence number) - A short summary - The full extracted text (for in-document search) - A vector embedding (768 floats) computed by Google’s text-embedding-004 model

For E2E categories, the extracted text and metadata stay encrypted at rest using your vault key — we cannot read them either.

3.4 Tags, categories, and organisation data

The labels you apply to documents, the category they sit in, the order you arrange categories in, favorite/emergency flags. Stored as plaintext in the database (these don’t reveal document contents).

3.5 Family sharing data

If you invite a family member, we store: - Their email address (so we know who you invited) - Their role (owner, editor, viewer, emergency) within your vault - The invitation token, until accepted

When they accept, their public X25519 key is stored so we can wrap document keys for them. Their private key never leaves their device.

3.6 Audit log

A line for every security-relevant action: uploads, shares, member additions, role changes, deletions. Used to populate the Activity Feed in the Family screen. We retain the audit log indefinitely; deletion is honoured when you delete your account.

3.7 Notifications

System-generated alerts (e.g. “Your PAN card expires in 30 days”). Stored until read or 90 days, whichever is later.

3.8 Push notification tokens

A Firebase Cloud Messaging (FCM) device token, so we can deliver expiry reminders to your phone. Tied to your user ID. Rotated automatically by Firebase; old tokens are cleared by us when they bounce.

3.9 Search queries

When you ask a question in the AI search bar, the question text plus the matched document snippets are sent to Google Gemini to compose an answer. We retain the question and the rendered answer for 30 days for product debugging; you can clear them any time in Settings → Clear search history (coming in a future release).

3.10 Crash reports and diagnostics

When the app crashes, we send a stack trace and basic device info (OS version, model, free memory) to Sentry. Personally identifiable information is scrubbed in our beforeSend hook before the payload leaves the device — emails, names, tokens, and any document content are stripped. Sentry retains this data for 30 days.

3.11 What we explicitly do NOT collect

• Advertising ID
• Location
• Contacts
• Calendar
• SMS or call logs
• Browsing history
• Biometric data — fingerprint / face unlock prompts go through Android’s BiometricPrompt API; the biometric template never leaves the secure enclave on your device
• Phone number

4. How your data flows

You ─── magic link / Google / Apple ───▶ Supabase Auth (Mumbai)
You ─── document upload ───────────────▶ Supabase Storage (Mumbai)
                                          │
                                          ├─ AES‑256 at rest (default categories)
                                          └─ Already E2E ciphertext (Identity / Finance)
                                          │
                                          ▼
                              Supabase Edge Function (Mumbai)
                                          │
                                          ▼
                              Google Gemini API (regional, no retention)
                                          │
                                          ▼
                              Extracted fields ─▶ Supabase Postgres (Mumbai)

Push notifications: Supabase Postgres → pg_net trigger → FCM v1 API → your device.

Crash reports: app device → Sentry (US, PII‑scrubbed).

That is the entire data path. There is no analytics SDK, no advertising SDK, no attribution SDK in the app.

5. Service providers we use

We have signed Data Processing Agreements with Supabase and Sentry. Google’s terms for the Gemini API are public at https://ai.google.dev/gemini-api/terms.

These are service providers processing data on our behalf, not third parties we sell or share data with. Per Google Play’s Data Safety taxonomy, this distinction matters: we declare no data sharing with third parties.

6. Why we collect each piece

We never use your data for advertising, profiling, or any analytics beyond aggregate counts of “uploads per day” used to plan capacity.

7. Sharing and disclosure

We do not share, sell, or rent your data to any third party.

We will disclose your data only: - To the family members you have invited, scoped to the role you granted them (editor / viewer / emergency). - In response to a valid Indian legal process (for example a court order under DPDP Act or CrPC). We will challenge overbroad requests where reasonable, and we will notify you unless legally prevented from doing so. - In a merger or acquisition — if we ever transfer the operation of DocNest, we will notify users at least 30 days in advance and your data will be handled under the same or stricter terms.

