Legal

Privacy Policy

Last updated: May 30, 2026

1. Introduction

This Privacy Policy explains how NIKKS CREATIONS ("we", "our", "us") collects, uses, stores, and protects information when you interact with our website (nikkscreations.in) and our mobile applications distributed via the Samsung Galaxy Store, including but not limited to PocketWise AI, AI Workout Planner, and CryptChat (collectively, the "Services").

We are committed to protecting your privacy. By using our Services, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our Services.

2. Data We Collect

We collect data in the following categories:

Account Information

• Email address, display name, and profile information you choose to provide
• Authentication credentials managed through Firebase Authentication

Application Data

• Content you create within our apps (e.g., budgets, expenses, fitness data, messages)
• App preferences, settings, and configuration
• Subscription and purchase history (handled by Samsung)

Technical Data

• Device model, operating system version, and language settings
• App version, crash logs, and diagnostic information
• Anonymized usage analytics
• IP address and approximate location (country level) for fraud prevention

3. How We Use Your Data

We use collected data to:

• Provide, maintain, and improve our Services
• Authenticate users and manage accounts
• Process in-app purchases through Samsung billing
• Deliver AI-powered features and personalized recommendations
• Send service-related communications and respond to inquiries
• Detect, prevent, and address fraud, abuse, or security threats
• Comply with legal obligations

We do not sell your personal data to third parties.

4. Firebase Services

We use Google Firebase to power core backend functionality, which may include:

• Firebase Authentication for secure sign-in and user identity management
• Cloud Firestore for storing user-generated content and app data
• Firebase Cloud Functions for backend logic and integrations
• Firebase Crashlytics for crash reporting and stability improvements
• Firebase Cloud Messaging for push notifications
• Firebase Remote Config for feature configuration

Firebase processes data in accordance with Google's Privacy Policy, available at policies.google.com/privacy.

5. Analytics

We use Firebase Analytics and similar analytics tools to understand aggregate usage patterns, identify performance issues, and improve our Services. Analytics data is processed in an anonymized and aggregated manner where feasible. You may be able to opt out of analytics within the app settings of supported applications.

6. AdMob and Advertising

Some of our applications may display advertisements served by Google AdMob. AdMob may collect device identifiers, IP addresses, and limited interaction data to serve relevant ads and measure performance. AdMob's data practices are governed by Google's Privacy & Terms.

Users can reset or limit ad personalization through their device's privacy settings:

• Galaxy device: Settings → Google → Ads
• Or by visiting adssettings.google.com

7. Samsung IAP and Billing

All in-app purchases and subscriptions in our applications are processed through the Samsung In-App Purchase (Samsung IAP) system. We do not directly store your payment card details. Billing data — including purchase tokens, subscription status, and receipts — is provided by Samsung. Refund requests, cancellations, and billing disputes are handled through Samsung Galaxy Store. Please review Samsung Galaxy Store policies for specific terms.

8. AI APIs and Processing

Certain features in our applications rely on third-party large language model providers (such as Google Gemini, OpenAI, or similar). When you use AI features, your input may be transmitted to these providers for processing. We take reasonable steps to minimize the data shared and apply prompt-engineering practices to avoid unnecessary disclosure of personal information.

Important: AI-generated outputs are provided for informational and convenience purposes only and may contain inaccuracies. They should not be considered professional financial, medical, legal, or other advice.

9. Encrypted Messaging Notice

Our messaging application CryptChat uses encryption protocols to protect the confidentiality of messages exchanged between users. While we strive to provide strong cryptographic protection:

• We do not have access to the plaintext of end-to-end encrypted messages
• Metadata such as account identifiers, message timestamps, and delivery status may still be processed to operate the service
• Loss of cryptographic keys (e.g., due to device reset) may result in loss of access to encrypted message history
• No system is perfectly secure; we make no guarantee against all forms of attack

10. SMS Auto-Capture (PocketWise AI, Android only)

Our personal finance application PocketWise AI offers an optional "Capture bank SMS" feature that can read transaction-related SMS messages on your Android device to help you log expenses automatically. This feature is off by default and must be explicitly enabled by you in the app's Settings.

What we read: When enabled, the feature scans incoming SMS messages from financial senders such as banks, card issuers, and UPI applications to identify transaction details (amount, type of transaction, merchant or counterparty, and date).

How the data is handled:

• SMS content is processed entirely on your device. The message text is never uploaded to NIKKS CREATIONS servers, never transmitted to any third party, and never used for analytics or advertising.
• Parsed transaction drafts are stored locally on your device until you review and confirm them. Once confirmed, the resulting transaction record is saved to your PocketWise AI account using the same cloud sync mechanism as any other transaction you create manually.
• If parsing fails, the original SMS text remains on your device and is not exfiltrated. Anonymous parser failure counts may be recorded in Firebase Crashlytics, but the SMS body itself is never logged.
• Required Android permissions: READ_SMS and RECEIVE_SMS. These are restricted permissions; you are prompted by the Android system before granting them.

Your controls: You can disable the feature at any time from PocketWise AI's Settings screen, which immediately stops the SMS listener. You can also revoke the Android SMS permission from your device's system Settings. Disabling the feature does not delete transaction drafts that were already created — you can clear those from the in-app "SMS captures" review screen.

