Privacy Policy

MF Arena reads your mutual fund statements so it can show you what your portfolio holds. We collect only what that needs, keep it in India, never sell it, and delete it when you ask.

Effective 28 October 2026

Who we are

MF Arena ("we") is built and operated by Ajay Vallabhaneni (individual developer of MF Arena), Hyderabad, Telangana, India. For anything about your data, write to privacy@mfarena.com.

What we collect and why

Your email address — to sign you in with a one-time code.
Mutual fund statements (CAS) you receive from CAMS, KFintech, CDSL or NSDL — to build your portfolio. From them we keep your folio numbers, fund names, units, transactions and holdings.
If you connect Gmail: your Gmail address and a Google access grant, used only to find those statement emails and their PDF attachments.
Your PAN, only if you choose to add it — used only to open statements that are protected with your PAN. We show you just its last 4 characters.
A statement password we generate for you, used only to open statements you request through the app.
Which screens you open and how often (screen name, date and a count) — never amounts or anything from your statements — so we know which features are useful.
If you join the Pro waitlist: the plan you picked and which screen you joined from.
If the app crashes or hits an error: a technical error report (the error, app version, phone model and Android version) so we can fix it. Amounts, PAN, folio numbers, statement text and your email are removed before it is sent.

What we do with it

Calculate your portfolio value, returns, gains and X-Ray analytics (holdings, sectors, overlap).
Nothing else. We do not show ads, sell or rent your data, build marketing profiles, or share it with brokers or fund houses.
The app gives information about your own portfolio. It is not investment advice.

Gmail access (Google API Limited Use)

MF Arena's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Access is read-only. We search only for statement emails from CAMS, KFintech, CDSL and NSDL and read only their PDF statements. We do not read, store or analyse any other email.
Gmail data is used only to show your portfolio inside this app. It is not used for advertising, not sold, not transferred to others, and not used to train AI models.
No person at MF Arena reads your email. Automated processing only, except where you ask us for support or the law requires it.
You can disconnect Gmail at any time in the app; we then revoke the access at Google and delete the stored grant.

How long we keep it

Statement PDFs: deleted once processed, and in any case within 30 days.
Your portfolio data, PAN, Gmail grant, screen-open counts and waitlist choice: until you remove them or delete your account.
Error reports: deleted automatically by Sentry after at most 90 days.
Backups: we keep private copies of the database (at most 8 weekly copies, about two months) so data can be recovered after a failure. Deleted data disappears from backups as old copies are removed.

Where it is stored and who processes it

Supabase (database, file storage, servers) in Mumbai, India. PAN, Gmail grants and statement passwords are encrypted in Supabase Vault.
Google — only when you connect Gmail, to read your statement emails.
Sentry (Functional Software, Inc.) — error reports only, stored in the European Union (Germany), with personal and financial details removed before sending.

Security

Every record is locked to your account at the database level, so no other user can read it.
Data is encrypted in transit (HTTPS) and at rest. Sign-in sessions on your phone are kept in its secure storage.
We never ask for your CAMS, KFintech, MFCentral, broker or bank passwords.

Your rights

See your data in the app, and correct it by importing a newer statement.
Download a copy of everything we store about you from Profile → Download my data (a JSON file saved to a folder you choose).
Remove your PAN or disconnect Gmail at any time.
Delete your account and all data from Profile → Privacy & data → Delete my account.
Write to privacy@mfarena.com for any privacy question, correction or complaint. Grievance officer: Ajay Vallabhaneni. We reply within 30 days. You may also complain to the Data Protection Board of India.

Children

The app is meant for adults (18+). We do not knowingly collect data from children.

Changes

If we change how we use your data, we will update this page and tell you in the app before the change applies.