Privacy Policy — Hisaab

Last updated: 3 October 2026 · Effective: 3 October 2026

This Privacy Policy explains how Hisaab (“the app”, “we”, “us”, “our”) — a privacy-first UPI expense tracker for Android (package com.hisaab.hisaab), published by CyberCodex — collects, uses, stores, shares, and protects your information. It applies to your use of the Hisaab Android app and the cloud services it uses, which run on Google Firebase. By installing or using Hisaab, you agree to this policy.

In short: your financial and transaction data is read and stored on your device. We do not upload your transaction history to our cloud. The only personal data our cloud (Google Firebase) holds is your phone number (for your account) and your subscription status. Optional cloud backup is end-to-end encrypted — the cloud only ever stores ciphertext that neither we nor Google can read.

1. Who we are (Data Fiduciary)

Hisaab is operated by CyberCodex. For the purposes of the Digital Personal Data Protection Act, 2023 (India) and other applicable laws, CyberCodex is the data fiduciary/controller for the limited account data described below. You can reach us at support@cybercodex.co.in (see Section 13).

2. Information we collect

2.1 Information you provide

Phone number — collected when you create an account. It is used to sign you in (via a one-time password) and to link your premium entitlement to your account.

2.2 Financial & transaction data (stays on your device)

Payment and transaction details (amount, merchant/payee, date, category, account/bank identifiers, balances) parsed from your device’s payment notifications and bank SMS are processed and stored only on your device. We do not collect, receive, or have access to this data.
If you choose to enable cloud backup, this data is end-to-end encrypted on your device before upload using a key held on your device. Our cloud database (Google Cloud Firestore) stores only the encrypted blob (ciphertext); neither we nor Google can decrypt or read it.

2.3 Information collected automatically

Advertising identifiers & device/network information — collected by Google AdMob to serve ads to users on the free plan (e.g. advertising ID, coarse device and app information). Premium subscribers do not see ads.
Usage & diagnostics — Firebase Analytics records aggregate, non-identifying app and screen usage; Firebase Crashlytics records crash and error diagnostics to help us improve stability. These may include device model, OS version, app version, and crash traces.
Subscription & billing records — when you purchase premium, Google Play Billing processes the payment, and our subscription provider RevenueCat verifies the purchase and records your entitlement against an anonymous account id. We do not receive your card or bank details.

3. Device permissions and why we use them

Each sensitive permission is optional, requested in context with an in-app explanation, and can be declined or later revoked in Android Settings. The core app remains usable without granting all of them.

Permission	Purpose
Notification access	Detect UPI/payment notifications (e.g. Google Pay, PhonePe, Paytm) to create expense entries on your device.
SMS — read & receive (`READ_SMS`, `RECEIVE_SMS`)	Read bank transaction SMS on your device so payments are captured automatically. SMS content is parsed entirely on-device and is never transmitted off your device to us or any third party. We do not read, collect, or upload OTPs, personal messages, or any non-transaction SMS. See Section 4.
Display over other apps	Show an optional “instant categorize” popup immediately after a payment.
Post notifications	Show capture prompts, reminders, and budget alerts.
Biometric / device credential	Optional app lock to protect your data on the device.
Internet / network	Account sign-in, subscription verification, app settings, ad delivery, and optional encrypted backup.

4. SMS data — specific disclosure

Hisaab requests SMS read/receive access (READ_SMS, RECEIVE_SMS) solely for on-device money management: it reads your bank and UPI transaction SMS on your device to automatically create your own expense entries (amount, date, merchant), because many payments — money sent from Google Pay or CRED, UPI debits and bank transactions — do not post an app notification. This is a core way the app tracks your spending. We process this data locally on your device only. We do not transmit, upload, sell, or share the contents of your SMS, and we do not use SMS for any purpose other than identifying your own financial transactions for money management. SMS access is optional and opt-in — you can use the app with notification-based capture and manual entry instead, and revoking SMS permission stops all SMS reading immediately.

5. How we use information

To create and authenticate your account and keep you signed in.
To determine whether you have an ad-free premium subscription and to apply it across devices.
To serve ads to free users (via AdMob) and to process and verify premium purchases (via Google Play Billing).
To diagnose crashes and understand aggregate, non-identifying usage so we can improve the app.
To store your optional encrypted backup (ciphertext only) so you can restore it.
To prevent abuse and comply with legal obligations.

6. Sharing and third-party services

We do not sell your personal information. We share data only with the service providers needed to operate the features above, each under its own privacy policy:

Google AdMob — serves ads to free users; may collect device/advertising identifiers. See Google’s Privacy Policy and AdMob & privacy.
Google Play Billing — processes premium subscription payments.
RevenueCat — verifies Play purchases and keeps your subscription status. See RevenueCat’s Privacy Policy.
Firebase (Google) — Authentication (Phone), which sends and verifies the login OTP SMS to your phone number; Cloud Firestore, which stores your account record (phone number, subscription status) and your optional encrypted backups in Google’s Mumbai (India) region; Remote Config, which delivers app settings such as ad configuration (no personal data); Analytics; and Crashlytics.

We may also disclose information if required by law, regulation, legal process, or a valid governmental request, or to protect the rights, safety, and security of our users and the service.

7. Data retention

On-device transaction data — kept on your device until you delete it, uninstall the app, or clear app data.
Account data (phone number, role, subscription/entitlement and billing records) — retained while your account is active, and afterwards only as long as needed to meet legal, tax, accounting, or fraud-prevention obligations.
Encrypted backups — retained until you delete them or your account.
Analytics & crash data — retained per Google Firebase’s standard retention settings.

8. Account & data deletion

You are in control of your data:

On-device data: delete individual entries in the app, or remove everything by clearing the app’s data or uninstalling it.
Account & cloud data: in the app, open Settings → Delete account & data. This immediately deletes your account and all its cloud data (phone number, subscription status, and any encrypted backups) and wipes the app’s data on that phone. You can also email support@cybercodex.co.in with your account phone number; we will verify your request and delete the data within 30 days, except where retention is required by law. See also how to delete your account.

Note: deleting your account does not automatically cancel a Google Play subscription — manage or cancel subscriptions in the Google Play Store.

9. Security

Login OTPs are sent and verified by Firebase Authentication; we never store them. Optional cloud backups are end-to-end encrypted with a key derived on your device, so the cloud stores only data it cannot read. All network traffic uses HTTPS/TLS. Access to account records is restricted. No method of transmission or storage is 100% secure, but we take reasonable technical and organizational measures to protect your information.

10. Your rights

Subject to applicable law (including the Digital Personal Data Protection Act, 2023), you may have the right to access, correct, update, or delete your personal data, to withdraw consent, and to raise a grievance. To exercise these rights, contact us using the details in Section 13. We will respond within the timeframes required by law.

11. Children

Hisaab is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, notified in the app. Your continued use of Hisaab after an update constitutes acceptance of the revised policy.

13. Contact & Grievance Officer

For questions, privacy requests, or data-deletion requests, contact:

CyberCodex
Email / Grievance Officer: support@cybercodex.co.in

We will acknowledge and address grievances in accordance with applicable law.