Platform availability: SMS reading is technically possible only on Android. On iOS, third-party applications cannot access SMS messages, so this feature is not offered. On Galaxy Store builds, the feature is available immediately. On Google Play Store builds, availability may depend on Play Store's restricted-permission review process.

11. UPI Payment Integration (PocketWise AI)

PocketWise AI offers a "Pay via UPI" feature that lets you initiate a UPI payment to a payee directly from within the app. PocketWise AI is not a payment processor or financial institution and does not handle, hold, or transmit funds. Payments are processed entirely by your chosen UPI application (such as Google Pay, PhonePe, Paytm, BHIM, or any other installed UPI app), your bank, and the UPI network (NPCI).

What we pass to the UPI app: When you tap "Pay now", PocketWise AI constructs a standard upi:// deep link containing only the information you entered: the payee's UPI ID (VPA), payee name, amount, and an optional note. PocketWise AI then hands this deep link off to the Android system, which lets you choose which UPI application to open. PocketWise AI does not see your UPI PIN, bank credentials, account number, or any authentication data.

What we do not receive back: The UPI protocol does not return payment confirmation or failure status to the originating app. PocketWise AI therefore does not know whether your payment succeeded, failed, was declined, or is pending. When you return to PocketWise AI after attempting a payment, you are shown a confirmation screen to manually record the transaction — you decide whether to save it as an expense based on what actually happened in your UPI app and bank.

Data we store related to UPI payments: If you choose to save a UPI-initiated transaction, the saved record includes the payee VPA, payee name, amount, note, and timestamp — the same data you would record manually. Bank-side payment details (success codes, settlement times, your account balance, and so on) are not visible to us and are not stored.

12. App Lock, PIN, and Biometric Authentication

PocketWise AI offers an optional App Lock feature that requires a PIN or biometric authentication (fingerprint or face unlock) to open the app. This feature is off by default and must be enabled by you in Settings.

• PIN storage: Your chosen PIN (4 or 6 digits) is stored locally on your device using Android's secure storage facilities. The PIN is never transmitted to NIKKS CREATIONS servers and is not part of cloud backups associated with your account.
• Biometric authentication: When you enable biometric unlock, PocketWise AI uses the Android BiometricPrompt system API to request authentication. The actual biometric data (fingerprint template, face geometry) never leaves your device and is managed exclusively by the Android operating system and your device hardware. NIKKS CREATIONS has no access to your biometric templates, scans, or images.
• Lock state: Whether the app is locked at a given moment is tracked locally on your device. Locking does not affect cloud-stored data.
• Forgotten PIN: Because the PIN is stored only on your device, NIKKS CREATIONS cannot recover or reset it for you. If you forget your PIN, you may need to reinstall the app or sign back in with your account credentials, which may make locally-cached data inaccessible until re-sync.

Disabling App Lock from Settings removes the stored PIN and disables biometric unlock immediately.

13. Cookies and Local Storage

Our website may use cookies or browser local storage to remember preferences, support analytics, and improve performance. Our mobile applications may use local device storage to cache user data and configuration. You can control cookie behavior through your browser settings.

14. Third-Party Services

We rely on the following categories of third-party services:

• Cloud infrastructure: Google Firebase, Google Cloud
• App distribution and billing: Samsung Galaxy Store, Samsung IAP
• Advertising: Google AdMob (where applicable)
• AI processing: Google Gemini API, OpenAI API, and similar providers
• Analytics and crash reporting: Firebase Analytics, Firebase Crashlytics

Each provider operates under its own privacy practices. We encourage you to review their policies.

15. Account Deletion

You may request deletion of your account and associated personal data at any time:

• In-app: Most of our applications include a "Delete Account" option in Settings
• Email: Send a deletion request to support@nikkscreations.in from the email associated with your account

We will process deletion requests within a reasonable timeframe. Certain data may be retained for legal, accounting, or fraud-prevention purposes as required by law.

16. Your Rights

Depending on your jurisdiction, you may have rights including:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate data
• The right to request deletion of your data
• The right to object to or restrict certain processing
• The right to data portability
• The right to withdraw consent
• The right to lodge a complaint with a supervisory authority

To exercise these rights, contact us at support@nikkscreations.in.

17. Child Safety

Our Services are not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal information to us, please contact support@nikkscreations.in and we will take prompt steps to delete the information.

Parents and guardians who allow minors to use Galaxy devices are responsible for supervising the use of our Services.

18. Data Retention

We retain personal data only as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer required, we delete or anonymize it using secure procedures.

19. Security

We implement administrative, technical, and physical safeguards designed to protect your information. These include encryption in transit (TLS), secure authentication via Firebase, access controls, and regular security reviews. However, no system can guarantee absolute security.

20. International Data Transfers

Our infrastructure relies on globally distributed cloud providers. Your data may be processed in countries other than your own, where data protection laws may differ. By using our Services, you consent to such transfers in accordance with applicable law.

21. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or via the registered email address. The "Last updated" date at the top of this policy reflects the most recent revision.

22. Contact Us

For privacy-related questions, requests, or concerns, contact us at:

• Email: support@nikkscreations.in
• Website: nikkscreations.in
• Studio: NIKKS CREATIONS

We respond to legitimate inquiries within a reasonable timeframe and will work with you to resolve any concerns.