Privacy Policy

1.Introduction

HisaabBook ("the App", "we", "us") is a personal finance and expense tracking application that helps you record transactions, set spending and savings goals, split group expenses, and use financial calculators. This Privacy Policy explains what information we collect, how we use it, where it is stored, and the choices you have.

By creating an account or using the App, you agree to the practices described in this policy. If you do not agree, please use the App's offline mode (which keeps all data on your device) or discontinue use.

2.Information We Collect

2.1 Account information

• Email and password sign-up: your email address, display name, and your password stored only as a one-way bcrypt hash. We never store or can see your plain-text password.
• Google Sign-In: if you sign in with Google, we receive your name, email address, profile photo URL, and a Google/Firebase user identifier used to verify your identity. We request only the basic email and profile scopes — we never access your Gmail, contacts, or other Google data.
• Profile preferences: currency, occupation (optional), monthly budget, and selected expense categories.

2.2 Financial data you enter

• Transactions: amount, description, type (income/expense), category, and date.
• Balance: the account balance you maintain in the App.
• Spending goals: category, limit amount, and period (weekly/monthly).
• Savings goals: goal name, target amount, saved amount, emoji, and target date.
• Groups and splits: group name, invite code, member display names, shared expenses (title, amount, who paid, category, date, notes), each member's share, and settlement records between members.

We never ask for, collect, or store your bank account numbers, card numbers, UPI PINs, net-banking credentials, or any payment credentials. HisaabBook does not move money — it only records what you tell it.

2.3 SMS data (optional, Android only)

If you choose to enable SMS import, the App reads bank transaction alert SMS messages on your device to detect amounts, merchants, and dates, so transactions can be auto-suggested for import. This is entirely optional and requires your explicit permission (READ_SMS).

• All SMS parsing happens locally on your device. Your SMS inbox is never uploaded, and personal (non-bank) messages are never sent to our servers.
• Only for messages you actually choose to import, we store small de-duplication records on our servers so the same SMS is not imported twice: an irreversible SHA-256 fingerprint computed on your device from the opening portion of that bank-alert message (the original message text cannot be reconstructed from this fingerprint), and a transaction key consisting of the amount, merchant name, and date.
• Apart from that fingerprint and the transactions you choose to import, no SMS content ever leaves your device.
• You can deny or revoke the SMS permission at any time in your device settings; the rest of the App works normally without it.

2.4 Microphone / voice entry (optional)

The voice entry feature uses your device's built-in speech recognition service to convert your speech to text (via the operating system's speech engine). The recognized text is then interpreted on your device using local keyword matching to suggest an amount, category, and description. HisaabBook itself does not record, store, or upload your audio. Microphone access (RECORD_AUDIO) is requested only when you use this feature, and your device's speech recognition may be performed by your OS provider (e.g., Google) according to your device settings.

2.5 App lock (PIN / biometric)

If you enable app lock, your PIN is stored only on your device as a salted SHA-256 hash. Biometric unlocking (fingerprint/face) is handled entirely by your device's operating system — we never receive, store, or have access to your biometric data.

2.6 Support messages

If you contact support from within the App, we store your message, subject, category, and email address so we can respond to you.

2.7 What we do NOT collect

• No location data, no contacts, no call logs.
• No advertising identifiers — the App contains no ads and no advertising SDKs.
• No third-party analytics or behavioral tracking SDKs.

3.How We Use Your Information

• To create and authenticate your account (including verifying Google Sign-In tokens and issuing secure session tokens).
• To store and sync your transactions, goals, groups, splits, and settlements across your sessions and devices.
• To prevent the same bank SMS from being imported twice (de-duplication).
• To send you a one-time password-reset code by email when you request it (codes expire in 15 minutes and are stored only as a hash).
• To respond to your support requests.
• To maintain the security and reliability of our service.

We do not sell, rent, or trade your personal data. We do not use your financial data for advertising, profiling for third parties, or credit scoring.

4.Device Permissions

All optional permissions can be declined or revoked at any time in your device settings without losing core functionality.

5.Offline Mode

If you tap "Skip" and use HisaabBook without an account, all of your data (transactions, goals, settings) is stored only in a local database on your device. Nothing is sent to our servers in offline mode. Uninstalling the App permanently deletes this local data. Features that require a server (such as group expense splitting and cross-device sync) are unavailable offline.

6.Where Your Data Is Stored & Third-Party Services

We use a small number of infrastructure providers to operate the service. They process data only on our behalf and under their own security and privacy commitments:

Some of these providers may store or process data on servers located outside India. By using the App, you consent to such transfer and storage, subject to applicable Indian law.

7.Security

• All communication between the App and our servers uses HTTPS encryption.
• Passwords are stored only as bcrypt hashes; password-reset codes are also stored as hashes and expire in 15 minutes.
• API access is protected by signed JWT authentication tokens; every data request is scoped to your own account.
• App-lock PINs are salted and hashed on your device; biometrics never leave your device.

No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard practices.

8.Data Retention & Account Deletion

• Your data is retained for as long as your account exists so the App can function.
• You can delete individual transactions, goals, groups, splits, and other records at any time from within the App; deletions are removed from our database.
• Account deletion (in-app): go to Profile → Delete account inside the App. This immediately and permanently deletes your account and all associated data: profile and preferences, transactions, spending and savings goals, SMS de-duplication fingerprints, group memberships, and support history. Shared group records (group expenses and settlements involving other members) are retained so other members' history remains intact, but they are no longer linked to an active account of yours.
• Account deletion (web): you can also follow the steps at our dedicated page: https://hisaabbook-backend-production.up.railway.app/delete-account.
• Deletion is immediate and irreversible — there is no recovery period and no residual copy kept for reactivation.
• If you can no longer access the App, email us at jkclaude143@gmail.com from your registered email address and we will complete the deletion for you within 30 days and confirm by email.
• Offline-mode data exists only on your device and is deleted when you clear the App's data or uninstall it.
• CSV exports you generate are saved/shared by you on your own device — they are under your control and never uploaded by us.

9.Your Rights

Subject to applicable law (including India's Digital Personal Data Protection Act, 2023), you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data (most data can be edited directly in the App);
• Request deletion of your data (see Section 8);
• Withdraw consent for optional features (SMS, microphone, notifications, biometrics) at any time via device settings;
• Raise a grievance about how your data is handled.

To exercise any of these rights, contact us at jkclaude143@gmail.com. We aim to respond within 30 days.

10.Children's Privacy

HisaabBook is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at jkclaude143@gmail.com and we will delete it promptly.

11.Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page, and where appropriate, notified within the App. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

12.Governing Law & Contact

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. Any disputes are subject to the jurisdiction of the courts of India.

Contact / Grievance:
HisaabBook Support
Email: jkclaude143@gmail.com
Policy URL: https://hisaabbook-backend-production.up.railway.app/privacy
Account deletion: https://hisaabbook-backend-production.up.railway.app/delete-account