How we collect, use, and protect your data at drxFampay
When you register for drxFampay, we collect your chosen username, password (hashed), Gmail address, Google App Password (encrypted), UPI ID, and API key. We also automatically collect your IP address, browser user agent, login timestamps, and API usage data for security and analytics purposes. We do NOT collect or store any payment card details, bank account numbers, or UPI PINs.
Our service accesses your Gmail inbox solely to scan for payment notification emails sent from no-reply@famapp.in. We specifically filter for emails that begin with "You received" to identify legitimate incoming payment notifications. We do NOT:
Your Google App Password is encrypted using industry-standard encryption before being stored in our database. You can revoke our access at any time by generating a new App Password in your Google Account or deleting your drxFampay account.
We use the collected information exclusively for: authenticating API requests, generating UPI QR codes linked to your UPI ID, scanning your Gmail for FamPay payment confirmations to verify transactions, preventing duplicate payment claims (UTR/Transaction ID deduplication), maintaining security (IP logging, ban enforcement, abuse detection), and providing customer support. We do not sell, rent, or share your personal data with any third parties for marketing or commercial purposes.
We implement industry-standard security measures to protect your data including: SSL/TLS encryption for all API and website communications, bcrypt-hashed passwords, encrypted storage of sensitive credentials (App Passwords), rate limiting to prevent brute-force attacks, IP-based login attempt monitoring with automatic lockout, and session management with secure cookies. While we take reasonable precautions, no internet transmission is 100% secure and we cannot guarantee absolute security.
We retain your account data for as long as your account is active. Transaction records (order IDs, UTRs, Transaction IDs) are retained indefinitely for fraud prevention and duplicate detection purposes. Login logs are retained for 90 days. If you delete your account, your personal information (email, App Password, UPI ID) will be permanently removed within 30 days, but anonymized transaction data may be retained for analytical and security purposes.
We use essential session cookies to maintain your login state. These cookies are HttpOnly, secure, and expire when you log out or after 2 hours of inactivity. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
Our service interacts with third-party services including: Google (Gmail IMAP for email scanning), FamPay (payment notification emails), and QRServer API (QR code generation). We are not responsible for the privacy practices of these third parties. Please review their respective privacy policies for more information.
You have the right to: access the personal data we hold about you, request correction of inaccurate data, request deletion of your account and associated data, export your transaction history, and withdraw consent for Gmail access at any time. To exercise these rights, contact us at the email or Telegram provided below.
Our service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a minor has provided us with personal data, we will take steps to delete such information immediately.
We may update this Privacy Policy from time to time. We will notify users of significant changes through our website or updates channel. Your continued use of the service after policy changes constitutes acceptance of the updated policy.
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
Developer: @stalker
Email: stalker@drxnet.site
Updates: drx Network