Software that runs on your phone, and nowhere else.

Welcome to InvoiceOnGo by Waveclues ("we," "our," or "us"). We are committed to protecting your privacy and ensuring your business data remains safe. This policy outlines how the mobile application collects, uses and safeguards information when you use our GST billing and invoicing service.

1. Information the app holds

• Business information: business name, GSTIN, address, logo, contact number and email address, used to generate your invoices.
• Transactional and client data: client names, phone numbers, addresses, product and service details, prices, and the invoice records you create in the app.
• Device information: device model and OS version, where needed for support and bug fixing.

2. How that information is used

Solely to deliver the billing service: generating GST invoices and reports, letting you back up your own data to a location you choose, and improving the app's stability.

3. Storage and security

Your business and customer data is stored on your device, in the app's own storage. Backups are written to the destination you pick - your Google Drive, OneDrive, Dropbox or local storage - and go directly there. We do not sell, rent or monetise your financial or client data, and we do not receive a copy of it.

4. Third-party services

Google Play handles purchases. If you choose to configure the optional AI tax assistant with your own API key, the item description text for that one suggestion is sent to the provider and address you saved that key for, and nowhere else. The app has no analytics, no advertising and no crash reporting.

Sign in with Google on the web app. The sign-in page of the InvoiceOnGo web app (invoiceongo.in) shows a Google sign-in button. To show it, your browser loads a script from Google, so Google learns that your browser opened that page (with your IP address and browser details, as with any website Google serves). Nothing is loaded from Google on any other page of the web app. If you choose to sign in with Google, Google gives us your email address and name — nothing else — and we use them only to find or link your InvoiceOnGo account. We use Google for nothing else: no analytics and no advertising.

5. Contact

Questions about this policy: support@waveclues.com.

This section applies to the InvoiceOnGo web app at invoiceongo.in and to the optional account and sync feature in the Android app. If you use the Android app without signing in, the policy above applies and none of this does: your data stays on your phone. Our Terms of Use also apply.

1. What we store

When you use the web app, or sign in to sync, we store on our server:

• Your account: your email address and name (from Google sign-in).
• Your business records: business profile, customers, items and their stock (opening stock, manual adjustments and the movements from invoices), invoices, quotations, credit notes and the payments recorded against them, and your settings. If you use sync, the Android app sends these to the server and the server sends back changes made on other devices or on the web.
• Which devices you use: a short name and a letter for each phone or browser that syncs (the letter appears inside invoice numbers, for example INV-2026-27-P001), and when each last synced.
• Sync bookkeeping: a change counter, a record that something was deleted (so the deletion reaches your other devices), and any open conflict between two versions of the same record until you choose one.
• Signed PDFs and your logo and signature images: when you sign an invoice with a digital-signature certificate on your phone while signed in, the signed PDF is stored on our server so your other devices and the web app can download it; the logo and signature images you set up are stored the same way. Unsigned PDFs are not stored: each device makes them again. Limits: 5 MB per file and 500 MB per account.
• Pro status: a record that your Pro purchase was verified with Google Play (the purchase token and the result), so we can tell whether sync is allowed.
• Security records: sign-in attempts with the time and IP address (to stop password guessing), and the session token that keeps you signed in.

Your signing certificate and AI key (only if you choose): you can save an encrypted copy of your signing certificate's key and certificate chain, and of your AI key, to your account. They are encrypted on your phone with a passphrase only you know (at least 12 characters) before they leave it; we store only the scrambled data and cannot read it. If someone copied it from our server, the passphrase is what protects it. We cannot recover a lost passphrase: you would import your certificate again and choose a new one. You can remove the copy at any time (Settings, Digital signature), and it is deleted with your account. The web app asks for the passphrase to sign in your browser, keeps the unlocked key in memory for about five minutes after the last signature, and never sends the passphrase to us.

Never sent to us: your app lock and your PIN.

2. Google sign-in

When you sign in with Google we receive your email address and name, and nothing else from your Google account. We never see your Google password. We use them only to create and recognise your account. On the web app, the sign-in page loads a script from Google to show the Google button, so Google learns that your browser opened that page; nothing is loaded from Google on any other page.

3. Where it is kept

On servers of our hosting provider, Hostinger. Data is sent over HTTPS. We and our hosting provider keep backups to recover from failures; deleted data can remain in backups for a limited time.

4. Who can see it

• You. Your records are visible only to your account.
• The administrator of the service cannot open your documents from the admin console. They can open one only if you share it with "Allow admin to review this" (seven days, you can take it back). In an emergency they can open one without that, which is a separate, recorded action.
• Technically, whoever runs the server and the hosting provider can reach the database. We do not look at your data except as above, and we do not sell, rent or share it.

5. What we do not do

The InvoiceOnGo web app and the Android app contain no analytics, no advertising and no crash reporting, and we do not sell your data. The browser keeps your sign-in session and an offline copy of your records in its own storage on your device; you can clear it by signing out or clearing site data.

5b. The waveclues.com website

Visiting our website needs no account. If you agree in the banner, we use Google Analytics to count visits and which pages are read: it sets cookies and sends usage data (pages viewed, approximate location, browser and device type, and your IP address) to Google. If you decline, do nothing, or your browser sends the "Do Not Track" or "Global Privacy Control" signal, nothing is loaded and nothing is collected. You can change your choice any time from "Analytics choices" in the footer, which also removes the cookies. We do not use it for advertising.

