Privacy Policy

Last updated: April 12, 2026 • Version 1.0

DhanRakh ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and Google Play Store requirements.

1. Data We Collect

Data Type	What	Why
Account info	Google account email, display name, profile photo	Authentication & account identification
Financial transactions	Amount, category, date, payment method, notes, merchant	Core expense tracking functionality
UPI notifications	Payment notification text from GPay, PhonePe, Paytm, bank apps	Auto-import of digital transactions (with your permission)
Voice recordings	Audio processed on-device via speech-to-text	Voice expense entry. Audio is NEVER uploaded to our servers.
Device info	Device model, OS version, app version	Crash reporting (anonymized) and support troubleshooting
Financial documents	Receipts (photos), will documents, scanned notebooks	Receipt attachment, will builder, OCR scan features

2. How We Use Your Data

• Expense tracking, budgeting, and financial reporting
• AI-generated financial health narratives (Pro plan — processed by Cloudflare Workers, never stored)
• Tax estimation and CA export generation
• Will generation (Estate plan)
• Push notifications for bill reminders, budget alerts, and nudges
• Anonymized, aggregated analytics to improve the product (no individual tracking)

3. Data Storage & Security

• Server: Supabase (PostgreSQL), hosted in Singapore region. Data encrypted at rest (AES-256) and in transit (TLS 1.3).
• Local device: SQLite database encrypted via SQLCipher. Accessible only within the app sandbox.
• Row-Level Security (RLS): Every database table has RLS policies — you can only access your own data, verified by your authentication token.
• PIN & Biometric: Local app lock via 4-digit PIN + optional fingerprint/face unlock. PIN verified server-side without storing plaintext.
• Cloud backups: Optional encrypted backup to your own Google Drive (Pro plan). We cannot access your Google Drive.

4. Data Sharing

We never sell your data. We share data only with these service providers, strictly for functionality:

Service	Purpose	Data Shared
Cloudflare Workers	AI financial narrative generation	Aggregated financial summary (no PII) — processed, not stored
Razorpay	Subscription payments	Payment details as per Razorpay's PCI-DSS compliance
Cloudflare Analytics	Website analytics	Anonymous page views — no cookies, no tracking

5. Your Rights (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access: Export all your data anytime via Settings → Export Data (CSV/PDF).
• Right to Correction: Edit any transaction, budget, or personal information directly in the app.
• Right to Erasure: Delete your entire account via Settings → Delete Account. All data is cascade-deleted within 48 hours. This is irreversible.
• Right to Data Portability: Full CSV and PDF export of all financial data.
• Right to Nominate: Designate a trusted contact via the death trigger feature (Estate plan).

6. Data Retention

• Active account: Data retained indefinitely while your account is active.
• Deleted account: All personal data cascade-deleted within 48 hours of account deletion.
• Audit logs: Retained for 90 days for security purposes, then permanently deleted.
• Backups: Server backups may contain deleted data for up to 7 days (Supabase point-in-time recovery), after which it is purged.

7. Consent

We collect explicit, informed consent at signup (DPDPA Section 6). The consent version is tracked in our database. You can withdraw consent at any time by deleting your account. Consent is required for:

• Financial data collection and processing
• Notification access for auto-import (separate opt-in)
• Camera access for receipts/OCR (granted per-use by Android)

8. Children

DhanRakh is not intended for users under 18 years of age. We do not knowingly collect data from minors. If we discover a user is under 18, we will delete their account and data.

9. Cookies

The DhanRakh website (dhanrakh.in) uses Cloudflare Web Analytics, which is privacy-respecting and does not use cookies. No advertising cookies, no tracking cookies, no third-party cookies.

10. Breach Notification

In the event of a data breach affecting your personal data, we will notify you within 72 hours per DPDPA 2023 requirements, via push notification and email.

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be communicated via an in-app notification and updated on this page. The "Last updated" date at the top reflects the latest revision.

12. Contact

For privacy concerns, data requests, or questions:

• Email: support@dhanrakh.in
• Response time: Within 48 business hours

Data Protection Officer: support@dhanrakh.in

13. Languages

This privacy policy is available in English (legally binding). A Hindi translation is available in the app for convenience — in case of conflict, the English version prevails.