Security
How Oru keeps your money data safe.
The facts, in plain words. All of it comes from our privacy policy, which has the full detail.
The facts
Oru can't move money
It has no access to your bank account and never asks for an OTP, PIN, password or card number. It only reads what you send it and the bank alerts you choose to forward.
Only what's useful from a bank alert
From each alert Oru keeps the amount, the shop or sender, the date and the bank, plus the email's sender and subject. The email itself is not kept.
Where your data lives
The database (Supabase) and the servers (Vercel) are in Mumbai. Bank alert emails arrive through Cloudflare. Telegram carries the chat, Google delivers notifications, and the contact form on this site is sent through Web3Forms. Data is encrypted in transit and at rest.
The AI that reads your messages and voice notes
Oru's replies come from Anthropic's AI model, and Groq turns voice notes into text. Both are in the United States, so your messages and voice notes are processed outside India. Before a message, bank email or statement goes to Anthropic, Oru removes your name, phone numbers, email addresses, and Aadhaar, PAN, card and account numbers. Photos are sent as they are. Voice notes are turned into text by Groq first, and Anthropic only gets that text, with the same details removed. Only the voice note goes to Groq, and Oru never keeps the audio. Anthropic's commercial terms don't allow it to train on this data.
Who can see it
Only the people who run Oru. To help you, they can see your account details, like your name, plan and how many entries you have. They don't read your chats. They do see feedback you send, and bank messages you choose to share so Oru can learn a new bank, with numbers hidden.
Delete my data, any time
Say “delete my data” in the chat, or tap Delete my data in the dashboard, and your account and everything linked to it is erased. It can't be undone. A record of what happened and when, with no amounts, names or messages, is kept for a year, as the privacy policy explains. Send /disconnect to stop email reading at once.
If something goes wrong
Oru reports security incidents to CERT-In, India's cyber security agency, within 6 hours, as Indian law requires. If a breach affects you, we tell you without delay.
Spotting a fake Oru
On Telegram, the only real Oru is @heyoru_bot. It only talks to you after you start the chat, and it will never ask for an OTP, PIN, password or card number. If an account claiming to be Oru does any of that, it isn't us. As Oru launches on WhatsApp and in its own apps, each official channel will be listed on this page.
Questions or complaints about your data: privacy@heyoru.com, which reaches our Grievance Officer, Deepak Carpenter, BaseNovo Technologies.