What leaves your device
Varuno’s privacy screen inside the app lists what does leave your device rather than only what doesn’t. This page mirrors it. The app talks to exactly two services:
1. The account service (Supabase)
Used for signing in, email verification, password reset, your profile row and account deletion. It receives:
- your email address and password (to its authentication system)
- your name, country and base currency (your profile)
- your IP address, inherently, as with any internet connection
2. The exchange-rate service (open.er-api.com)
Used to fetch daily mid-market exchange rates. It receives:
- your base currency code (for example
SGD) - your IP address, inherently
No other connections
No endpoint receives a balance, a transaction, a salary figure, a document image or any scanned text. Payslip and receipt OCR runs entirely on the device using an on-device text recognition library; statement CSV files are read locally. This is verified against the app’s code.
Both connections use TLS (HTTPS).
Also worth knowing
- There is no analytics SDK, no ad network and no crash reporter in the app.
- The app’s internal logging rule is “log the type, never the instance” — error types may be logged, your data is not.
- Backup files you export leave the device only when you move them somewhere — see Exporting your data for why you should treat them carefully.