Privacy Policy

If you sign in with Google, Pruvaly receives only basic OpenID Connect identity information: a stable subject identifier, your name and basic profile details, and your email address. These are used solely to create and authenticate your Pruvaly account and to show who is signed in.

Pruvaly does not request or receive Google Drive, Gmail, Contacts, Calendar, BigQuery or any other Google API data through this sign-in. No Google identity data is sold, used for advertising or profiling, or shared with anyone other than the service providers needed to run the product, or where required to protect the service or comply with a legal obligation.

• Account and profile: verified email address, preferred name, optional full name, authentication state and plan.
• Documents you add: the original file you scanned, imported or shared, stored unchanged in a private bucket.
• Derived layers: recognised text (OCR) and extracted fields such as merchant, dates, totals and line items, with their provenance and confidence. These are derived from your documents and never replace the original.
• Preferences: appearance, language, opening destination, capture source and reminder settings.
• Deadlines and tasks: follow-ups and reminder schedules generated from your documents or created by you.
• Security and operational records: bounded processing and error records needed to run, secure and debug the service.
• Optional AI metadata: see below.

Document analysis reads a document you add and proposes structured fields. It runs as part of importing a document.

The document-grounded Assistant is a distinct, opt-in feature. When you turn it on and ask a question, the server selects a bounded set of documents you are allowed to read and sends only document-derived context — metadata, recognised text, line items and deadline evidence — plus a few recent turns of the current conversation to the configured Azure OpenAI service. The immutable original file is never sent.

Requests are stateless and sent with store: false. Pruvaly does not persist your questions, the model’s answers, the chat context or provider response identifiers; the visible conversation disappears when the chat screen closes. Only metering and audit metadata are stored: user id, provider, deployment, region, status, token counts and timestamps. Turning AI access off clears the stored consent and prevents further calls.

Pruvaly relies on a small number of processor categories: managed database, authentication and file storage hosting; document analysis and, if you opt in, the Azure OpenAI service; transactional email delivery for account messages; and error and operational monitoring. Providers act on Pruvaly’s instructions for these purposes only.

Your data is used to operate the features you use: storing documents, extracting fields, reminding you of deadlines, summarising your own purchases, and securing your account. It is not used for advertising and is not sold. Documents are private to your account unless you explicitly share a document inside a household, which you can reverse.

Access is denied by default. Every record is protected by server-side row-level access rules tied to your authenticated account, private storage buckets and least-privilege server functions. No security measure is perfect, and we do not make claims about certifications or specific cryptographic guarantees.

Documents and derived layers are kept while your account exists, so you can keep using them. You can delete individual documents, and deletion is never silent. You can request an export of your account data, and you can request account deletion from within the app; deletion removes stored originals before the account itself is removed. We do not commit to a fixed deletion window here, and limited operational or legally required records may persist for a short period after deletion.

Subject to applicable law, you may request access to your data, correction, deletion, a portable copy, restriction of or objection to processing, and withdrawal of consent for optional features such as the Assistant. To exercise any of these, or to ask a privacy question, contact 404@404media.ai.

If this policy changes materially, the effective date above is updated and, where appropriate, you are notified in the app. See also the Terms of Service and About Pruvaly.