User Privacy Agreement

RS PAY is a demonstration application. It is not a licensed payment service, is not connected to any bank, UPI PSP or cryptocurrency provider, and never processes real money.

What we store

• Your phone number — used to sign in.
• A securely hashed password. We never see or store your plaintext password.
• UPI IDs you link (the virtual payment address only, e.g. name@bank).
• Purchase, payout and wallet ledger records created inside the app.

What we never ask for

• Your UPI PIN, OTP, card numbers, CVV or internet-banking password. Any screen asking for these is not RS PAY — do not use it.

How data is used

Records exist only to demonstrate the review workflow. There is no advertising, no analytics integration and no third-party data sharing in this build.

Security

Passwords are bcrypt-hashed, sessions are protected against CSRF, and privileged actions are audit-logged. See docs/SECURITY.md for the full list of protections and open items.

Contact

Questions about this agreement: [email protected].