Privacy Policy
Last updated 29 August 2026
The short version
Your financial data is stored locally by default — expenses, income, accounts, goals, loans, notes, and reminders — in an encrypted database on your own device. You can use all of Dova as a Guest, with no account of any kind. If you choose to sign in with Google, that only identifies you; it never uploads your financial data anywhere by itself. If you separately choose to turn on Cloud Backup, Dova encrypts your data on your device, before it ever leaves it, and stores that encrypted copy in your own private Google Drive storage — Dova has no server of its own, and nobody at Dova, including us, can read that backup: it is encrypted with a password only you hold. If you subscribe to Dova Plus, Google Play handles the entire payment — Dova never sees your card, UPI, or bank details.
What Dova stores, and where
All transactions, categories, budgets, goals, notes, reminders, and settings you create are stored locally in an encrypted database on your device (using industry-standard SQLCipher encryption). This data is never transmitted to us or to any third party. It stays on your device unless you explicitly export or back it up yourself, using the Export/Backup tools in Settings, or turn on the separate, optional Cloud Backup feature described below.
Secure Notes
A Note you mark Secure is encrypted twice: once as part of Dova's whole database (like everything else), and a second time on top of that with its own separate key that never leaves your device. Reading it back requires unlocking with your fingerprint, face, or device passcode. Secure Notes are excluded from Cloud Backup by default — you can choose to include a specific one, but even then only its encrypted form is uploaded, and the key that could actually read it is never included. This means a Secure Note restored on a new device will show its title but not a readable secret — Dova tells you this before you opt a note in.
Business Module
If you use the Business module to track customers and suppliers, those records — including any phone number you add — are stored locally the same way as the rest of your ledger. This data is not currently included in Cloud Backup, so it stays on this device even if you have Cloud Backup turned on for everything else.
Dova Plus (optional)
Dova Plus is an optional paid subscription. All payment is handled directly by Google Play — Dova never receives or stores your card, UPI, or bank details; that information never reaches Dova at all. Dova only ever learns whether you currently have an active subscription by asking Google Play, each time it needs to know — that status is never stored on any server, because Dova doesn't have one.
Google Sign-In (optional)
Dova lets you optionally sign in with Google — this is never required, and Guest mode works fully offline with no account of any kind. Choosing Guest or Google is purely a display/identity choice made once on first launch, or later from Settings > Account; switching between them never deletes, uploads, or moves your financial data. Signing in with Google shares only your Google account ID, email address, name, and profile photo with Dova, stored locally on your device and used solely to identify you if you sign in again and to personalize the greeting Dova shows you. Signing in by itself does not upload, back up, or transmit your financial data anywhere — Cloud Backup (below) is a separate feature you must turn on explicitly. Dova never sees, receives, or stores your Google password; authentication happens entirely through Google's own sign-in system.
Cloud Backup (optional, requires Google Sign-In)
If you turn on Cloud Backup in Settings > Account, Dova encrypts a copy of your financial data on your device — using AES-256 authenticated encryption with a key derived from a recovery password only you know, via a memory-hard key-derivation function (Argon2id) — before it ever leaves your device. Only that already-encrypted file is uploaded, to a private storage area of your own Google Drive that's hidden from Google Drive's normal file listing and accessible only to Dova. Dova cannot read your backup, because Dova never has your recovery password — only you do, and Dova never stores it. If you forget it, that backup can't be recovered; Dova will tell you this clearly before you turn Cloud Backup on. You choose how often it backs up (Never, Manual only, Daily, or Weekly — Never is the default), and you can turn it off or permanently delete the cloud backup at any time from Settings > Account, independently of your local data. Dova requests the single, narrowest Google Drive permission needed for this (access to its own private app storage only, never your other Drive files), and never uses Cloud Backup, or any data in it, for analytics, advertising, or any purpose other than letting you restore your own data on another device. Dova does not sell your financial data, in Cloud Backup or anywhere else.
Biometric App Lock
If you enable "Unlock with Biometrics," Dova asks your device's own operating system to verify your fingerprint or face. Dova never receives, sees, or stores your biometric data — that verification happens entirely inside your device's own secure hardware, the same way it does for unlocking your phone itself.
Voice Add
If you use the microphone to add a transaction by speaking, your device's speech recognition service converts your voice to text. On most devices this happens entirely on-device; if your device can't do this on-device, Android may send the audio to Google's speech recognition service to be transcribed, the same as when you use voice typing anywhere else on your phone. Dova itself never stores or transmits the audio — it only ever receives the resulting text, which is processed the same as if you had typed or pasted it.
Receipt Scanner
A scanned receipt photo is processed entirely on your device, using Google's on-device text recognition. The photo is never uploaded anywhere.
Notifications
Reminders (daily logging nudges, budget alerts, due-date reminders, and similar) are scheduled directly on your device using Android's own notification system. They are not sent through any push-notification server, and no record of them is kept anywhere but your device.
What we don't do
Dova has no analytics, no crash reporting, no advertising, and no third-party trackers of any kind. We don't know how you use the app, what you've entered, or that you even have it installed. We have nothing to sell, because we have nothing to collect.
Deleting your data
Deleting your data is entirely in your control. Settings > Delete All Data permanently erases every transaction, account, budget, goal, loan, "You Get"/"You Pay" record, workspace, business record, note (including Secure Notes), and reminder on this device, while keeping the app installed; uninstalling the app removes it entirely. Either way, this cannot be undone, so Settings also offers tools to export or back up your data first if you might want it later. If you have Cloud Backup on, deleting your local data does not delete your cloud backup — you may still want it for moving to a new device — Settings > Account has a separate "Delete Cloud Backup" action if you want that gone too. Signing out of Google (Settings > Account) is separate again and much smaller in scope — it only ends the Google connection and turns off automatic Cloud Backup on this device; it never deletes your financial data or your existing cloud backup.
Changes to this policy
If Dova's data practices ever change, this page will be updated and the "last updated" date above will change with it.
Contact
Questions about this policy or how Dova handles your data can be sent to afzalmansuri163@gmail.com.