6. How long we keep it, and deleting it

Your records are kept while your account is active. Deleting a customer, item or draft on one device deletes it on your others; a small record of the deletion is kept so that it reaches them. If you and another device change or delete the same record while apart, the app shows you both versions and asks which to keep; the one you do not choose is discarded. Issued invoices are never deleted by sync.

If your Pro purchase is refunded or charged back, sync pauses and you can still view and download your data for a grace period, currently 30 days; after that we delete the server copy. Your phone keeps its own copy and your account stays. You can delete your data earlier, or your whole account, from Settings in the web app ("Delete my data" / "Delete my account") or from Settings → Sync in the Android app (data only), or by emailing support@waveclues.com.

7. Your choices and rights

You can ask us to correct or delete your data, and to give you a copy, and you can raise any question or complaint about your data, by writing to support@waveclues.com.

8. Changes

If we change this policy we will update the date above and, for material changes, tell signed-in users.

AppLock by Waveclues locks the apps you choose behind a PIN or fingerprint. It has no account, no server and no analytics, and nothing it holds ever leaves your phone.

1. Information the app holds

• The apps you chose to lock, stored on the device.
• Your PIN and recovery answer - stored only as encrypted key material that cannot be turned back into what you typed. There is no PIN, and no hash of one, saved anywhere.
• Failed attempts: the digits typed, the time, and - only if you turn that setting on - a front-camera photograph, kept encrypted in the app's private storage.

2. Usage access

AppLock uses Android's usage-access permission to read the package name of the app currently in the foreground, so it knows when to ask for your PIN. It does not and cannot read the contents of any app, your messages, your keystrokes or your screen. It does not use an accessibility service. This information is used in the moment and is not recorded or transmitted.

3. Camera

Camera access is optional and is requested only when you switch on the intruder-photo setting - never at startup. Photos are stored encrypted on the device, readable only after a correct unlock, and are deleted when you delete the entry.

4. What leaves the device

Nothing, and the app has no means to send it. AppLock holds no internet permission at all - not restricted, absent from the app entirely - so it cannot make a network connection even if something in it tried to. There is no account, no cloud sync, no analytics, no advertising and no crash reporting. You buy the app on Google Play, and Google handles that purchase under its own policy before the app is ever installed; the app itself takes no part in it.

5. Deleting your data

Settings → Reset AppLock deletes your PIN, recovery question, chosen apps and attempt history. Uninstalling the app removes everything it holds.

6. Contact

support@waveclues.com.

File Vault Pro by Waveclues ("we," "our," or "us") is deeply committed to protecting your privacy and security. This policy outlines our practices regarding the collection, use and handling of your data.

Because File Vault Pro is designed from the ground up as a zero-trust, offline-only security application, our data policy is incredibly simple: we do not collect, transmit or share any of your personal data.

1. Data collection and transmission

File Vault Pro operates entirely offline. The application does not include the Android INTERNET permission. As a result, it is technically impossible for the application to transmit analytics, crash reports, telemetry, or any of your files or passwords to us or to any third party.

2. Permissions we request, and why

To function properly, File Vault Pro requests specific on-device permissions. All data accessed through them stays encrypted on your device.

• Camera (android.permission.CAMERA): used exclusively for the intruder-selfie feature, which captures a photo on the second wrong passcode entry. It is opt-in: the permission is requested only when you switch the feature on in Settings, never at startup, and no photo is taken while the setting is off. Photos are encrypted and stored inside the app's own private storage, readable only inside an unlocked vault, and are never transmitted off the device.
• Biometrics (android.permission.USE_BIOMETRIC / android.permission.USE_FINGERPRINT): lets you unlock your vault with your device's fingerprint or face scanner. Authentication is handled entirely by the Android OS; the app receives only a cryptographic success or failure signal and has no access to your raw biometric data.

3. Data encryption and storage

Every file you import into File Vault Pro is encrypted with AES-256-GCM.

• Your passcode: processed with the Argon2id key-derivation function to encrypt your vault key. The passcode itself is never stored on the device or anywhere else - not even as a hash - which is also why a forgotten passcode cannot be recovered.
• Your files: encrypted files live in the app-private directory, where other apps cannot reach them. Their names and metadata - size, date added and file type - are encrypted too, under the same vault key, as are folder names; the app's database holds no plaintext copy of them.
• Backups: Android's own automatic cloud backup is switched off for this app, so your vault is never copied to a Google account. Any backup is one you make yourself, encrypted, to a destination you choose.

4. Files you take out yourself

Exporting a file, or using "Open with" or Share, writes an unencrypted copy outside the vault, at your instruction and after a warning. File Vault Pro cannot protect that copy once it leaves; your vault copy stays encrypted.

5. Deleting your data

Settings → Erase vault schedules a permanent wipe of everything - files, metadata, the failed-attempt log with its photos, and the keys themselves - 24 hours out. Any successful unlock, or the explicit "Cancel erase", calls it off; the same option is offered on the lock screen if you have forgotten your passcode. Failed-attempt entries can also be set to auto-delete after a retention period you choose. Uninstalling the app removes everything it holds - so export or back up anything you want to keep first.

6. Third-party services

File Vault Pro does not integrate with any third-party advertising network, analytics tracker or cloud backup service.

7. Changes to this policy

We may update this policy from time to time. Since the app does not connect to the internet, we cannot notify you inside it dynamically. Any change will be reflected in the policy linked from our Google Play listing and in the app's update notes.

8. Contact

Questions or concerns about this policy: support@waveclues.com, the support address listed on our Google Play page.