Software that runs on your phone, and nowhere else.

Welcome to InvoiceOnGo by Waveclues ("we," "our," or "us"). We are committed to protecting your privacy and ensuring your business data remains safe. This policy outlines how the mobile application collects, uses and safeguards information when you use our GST billing and invoicing service.

1. Information the app holds

• Business information: business name, GSTIN, address, logo, contact number and email address, used to generate your invoices.
• Transactional and client data: client names, phone numbers, addresses, product and service details, prices, and the invoice records you create in the app.
• Device information: the app version, device model and Android version are pre-filled in a support email only when you choose to write to us. The app itself reports nothing.
• Signing certificate (optional): if you import a .pfx/.p12 certificate it is stored encrypted on the device and excluded from backups. It is used only to sign the PDFs you choose to sign, on the device.

2. How that information is used

Solely to deliver the billing service: generating GST invoices and reports, letting you back up your own data to a location you choose, and improving the app's stability. Without an account nothing is sent to us, and we cannot see your invoices. If you choose the optional sign in with Google to sync (a Pro feature), a copy of your records is also kept on our server; the second section below describes that.

3. Storage and security

Your business and customer data is stored on your device, in the app's own storage. Backups are written to the destination you pick - your Google Drive, OneDrive, Dropbox or local storage - and go directly there. We do not sell, rent or monetise your financial or client data, and we do not receive a copy of it.

A backup file is not encrypted. Anyone with the ZIP can read the business records, settings, images and signed PDFs inside it, so keep it in private storage and share it only with people you trust. Your AI API key, signing certificate and app-lock PIN are never included in a backup.

What leaves the device only when you send it: sharing or emailing an invoice hands the PDF to the app you choose (WhatsApp, Gmail, Drive) and that app's privacy policy applies from there; exporting to Excel writes a file where you tell it to. If you use "Detect from GPS" to fill in your state, the location is used once, on the device, and is neither stored nor transmitted.

4. Third-party services

Google Play handles purchases. If you choose to configure the optional AI tax assistant with your own API key, the item description text for that one suggestion is sent to the provider and address you saved that key for, and nowhere else; it is off by default. The app has no analytics, no advertising and no crash reporting.

Sign in with Google on the web app. The sign-in page of the InvoiceOnGo web app (invoiceongo.in) shows a Google sign-in button. To show it, your browser loads a script from Google, so Google learns that your browser opened that page (with your IP address and browser details, as with any website Google serves). Nothing is loaded from Google on any other page of the web app. If you choose to sign in with Google, Google gives us your email address and name — nothing else — and we use them only to find or link your InvoiceOnGo account. We use Google for nothing else: no analytics and no advertising.

5. Contact

Questions about this policy: support@invoiceongo.in.

This section applies to the InvoiceOnGo web app at invoiceongo.in and to the optional account and sync feature in the Android app. If you use the Android app without signing in, the policy above applies and none of this does: your data stays on your phone. Our Terms of Use also apply.

1. What we store

When you use the web app, or sign in to sync, we store on our server:

• Your account: your email address and name (from Google sign-in).
• Your business records: business profile, customers, items and their stock (opening stock, manual adjustments and the movements from invoices), invoices, quotations, credit notes and the payments recorded against them, and your settings. If you use sync, the Android app sends these to the server and the server sends back changes made on other devices or on the web.
• Which devices you use: a short name and a letter for each phone or browser that syncs (the letter appears inside invoice numbers, for example INV-2026-27-P001), and when each last synced.
• Sync bookkeeping: a change counter, a record that something was deleted (so the deletion reaches your other devices), and any open conflict between two versions of the same record until you choose one.
• Signed PDFs and your logo and signature images: when you sign an invoice with a digital-signature certificate on your phone while signed in, the signed PDF is stored on our server so your other devices and the web app can download it; the logo and signature images you set up are stored the same way. Unsigned PDFs are not stored: each device makes them again. Limits: 5 MB per file and 500 MB per account.
• Pro status: a record that your Pro purchase was verified with Google Play (the purchase token and the result), so we can tell whether sync is allowed.
• Security records: sign-in attempts with the time and IP address (to stop password guessing), and the session token that keeps you signed in.

Your signing certificate and AI key (only if you choose): you can save an encrypted copy of your signing certificate's key and certificate chain, and of your AI key, to your account. They are encrypted on your phone with a passphrase only you know (at least 12 characters) before they leave it; we store only the scrambled data and cannot read it. If someone copied it from our server, the passphrase is what protects it. We cannot recover a lost passphrase: you would import your certificate again and choose a new one. You can remove the copy at any time (Settings, Digital signature), and it is deleted with your account. The web app asks for the passphrase to sign in your browser, keeps the unlocked key in memory for about five minutes after the last signature, and never sends the passphrase to us.

