Privacy Policy — Money Track

1. Who we are

Money Track ("we", "us", "our") is a personal finance application operated by Money Track (sole proprietorship), with registered address at Bengaluru, Karnataka, India.

This policy explains how we handle your personal data under India's Digital Personal Data Protection Act, 2023 (DPDP). Questions go to privacy@themoneytrack.app.

2. What data we collect

We collect only what's necessary to run the service:

Account data: name, email, password (hashed), timezone preference.
Authentication data: session cookie, Google account ID (only if you sign in with Google), email-verified timestamp.
Finance data you enter: wallets, transactions, goals, budgets, khata entries, subscriptions, assets, achievements, notes you write.
Payment metadata: Razorpay order ID, payment status, plan code. We do not store your card or UPI ID — Razorpay does, as a PCI-DSS Level 1 processor.
Operational logs: IP address, browser user-agent, request timestamps (retained for 30 days for security / abuse prevention).

3. What we do NOT collect

We do not use advertising trackers, fingerprinting, or third-party analytics that profile you.
We do not read your emails, contacts, or bank accounts.
We do not share or sell your data to anyone. Ever.

4. Purposes of processing

We use your data only to:

Provide the Money Track app you signed up for.
Authenticate you (passwords, sessions, Google sign-in).
Process payments via Razorpay and issue GST invoices.
Send transactional emails (renewal reminders, plan expiry warnings, password reset).
Prevent abuse, debug crashes, and meet our legal obligations.

5. Where your data lives

Your data is stored in encrypted databases on infrastructure located in India. Daily encrypted backups are kept for 30 days for restore safety, then deleted.

6. Third parties we use

The minimum number of vendors needed to run the service:

Razorpay (Bengaluru, India) — payment processing, GST invoice issuance.
Google (only if you use "Sign in with Google") — verifies your Google account email and ID token. We do not access your Gmail or any other Google service.
Transactional email provider — sending renewal reminders and password resets.
Cloud hosting provider — running the app servers and storing your encrypted database.

7. Your rights (under DPDP)

You have the right to:

Access — export your full database as JSON anytime from Settings → Backup.
Correction — edit your name, email, finance entries directly in the app.
Erasure — request full account + data deletion by emailing privacy@themoneytrack.app. Processed within 30 days.
Grievance redressal — contact our grievance officer at the same email; if unresolved, you may complain to the Data Protection Board of India.

8. Cookies and local storage

Money Track uses a single first-party session cookie (encrypted, HttpOnly, SameSite=Lax) to keep you logged in. We do not use third-party cookies. Local storage is used only for UI preferences (e.g. last selected period filter).

9. Data retention

Account data: retained while your account is active. Deleted within 30 days of account deletion request.
Operational logs: 30 days.
Payment invoices: retained for 7 years as per Indian tax law (mandatory).
Backups: 30 days rolling.

10. Security

Passwords are hashed with bcrypt. Sessions are signed. Payments go to Razorpay directly — no card data touches our servers. HTTPS-only in production. We do regular security reviews before every release.

11. Children

Money Track is not directed at children under 18 and we do not knowingly collect data from them. If you believe a child has registered, email privacy@themoneytrack.app and we will delete the account.

12. Changes to this policy

If we materially change this policy, we'll show a banner in the app and email registered users at least 14 days before the new policy takes effect. The "effective date" at the top of this page always reflects the current version.

13. Contact

Privacy-related: privacy@themoneytrack.app
General: support@themoneytrack.com
Postal: Money Track (sole proprietorship), Bengaluru, Karnataka 560001, India