Security overview

How OmniAsset is built to protect your money data. This describes what the app actually does today, not a roadmap.

Where your data lives

At setup you pick one of two modes, and you can change your mind later.

The on-device database is encrypted, and its key is held in the Android keystore. Backups you export are encrypted with a passphrase that only you know — we cannot read a backup file, and we cannot recover one for you if the passphrase is lost.

Analysis you can check

The health check runs on a server because it needs reference data — NAV history, benchmark series, scheme documents — that would be impractical to ship to a phone. What comes back is a signed report:

• Each report carries a signature over the exact bytes of the full report.
• The app verifies that signature, and the report's own hash, before anything is rendered. A report that fails verification shows nothing at all rather than showing unverified numbers.
• Each report names the exact reference-data snapshot it was computed from, so the same inputs can be checked again later.

Your portfolio is analysed and returned. It is not kept on the server afterwards.

Statement files stay on the phone

When you import a statement, the file is parsed on the device. The file itself is never uploaded, and there is no server endpoint that accepts a raw statement or a statement password — that route was removed deliberately rather than left disabled.

The AI boundary

AI is off until you turn it on, and there are three separate routes, which never mix:

• Built-in — included with Premium. We run it for you.
• Your own API key — your key, stored encrypted on your device, talking to your provider account.
• Your own computer — the work happens on a machine you already control; your AI sign-in never leaves it.

Whichever route you pick, before each send the app shows the exact compact summary that will leave the device. Statement files, credentials and raw transaction history are never part of it.

Reference data

Market and scheme data comes from free public sources — AMFI, SEBI scheme documents, NSE and BSE, RBI and Nasdaq. It is collected on a schedule into an immutable, content-addressed snapshot, and every figure the app shows carries the source and the date it was observed. When a value is missing, the app says it is missing; it does not substitute an estimate.

Deleting your account

You can delete your account and its cloud copy from inside the app, or from this page without the app installed. Either route proves ownership of the email first, shows you exactly what will be erased and what must be retained, and finishes with a receipt.

This website

It is static. The only measurement it uses is Cloudflare's privacy-friendly Web Analytics — cookieless and aggregate, with no cross-site tracking, no personal profiles, and nothing sold; it tells us roughly how many people visit and where from, so we know where to focus. Apart from that beacon and the bot-check widget on the deletion page, there is no third-party runtime code, and no secret in any file it serves. It runs under a strict Content-Security-Policy that permits scripts only from this origin, that analytics beacon, and that bot-check widget.

App analytics

The app collects no analytics unless you turn on Help improve OmniAsset in Settings — it is off by default. When on, it sends only anonymous product-usage events (for example that a health check completed) with a rotating anonymous install id, app version, coarse locale, a month-level install cohort, and the acquisition source. There are no advertising or cross-site tracking SDKs. Your holdings, amounts, names, transactions, email and account id are never collected — the event design makes that impossible and the server rejects anything outside a fixed, non-financial event list. Turn it off and delete the identifier anytime in Settings. See the privacy policy for the full list.