Security

How the guarantee is built, for people who want the detail

Most apps ask you to trust a privacy policy. A policy is a statement of intent — it can be revised, and you have no way to audit whether it is being honoured.

Lekhya's approach is to remove the need to trust us. If the app has no way to reach the internet, then what we intend stops mattering.

Four independent layers

Any one of these would prevent your data leaving. All four are in place, and each is checked before a release is built.

#	Layer	What it does
1	No `INTERNET` permission	The released Android app does not declare it. Android then refuses, at the operating system level, to let the app open any network connection — regardless of what its code tries to do. Check it yourself: Settings → Apps → Lekhya → Permissions.
2	Runtime network block	The first thing the app does at startup — before any screen is drawn — is install a handler that makes every attempt to create a network client throw an error instead. This covers iOS too, where there is no equivalent permission to withhold.
3	No network code	There are no HTTP calls anywhere in the app, and no networking library is a dependency. There is no code to accidentally re-enable.
4	Automated tests	A test asserts that attempting a network connection fails. A release check scans the source for network permissions, hard-coded URLs and networking imports. If any appear, the release is blocked.

The one exception, stated plainly

Buying Lekhya Pro obviously requires a network. That happens in Google Play's or Apple's app, in their process, using their permissions — not ours. Lekhya asks the store a question through an on-device channel and receives yes or no. It never sees your card, your billing address or your identity, and it still cannot open a connection of its own.

Encryption

What	How
Backup files (`.lkh`)	AES-256-GCM. The key is derived from your passphrase with PBKDF2 at 310,000 iterations and a random 16-byte salt. The passphrase is never stored anywhere.
Bank message text at rest	AES-256-GCM, with a random key held in the Android Keystore or iOS Keychain — hardware-backed storage no other app can read.
Card numbers	Never stored in full. Any run of five or more digits is masked before saving, so at most the last four survive. No CVV or PIN is ever stored, or asked for.
OS cloud backup	The database is explicitly excluded from Android's automatic backup and from device-to-device transfer, so your finances cannot leak during a phone migration.
App Lock	Fingerprint, face or device PIN, handled entirely by the OS. Lekhya never stores a PIN of its own. The app also hides its contents in the task switcher.

The consequence of real encryption: if you lose your backup passphrase, the backup is unrecoverable. Not "difficult to recover" — unrecoverable, by us and by anyone. An app that could recover it for you would be an app that could read it without you.

What is not in the app

No analytics — no Firebase, Mixpanel, Amplitude or anything similar
No crash reporting that transmits. Crash details are written to a small local file, capped in size, that never leaves the device
No advertising SDK. Google's advertising initialiser, which arrives as a side effect of the billing library, is explicitly stripped from the app
No remote configuration or feature flags — the app cannot be changed from outside
No downloaded fonts or icons. They are bundled, so even rendering a screen contacts nobody
No copyleft dependencies — every third-party library is under a permissive licence, and an automated check blocks any that is not

Verify it yourself

Check the permissions. Settings → Apps → Lekhya → Permissions on Android. No internet permission is listed.
Inspect the published file. aapt2 dump permissions app-release.apk lists everything the app can do. android.permission.INTERNET is not there.
Cut it off. Turn on aeroplane mode and use the app normally. Nothing changes, because nothing was being sent.
Watch the traffic. Point a network monitor at the device. Lekhya generates none.

Reporting a security issue

If you believe you have found a vulnerability — especially anything that would let data leave the device — please tell us before telling anyone else, and we will fix it and credit you if you would like.

vinosmig@gmail.com

Lekhya · Made in India · Home · Privacy · Terms · Support · Data safety