E2E-encrypted content is not technically disclosable: we do not have the key.

8. Where data is stored, and how long

• Mumbai, India (Supabase / AWS ap-south-1) for everything Supabase touches: auth, database, storage, Edge Functions.
• United States for Sentry crash reports (PII‑scrubbed; 30‑day retention).
• Google’s regional infrastructure for Gemini API requests; not retained per Google’s API terms.

Retention: - Documents and metadata: until you delete them, or until you delete your account - Audit log: until you delete your account - Crash reports: 30 days - Search queries: 30 days - Notifications: until read or 90 days

When you delete your account, all of the above is purged from our database within 7 days. Storage objects are unlinked immediately and physically deleted within 30 days as part of Supabase’s normal storage cleanup.

9. Your rights

Under India’s Digital Personal Data Protection Act, 2023 (DPDP), and as a matter of our own policy:

• Right to access — Settings → Export data generates a JSON archive with every record we hold about you, plus signed download URLs for your stored files.
• Right to correction — edit any document field directly in the app.
• Right to erasure — Settings → Delete account removes everything. There is no recovery period.
• Right to portability — the export above is JSON, machine-readable.
• Right to nominate — under DPDP §14, you may nominate someone to act on your behalf in case of incapacity. DocNest’s family-sharing feature is the in-app implementation: invite a trusted person and grant them access to specific documents.
• Right to grievance redressal — write to rohitkale523@gmail.com. We aim to respond within 7 days. If we cannot resolve your concern, you may contact the Data Protection Board of India.

We are the Data Fiduciary for the purposes of DPDP. The same email serves as our Grievance Officer contact.

10. Security practices

• Transport security: TLS 1.2+ between the app, Supabase, Gemini, FCM, and Sentry. Cleartext HTTP is blocked on Android via network_security_config.xml.
• At-rest encryption: Supabase Storage encrypts every object with AES‑256. Postgres on-disk encryption is default-on for Supabase managed projects.
• End-to-end encryption for Identity, Finance, and any category you toggle to E2E:
• Vault password → Argon2id → 32-byte vault master key (VMK)
• VMK never leaves your device
• Per-document data encryption key (DEK) generated from SecureRandom, used in AES‑256‑GCM
• DEK wrapped with VMK; the server stores only the wrapped DEK
• Filenames also encrypted with a HKDF-derived sub-key; the server sees only opaque ciphertext for the filename
• Authentication: Supabase Auth (email magic link, Google OAuth, Apple OAuth). JWT tokens with 1-hour TTL, refreshed transparently.
• Row-level security: every database table has explicit RLS policies. A user can only see rows in vaults they belong to. RLS is fail-deny by default.
• App lock: optional biometric (fingerprint / face) gate using Android’s BiometricPrompt or iOS LocalAuthentication. Biometric templates never leave the device.
• No service role key on the client — privileged operations are routed through Supabase Edge Functions with explicit auth checks.

We have not yet undergone an external security audit. If you spot something, write to the same email — we will treat security reports with priority.

11. Children

DocNest is not directed at children under 18. We do not knowingly collect data from minors. If we learn we have inadvertently collected data from a child under 18, we will delete it. The 18+ target audience is also declared on our Play Store listing.

12. International transfers

Data stays in Mumbai (Supabase), with the exceptions listed in §5: Sentry (US), Gemini API (regional Google infrastructure), FCM (Google infrastructure). These transfers are necessary for the named features. Per DPDP §16 currently, India does not restrict cross-border transfers to most jurisdictions; we will adapt this policy if the central government issues a restriction list.

13. Changes to this policy

If we materially change this policy (new data category, new processor, new sharing partner), we will: - Update the Last updated date at the top - Push an in-app notice you must acknowledge before continuing to use DocNest - Re-submit the Data Safety form on Play Store - Mention the change in the next release notes

Non-material edits (typo fixes, formatting) just update the date.

14. Contact

This policy is licensed under CC0 — feel free to adapt it for your own product.