Privacy Policy

Kharchly collects only what you provide directly or through the features you use:

• Account information — name, email address, phone number (optional), city (optional), and monthly income figure.
• Financial records — income and expense entries (amount, category, note, date, merchant name, UPI reference number), recurring bills, and investment holdings.
• Reminder preferences — whether push notifications are enabled and the lead-days setting for bill reminders.
• Usage events — anonymous action names (for example "entry added") used to improve the product. These events never include amounts, notes, merchant names, or any personally identifying detail.

We do not collect location data, contacts, SMS messages, call logs, or any sensor data beyond camera access for receipt scanning (see section 4).

All records are stored in a Supabase database (PostgreSQL, hosted on AWS infrastructure). Every table uses row-level security so that only your authenticated session can read or write your rows. No other user, and no ad-hoc query, can access your data. Our team cannot browse your entries.

A small amount of state — reminder delivery history and an offline analytics buffer — is kept in your device's local storage and never transmitted to any server except our own Supabase instance.

You can create an account with an email address and password, or sign in with Google.

• Email / password — passwords are hashed and managed by Supabase Auth. We never store your password in readable form.
• Google Sign-In — when you choose Google, we receive your name and email address from Google's OAuth service. We store these in your Kharchly profile. We do not receive or store your Google password, Google contacts, or any other Google data.

Sessions are signed tokens stored on your device. Deleting your account permanently removes every entry, bill, holding, and profile tied to it, including from Supabase Auth.

When you scan a receipt, the app opens your device camera (or lets you pick a photo from your gallery). The image is compressed on-device and sent over an encrypted connection to our server, which forwards it to the Lovable AI gateway (powered by Google Gemini) solely to extract the amount, date, merchant name, and UPI reference number.

• Receipt images are not stored by Kharchly or the AI service after processing.
• Only the extracted text fields are saved to your account.
• Camera permission is requested only when you initiate a receipt scan. You can use the app fully without granting camera access by typing entries manually.

If you enable bill reminders, the app requests permission to send local push notifications on your device (via the Android notification system). Notifications are scheduled locally on your device — no notification content is sent to our servers. You can disable them at any time from your device settings or the Reminders screen.

We share data with the following services only to operate the product:

• Supabase (supabase.com) — database, authentication, and storage. Your financial records and account data reside here.
• Lovable AI gateway / Google Gemini — receives receipt images transiently for OCR. Images are not retained after the extraction response is returned.
• Google OAuth — used only if you choose "Sign in with Google". Governed by Google's own privacy policy.

We do not share your data with banks, brokers, advertisers, data brokers, or any other third party.

All data is transmitted over HTTPS (TLS). Supabase enforces row-level security at the database layer. Passwords are never stored in readable form. Sessions use signed tokens. We do not transmit financial amounts or personal details to any analytics or advertising service.

You can edit your profile, change your password, or delete your account at any time from the Settings screen. Deleting your account immediately and permanently removes all your data — profile, transactions, bills, holdings, reminders, and usage events — from our systems with no recovery option.

If you want a copy of your data or have any other request relating to your privacy rights, write to us from the email address registered to your account.

Kharchly is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

If we make material changes we will update the date at the top of this page and, where appropriate, notify you by email or in-app message. Continued use of Kharchly after a change constitutes acceptance of the revised policy.

For any privacy question or data request, write to us from the email address you signed up with. We aim to respond within 7 business days.