super.money

Is super.money safe?

For everyday UPI payments, super.money works like any other UPI app: your money stays in your bank until you pay, and each payment needs your UPI PIN. The concerns are elsewhere. The app shares a wide range of personal data for marketing and credit offers, its terms say your account cannot be deleted, and UPI scams hit its users as hard as anyone's. We score it 56/100, above Paytm (53) and below PhonePe (59) and Google Pay.

super.money launched in August 2024 and grew fast on the promise of cashback on every payment. The company says its downloads grew 242% in 2025, that it climbed from 56th on NPCI's list of UPI apps to the top five within two years, and that about 72% of its users are under 30. Google Play lists more than 50 million installs.

Who runs super.money?

The app belongs to Scapic Innovations Private Limited, a Flipkart group company in Bengaluru. It is not a bank. Its terms describe it as a third-party app provider under UPI, working through a tripartite agreement with NPCI and Yes Bank as its sponsor bank. Complaints about a UPI payment can go through the app or to Yes Bank.

Beyond payments, super.money sells credit. It distributes secured credit cards backed by fixed deposits from ₹100, and the company says its credit distribution tripled year on year. It also offers fixed deposits, personal loans through partner lenders and a "split-Store" shopping feature. Each of those products comes from a partner bank or lender under its own terms, and super.money earns from steering you towards them.

What data does super.money share?

More than its Apple label suggests. The App Store label is short: usage data used to track you across other companies' apps, contact details linked to you for analytics, and financial information for app features.

The Google Play data safety form, filled in by the developer, is far broader. It says the app shares with other companies your name, email, address and phone number, approximate and precise location, photos, SMS, files, contacts, payment information, purchase history and credit score. It also lists sexual orientation as shared, for analytics, fraud prevention and account management. The privacy policy does not mention sexual orientation at all, and we could not find a reason a payments app would need it.

The privacy policy, last updated on 25 November 2025, fills in the uses. super.money reads SMS stored on your phone to register you for UPI and read OTPs, but also to judge your "eligibility for products and services". It collects device identifiers, IP address and location, records customer-care calls, and uses your data for "targeted marketing, advertising" and tailored offers. It may share data with Flipkart group companies, lenders, merchants, credit bureaus and third-party advertising companies, and partners may contact you by SMS, messaging apps, calls or email. Data is stored in India. Because the policy and the Play form disclose more than the Apple label, we score privacy on the broader picture.

Can you delete your super.money data?

Only partly. The privacy policy says you can ask for deletion or withdraw consent through the in-app chat under Profile, then Help and Feedback, and that the company aims to close requests within 30 days. The terms of use go the other way: they say Scapic is "not able to delete Your account" because it must keep transaction records, and that you can only deactivate it. The policy keeps data for as long as the law requires or eight years, whichever is longer, plus longer for fraud checks or in anonymised form.

Opting out of marketing messages and personalised ads also means starting a chat, not flipping a setting. India's Digital Personal Data Protection Rules will require clearer consent and notice from about May 2027.

UPI scams on super.money

super.money users face the same scams as every UPI user. India recorded 12.64 lakh UPI fraud incidents worth ₹981 crore in 2024-25, and ₹805 crore in the first eight months of 2025-26, the Finance Ministry told Parliament. Since 1 October 2025, NPCI no longer lets people send each other "collect" requests, a common trick in which a fake buyer asked victims to enter their PIN to "receive" money. Merchant collect requests still exist, and scammers have moved to QR codes, fake customer-care numbers and screen-sharing apps.

A cashback app adds its own pull. Users who chase rewards may scan more unfamiliar QR codes or open more credit products than they need. The app's App Store rating is 4+ and Google Play's is 3+, although its privacy policy limits use to people who can sign a binding contract, which in India means adults.

How to use super.money safely

1. Never enter your UPI PIN to receive money, and never share it or an OTP.
2. Scan a QR code only to pay, never to get a refund or prize.
3. Get help only through the app's Help and Feedback chat, not numbers found by web search.
4. Read the bank's own terms before taking a secured credit card or loan in the app; a missed card payment hurts your credit score.
5. Deny SMS and contacts permissions after setup if you do not need bill reminders or contact payments.
6. Report fraud at once on 1930 and to your bank.

How we scored it

Regulatory record (86) is super.money's strongest factor: no fine or order since launch, but too short a history for the 90+ band. Privacy (45) ties with transparency and control as the weakest factor, because the developer's own Play form declares broad sharing, including credit score, SMS and sexual orientation, and the policy allows targeted advertising and group-wide sharing. Transparency and control loses points for the conflict between the deletion promise and terms that rule it out.