Never sent to us: your app lock and your PIN.

2. Google sign-in

When you sign in with Google we receive your email address and name, and nothing else from your Google account. We never see your Google password. We use them only to create and recognise your account. On the web app, the sign-in page loads a script from Google to show the Google button, so Google learns that your browser opened that page; nothing is loaded from Google on any other page.

3. Where it is kept

On servers of our hosting provider, Hostinger. Data is sent over HTTPS. We and our hosting provider keep backups to recover from failures; deleted data can remain in backups for a limited time.

4. Who can see it

• You. Your records are visible only to your account.
• The administrator of the service cannot open your documents from the admin console. They can open one only if you share it with "Allow admin to review this" (seven days, you can take it back). In an emergency they can open one without that, which is a separate, recorded action.
• Technically, whoever runs the server and the hosting provider can reach the database. We do not look at your data except as above, and we do not sell, rent or share it.

5. What we do not do

The InvoiceOnGo web app and the Android app contain no analytics, no advertising and no crash reporting, and we do not sell your data. The browser keeps your sign-in session and an offline copy of your records in its own storage on your device; you can clear it by signing out or clearing site data.

5b. The waveclues.com website

Visiting our website needs no account. If you agree in the banner, we use Google Analytics to count visits and which pages are read: it sets cookies and sends usage data (pages viewed, approximate location, browser and device type, and your IP address) to Google. If you decline, do nothing, or your browser sends the "Do Not Track" or "Global Privacy Control" signal, nothing is loaded and nothing is collected. You can change your choice any time from "Analytics choices" in the footer, which also removes the cookies. We do not use it for advertising.

6. How long we keep it, and deleting it

Your records are kept while your account is active. Deleting a customer, item or draft on one device deletes it on your others; a small record of the deletion is kept so that it reaches them. If you and another device change or delete the same record while apart, the app shows you both versions and asks which to keep; the one you do not choose is discarded. Issued invoices are never deleted by sync.

If your Pro purchase is refunded or charged back, sync pauses and you can still view and download your data for a grace period, currently 30 days; after that we delete the server copy. Your phone keeps its own copy and your account stays. You can delete your data earlier, or your whole account, from Settings in the web app ("Delete my data" / "Delete my account") or from Settings → Sync in the Android app (data only), or by emailing support@invoiceongo.in.

7. Your choices and rights

You can ask us to correct or delete your data, and to give you a copy, and you can raise any question or complaint about your data, by writing to support@invoiceongo.in.

8. Changes

If we change this policy we will update the date above and, for material changes, tell signed-in users.

AppLock by Waveclues locks the apps you choose behind a PIN or fingerprint. It has no account, no server and no analytics, and nothing it holds ever leaves your phone.

1. Information the app holds

• The apps you chose to lock, stored on the device.
• Your PIN and recovery answer - stored only as encrypted key material that cannot be turned back into what you typed. There is no PIN, and no hash of one, saved anywhere.
• Failed attempts: the digits typed, the time, and - only if you turn that setting on - a front-camera photograph, kept encrypted in the app's private storage.
• How long attempts are kept is your choice. Failed attempts, photos included, stay until you delete them unless you set "Delete attempts after" (7, 30 or 90 days) in the Failed attempts screen, after which older entries are removed automatically. You can also delete any single entry, or clear the whole log, at any time.

2. Usage access

AppLock uses Android's usage-access permission to read the package name of the app currently in the foreground, so it knows when to ask for your PIN. It does not and cannot read the contents of any app, your messages, your keystrokes or your screen. It does not use an accessibility service. This information is used in the moment and is not recorded or transmitted.

3. Camera

Camera access is optional and is requested only when you switch on the intruder-photo setting - never at startup. Photos are stored encrypted on the device, readable only after a correct unlock, and are deleted when you delete the entry.

4. What leaves the device

Nothing, and the app has no means to send it. AppLock holds no internet permission at all - not restricted, absent from the app entirely - so it cannot make a network connection even if something in it tried to. There is no account, no cloud sync, no analytics, no advertising and no crash reporting. You buy the app on Google Play, and Google handles that purchase under its own policy before the app is ever installed; the app itself takes no part in it.

5. Deleting your data

Settings → Reset AppLock deletes your PIN, recovery question, chosen apps and attempt history. Uninstalling the app removes everything it holds.

6. Contact

support@waveclues.com.

Photo Lock - Secure Vault by Waveclues ("we," "our," or "us") is deeply committed to protecting your privacy and security. This policy outlines our practices regarding the collection, use and handling of your data.

