Privacy Policy

This policy explains what personal data Niota Fintech Private Limited(“Niota”, “we”, “us”, “our”) collects when you use the Niota Android app or this website, why we collect it, and what you can do about it. “You” means any person who uses the app or visits this site.

We are the data fiduciary for this processing under India's Digital Personal Data Protection Act, 2023.

The short version

• Most of what the app knows about you never leaves your phone. Your watchlist, your in-app activity and your app preferences are stored on the device.
• Your broker credentials are never sent to us. The app talks to your broker directly.
• The only personal record we keep on our servers is that you signed in through a particular broker on a particular day.
• We do not sell your data, and we do not use it to target advertising.
• Browsing this website is anonymous unless you choose to accept analytics.

Data we collect in the app

Account identity

You sign in with Google, through Firebase Authentication (a Google service). We receive a Firebase user id for your account, and your email address only where Google has confirmed that you own it. We do not receive or store your Google password.

Broker sign-in records

Each time you connect a broker, the app sends us three fields: your Firebase user id, the trading day, and which broker you used. Nothing else. We use these records to understand how many people use the app and which broker integrations matter, so we know where to spend engineering time.

Your broker connection

Niota is an integration layer. You log in to your own broker through that broker's own login flow, and the resulting connection details are held on your device so the app can request market data on your behalf. Those credentials are not transmitted to Niota servers and we cannot see your funds, holdings or order book. Your relationship with your broker is governed by your broker's own terms and privacy policy.

Market data requests

When the app fetches the option chain, heatmap, FII and DII data, the instrument list or search results from our servers, those requests do not carry your account identifier. They are not linked to you.

Data stored on your device

Your watchlist, your in-app activity and history, and your display preferences are stored locally on your phone. They are not uploaded to us and they are not backed up by us. Uninstalling the app removes them.

Diagnostics

We use Firebase Crashlytics and Firebase Analytics (both Google services) to find crashes and understand which screens are used. These collect technical information such as device model, operating system version, app version, a reset-able installation identifier, and a stack trace when the app crashes. We use this to fix defects, not to build a profile of you.

Notifications

If you allow notifications, Firebase Cloud Messaging holds a push token for your device so we can deliver a message. Records of individual messages are removed automatically a short time after they are delivered or abandoned.

Permissions we do not ask for

The app requests only internet access, network state and, optionally, permission to show notifications. It does not request your location, contacts, camera, microphone, photos, files or SMS.

Data we collect on this website

This site is static and asks you for nothing. It sets no advertising cookies and includes no third-party trackers by default. If product analytics is enabled, it loads only after you explicitly accept it in the consent banner, and you can decline. Your choice is stored in your browser.

Why we are allowed to process this data

We process your account identity and broker sign-in records because they are necessary to provide the service you asked for, and on the basis of the consent you give when you create an account. Diagnostics and website analytics are processed on the basis of your consent, which you can withdraw.

Who we share it with

We do not sell your personal data and we do not share it with data brokers or advertisers. We use a small number of processors to run the service: Google (Firebase Authentication, Crashlytics, Analytics and Cloud Messaging) and Amazon Web Services, whose Mumbai region hosts our servers. We may disclose data where the law requires it.

Where it is stored

Our servers run in the AWS Asia Pacific (Mumbai) region in India. Firebase services operated by Google may process data outside India in line with Google's own terms.

How long we keep it

Broker sign-in records are kept while your account exists, and are removed when you ask us to delete your account. Notification delivery records are removed automatically within days. Crash and analytics data is retained under Google's Firebase retention settings. Data stored on your device stays there until you delete it or uninstall the app.

Your rights

Under the DPDP Act you can ask us to:

• tell you what personal data of yours we hold and who we have shared it with,
• correct or complete data that is wrong or out of date,
• erase your data and close your account,
• withdraw a consent you previously gave.

To exercise any of these, write to support@niota.in from the email address on your account. See Delete your account for the deletion process. If you are not satisfied with how we handle your request, you may complain to the Data Protection Board of India.

Children

Niota is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Security

We use transport encryption for all traffic between the app and our servers, and we keep the amount of personal data we hold deliberately small, because data we never collect cannot be lost. No system is perfectly secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy. When we make a material change we will update the effective date at the top and, where appropriate, tell you in the app.

Contact

Niota Fintech Private Limited, India. Email support@niota.in.