Privacy policy
Last updated 7 October 2026
This policy covers Paisa: the Android app, the web dashboard at dashboard.trackpaisa.app, and the Paisa MCP server. Paisa is run by Nimit Haria in India. Contact: privacy@trackpaisa.app.
What we collect
- Account: your name and email from Google sign-in. We store both encrypted.
- Your household’s money records: transactions, accounts (bank name and last 4 digits, never full card or account numbers), categories, budgets, goals, debts, net worth, investments and notes that you or your household members add. This is what Paisa is for; we keep it so your phone, the web dashboard and your partner see the same data.
- People you add: names of household members and people you track, and the email of anyone you invite.
- Notification token: if you turn on notifications, a push token for your phone, so we can send alerts. Signing out removes it.
- Zerodha holdings: only if you connect Zerodha on the web. We read holdings; we can’t place orders or move money.
What we don’t collect
- Bank statement files. The app reads PDF and CSV statements on your phone and sends only the transactions you confirm. A statement password is used once and not stored.
- Location, contacts, SMS, photos or files from your phone.
- Advertising IDs. Paisa has no ads.
- Usage analytics or crash reports from the app today. If we add them, this page will say so first, they will never include amounts, merchant names, notes, names or emails, and you can turn usage data off in Settings.
Private mode
With Private mode on (set up with a PIN on the web dashboard), descriptions, reference numbers and notes are encrypted in your browser before they’re saved. We can’t read them. Amounts, dates, categories and merchant names stay readable so totals, budgets and alerts work.
On your phone
The app’s database and cache are encrypted with keys kept in your phone’s secure storage. Android backup is off for the app. You can require your fingerprint or screen lock to open it.
Who processes your data for us
We don’t sell or share your data. These services run parts of Paisa for us and only use data to do that:
| Service | What for | What it sees |
|---|---|---|
| Cloudflare | Hosting the app’s server and website | All requests, encrypted in transit |
| Neon | Database | Your stored data |
| Sign-in; delivering notifications (Firebase Cloud Messaging) | Your Google account; a notification that says “You have a new alert” | |
| Expo | Delivering notifications and app updates | Your push token and the same notification text |
| Resend | Sending the “your account is ready” email | Your email address |
| Zerodha | Holdings, if you connect it | Your Zerodha login happens on Zerodha’s site |
Notifications never contain amounts or names.
If you use the Paisa MCP server with Claude, the server runs on your own computer and Claude sees what you ask it to read. That is between you and Anthropic; Paisa does not send your data to any AI service.
How long we keep it
As long as your account exists. When you delete your account we delete your data within 30 days, including backups. See Delete your account.
Your rights
You can see and export your transactions as CSV from the web dashboard (Transactions → Export), correct your data in the app, and delete your account. Under India’s Digital Personal Data Protection Act you can also ask us what we hold about you, withdraw consent, and nominate someone to act for you. Write to privacy@trackpaisa.app; we reply within 30 days.
Grievance officer: Nimit Haria, privacy@trackpaisa.app.
Children
Paisa is for adults (18+). We don’t knowingly collect data from children.
Changes
If we change what we collect, we update this page and the date at the top before the change ships, and say so in the app’s release notes.