Because Photo Lock is designed from the ground up as a zero-trust, offline-only security application, our data policy is incredibly simple: we do not collect, transmit or share any of your personal data.

1. Data collection and transmission

Photo Lock operates entirely offline. The application does not include the Android INTERNET permission. As a result, it is technically impossible for the application to transmit analytics, crash reports, telemetry, or any of your files or passwords to us or to any third party.

2. Permissions we request, and why

To function properly, Photo Lock requests specific on-device permissions. All data accessed through them stays encrypted on your device.

• Camera (android.permission.CAMERA): used exclusively for the intruder-selfie feature, which captures a photo on the second wrong passcode entry and again after every lockout that follows. It is opt-in: the permission is requested only when you switch the feature on in Settings, never at startup, and no photo is taken while the setting is off. Photos are encrypted and stored inside the app's own private storage, readable only inside an unlocked vault, and are never transmitted off the device.
• Biometrics (android.permission.USE_BIOMETRIC): lets you unlock your vault with your device's fingerprint or face scanner. Authentication is handled entirely by the Android OS; the app receives only a cryptographic success or failure signal and has no access to your raw biometric data.

3. Data encryption and storage

Every file you import into Photo Lock is encrypted with AES-256-GCM.

• Your passcode: processed with the Argon2id key-derivation function to encrypt your vault key. The passcode itself is never stored on the device or anywhere else - not even as a hash - which is also why a forgotten passcode cannot be recovered.
• Your files: encrypted files live in the app-private directory, where other apps cannot reach them. Their names and metadata - size, date added and file type - are encrypted too, under the same vault key, as are folder names; the app's database holds no plaintext copy of them.
• Backups: Android's own automatic cloud backup is switched off for this app, so your vault is never copied to a Google account. Any backup is one you make yourself, encrypted, to a destination you choose.

4. Files you take out yourself

Exporting a file, or using "Open with" or Share, writes an unencrypted copy outside the vault, at your instruction and after a warning. Photo Lock cannot protect that copy once it leaves; your vault copy stays encrypted.

5. Deleting your data

Settings → Erase vault schedules a permanent wipe of everything - files, metadata, the failed-attempt log with its photos, and the keys themselves - 24 hours out. Any successful unlock, or the explicit "Cancel erase", calls it off; the same option is offered on the lock screen if you have forgotten your passcode. Failed-attempt entries can also be set to auto-delete after a retention period you choose. Uninstalling the app removes everything it holds - so export or back up anything you want to keep first.

6. Third-party services

Photo Lock does not integrate with any third-party advertising network, analytics tracker or cloud backup service.

7. Changes to this policy

We may update this policy from time to time. Since the app does not connect to the internet, we cannot notify you inside it dynamically. Any change will be reflected in the policy linked from our Google Play listing and in the app's update notes.

8. Contact

Questions or concerns about this policy: support@waveclues.com.

FunKeyboard by Waveclues is an Android keyboard you design yourself. It has no account, no server and no analytics, and it cannot send what you type anywhere. This policy describes version 0.2.0, which is in testing on Google Play.

1. What you type

Like every Android keyboard, FunKeyboard sees what you type, because that is how text reaches the app you are typing in. It does not keep your messages or a log of your typing. To correct spelling, suggest words, delete an emoji whole and know when a capital is due, it reads the word you are typing and the text just before the cursor, in the moment.

If Learn my words is on, which it is by default, the app remembers single words and pairs of neighbouring words, with a count of how often you use them, so that its suggestions improve. That list stays on your phone. It is not a record of your messages, though a word you type often, such as a name, can be in it. Turn it off, or tap Forget learned words, in Settings.

Password fields get none of this: no suggestions, no autocorrect, no swipe typing and no learning. Nothing is learned from web address, email or number fields, or from any field that asks keyboards not to learn from it.

2. Information the app holds

• Your keyboard design, your settings and your chosen stylish text style, stored on the device.
• Learned words and word pairs, as described above, up to a few thousand entries.
• Clipboard history, if it is on, which it is by default: the text you copy while FunKeyboard is your keyboard. Items are removed after one hour unless you pin them. Copies that an app marks as sensitive, and anything copied while you are in a password field, are not kept. Turn it off, or clear it, in Settings.
• Recent emoji and the skin tones you chose.
• Stickers you send: a temporary image in the app's cache.
• Trial and purchase status: when your free day started and whether the keyboard is unlocked.
• Your background photo, if you choose one: a scaled-down copy in the app's private storage. You pick it through Android's own photo picker, so the app sees only that picture and needs no access to your gallery.

3. What leaves the device

FunKeyboard sends nothing to us or to anyone else. It holds no internet permission at all - not restricted, absent from the app entirely - so it cannot make a network connection. There is no account, no cloud sync, no analytics, no advertising and no crash reporting. Android's automatic cloud backup is switched off for this app, so what it holds is not copied to a Google account.

Text and stickers go only to the app you are typing in, when you enter or send them. That app's own policy then applies. On Android 11 and later, a password manager you use can show its choices above the keys; those come from that password manager, and FunKeyboard does not store them.

4. Trial and purchase

FunKeyboard is free to install, with one free day from when you first use it. After that it stops typing until you make a one-time purchase, ₹199 in India, or switch to another keyboard. The purchase runs through the Google Play app on your phone and is handled by Google under its own policy. FunKeyboard asks the Google Play app whether you have bought it, and never sees your payment details. This does not add an internet permission to FunKeyboard.

5. Deleting your data

Settings can forget your learned words and clear your clipboard history. Pinned clipboard items stay until you remove them yourself. Choosing a ready-made theme or a gradient removes your background photo from the app's storage. Uninstalling the app removes everything it holds.

6. Contact

support@waveclues.com.

Lighting Keyboard by Waveclues is an Android keyboard with LED-lit keys, neon themes, text art and wallpapers. It has no account, no server, no analytics and no ads, and it cannot send what you type anywhere. This policy describes version 1.0.0, which is in testing on Google Play.

1. What you type

Like every Android keyboard, Lighting Keyboard sees what you type, because that is how text reaches the app you are typing in. It does not keep your messages or a log of your typing. To correct spelling, suggest words, delete an emoji whole and know when a capital is due, it reads the word you are typing and the text just before the cursor, in the moment.

If Learn my words is on, which it is by default, the app remembers single words and pairs of neighbouring words, with a count of how often you use them, so that its suggestions improve. That list stays on your phone. It is not a record of your messages, though a word you type often, such as a name, can be in it. Turn it off, or tap Forget learned words, in Settings.

Password fields get none of this: no suggestions, no autocorrect, no swipe typing, no stylish text and no learning. Nothing is learned from web address, email or number fields, or from any field that asks keyboards not to learn from it.

2. Information the app holds

• Your current theme, your saved designs and your favourites, your settings and your chosen stylish text style, stored on the device.
• Learned words and word pairs, as described above, up to a few thousand entries.
• Clipboard history, if it is on, which it is by default: the text you copy while Lighting Keyboard is your keyboard. Items are removed after one hour unless you pin them. Copies that an app marks as sensitive, and anything copied while you are in a password field, are not kept. Turn it off, or clear it, in Settings.
• Recent emoji and the skin tones you chose.
• Stickers you send: a temporary image in the app's cache.
• Trial and purchase status: when your free day started and whether the keyboard is unlocked.
• Background photos, if you choose them: a scaled-down copy of each in the app's private storage. You pick a photo through Android's own photo picker, so the app sees only that picture and needs no access to your gallery.

3. What leaves the device

Lighting Keyboard sends nothing to us or to anyone else. It holds no internet permission at all - not restricted, absent from the app entirely - so it cannot make a network connection. There is no account, no cloud sync, no analytics, no advertising and no crash reporting. Every theme, background and wallpaper is drawn by the app on your phone; nothing is downloaded. Android's automatic cloud backup is switched off for this app, so what it holds is not copied to a Google account.

Text, text faces and stickers go only to the app you are typing in, when you enter or send them. That app's own policy then applies. Text you copy from the Text Art tab goes to your phone's clipboard. On Android 11 and later, a password manager you use can show its choices above the keys; those come from that password manager, and Lighting Keyboard does not store them.

4. Permissions

Besides being a keyboard, the app asks Android for two things: vibration, for key presses, and setting the wallpaper, used only when you tap a button on the Wallpapers tab. It does not ask for your contacts, storage, microphone, camera or location.

5. Trial and purchase

Lighting Keyboard is free to install, with one free day from when you first use it. After that it stops typing until you make a one-time purchase, ₹199 in India, or switch to another keyboard. The purchase runs through the Google Play app on your phone and is handled by Google under its own policy. Lighting Keyboard asks the Google Play app whether you have bought it, and never sees your payment details. This does not add an internet permission to Lighting Keyboard.

6. Children

The app is not made for children under 13 and does not knowingly hold information about them. It holds nothing beyond what is listed above, for anyone.

7. Deleting your data

Settings can forget your learned words and clear your clipboard history. Pinned clipboard items stay until you remove them yourself. Deleting a saved design removes its photo once no design uses it. Uninstalling the app removes everything it holds.

8. Changes to this policy

If this policy changes, the new version will be posted here with a new date, and described in the app's update notes on Google Play.

9. Contact

support@waveclues.com.