Privacy Policy

This Privacy Policy explains how KHAATA: Legal business or individual name ("we", "us") handles information in connection with Khaata — Simple Business Tracker (the "app"), a mobile app for Android and iOS published under the application identifier com.sandeshpandey.khaata.

Khaata is built offline-first. The business records you create — products, sales, bills, customers, expenses — are stored in a database on your own device and are not uploaded to us. Some parts of the app do involve other parties, and this policy is careful to keep the three cases separate:

• Data on your device. Stored locally, under your control, never sent to us. See section 3.
• Data we receive. Only if you choose to create an account: your sign-in details, the profile fields you fill in, your Pro status and any Pro request you send us. See section 2.
• Data third parties collect. Mainly the advertising SDK in the free version, which operates under its own privacy policy. See sections 4, 5 and 13.

By using Khaata you agree to this policy. If you do not agree with it, please stop using the app and uninstall it.

We do not collect your business records. There is no cloud sync and no server-side copy of your products, sales, bills or expenses.

The only information that reaches our systems is the information tied to an optional account. Creating an account is not required to use Khaata for tracking your business — you can use the app fully signed out.

If you create an account

You can sign in using Email and password, Google, Facebook. When you do, the following is stored on servers operated on our behalf by our hosting provider (see section 13):

• Your sign-in credentials or the identifier from the provider you signed in with
• Your profile: first name, last name, email address, phone number, date of birth and sex, as far as you choose to provide them
• Your Pro status, plan and expiry date
• Any Pro request you send us from this website: the plan you asked for, the phone number and note you supply, and whether we approved it

Profile fields such as your date of birth, phone number and sex come from what you type into the app, or from the basic profile the sign-in provider returns (for example your name and email address). You can leave optional fields blank. If you sign in with Google or Facebook, we receive only the basic profile information that provider shares with us for sign-in — we never receive your password for that provider.

What we do not collect

• No analytics. The app contains no analytics SDK, so we do not track your screens, taps or usage patterns.
• No crash reporting SDK. The app does not send crash or diagnostic reports to us.
• No contacts, and no precise location. The app does not read your contacts and does not request location permission.
• No payment details. The app has no in-app purchase or payment flow, so we never see card or bank information.

Almost everything Khaata holds about your business lives in a database file on your device (khaata.db) in the app's private storage, together with any images you attach. This includes:

• Your business profile and app settings (business name, logo, preferences)
• Products, product variants such as sizes, and stock levels
• Sales, bills and invoices you generate
• Customers and suppliers you choose to save
• Purchases, expenses and tax entries you record
• Profit and loss figures calculated from the records above
• Product and logo images you attach
• Your app lock PIN, stored only as a salted hash in the device keystore

This data is not transmitted to us, and we have no way to read it, view it, recover it or restore it for you. It stays on the device until you delete it, clear the app's storage, or uninstall the app.

If you enable the app lock, your PIN is stored only as a salted hash in the device keystore, never as the PIN itself. If you use fingerprint or face unlock, that check is performed by your device's operating system — we never receive your biometric data.

When you print or share a bill, invoice or report, your device generates the document locally and hands it to whichever app or printer you pick through the system share sheet. Where it goes from there is governed by the app or service you chose.

Khaata itself does not automatically collect usage information about you. We do not run analytics, and the app does not send us device or diagnostic data in the background.

Two things do happen automatically, and both are worth being clear about:

• The advertising SDK. In the free version, the advertising SDK named in section 5 runs inside the app and requests ads over the internet. To do that, it processes technical information such as your device's advertising identifier and IP address, under its provider's own privacy policy. We describe this in section 5 rather than restating that provider's practices here, because only they can state them accurately.
• Ordinary network requests. If you are signed in, your device contacts our hosting provider to check your session and Pro status. Like any internet request, that involves your IP address and standard connection metadata being visible to the provider.

Separately, the app store you installed from (Google Play or the Apple App Store) collects its own installation and diagnostic data under its own policies. We may see aggregate, non-identifying statistics in those consoles, such as total installs or crash counts by device model.

Who serves the ads

Advertising in Khaata is currently delivered through:

The advertising SDK may collect and process technical information in order to select, deliver, measure and prevent fraud in advertising — for example device and advertising identifiers, your IP address and an approximate location derived from it, device characteristics, and which ads were requested, shown or interacted with. The authoritative description of what is collected and how it is used is the provider's own policy, linked above, because those practices are set by the provider and can change without any change to this app.

Personalised versus non-personalised ads

Khaata requests non-personalised ads by default. Non-personalised ads are chosen from general context rather than from a profile of your interests.

• On iOS, the app uses Apple's App Tracking Transparency prompt. If you do not allow tracking, the app continues to request non-personalised ads. If you allow it, ads may be personalised. You can change your choice at any time in iOS Settings under Privacy & Security, Tracking.
• On Android, the app declares the advertising ID permission so the SDK can request ads. You can reset or delete your advertising ID, and opt out of ad personalisation, in your Android settings under Privacy, Ads.

Removing ads

Ads are shown only to users of the free version. Pro removes them. Pro is requested on this website and granted by us with a Pro grant issued from our website; it requires an account, because Pro is attached to one specific account and the app has to be able to check it.

What we receive from advertising

We see only aggregate reporting in the ad provider's dashboard, such as total impressions and estimated revenue. We do not receive reports that identify you, and we do not combine advertising data with your account or with anything stored in the app.

Advertising technology we may add later

We may change or add advertising providers in future versions of the app. Providers we may introduce are listed below. Nothing here is in the app today, and we will update this policy before any of it is used in a published version.

• AppLovin MAX (AppLovin Corporation) — Ad mediation, if it is added in a future version to serve or mediate advertisements. Their privacy policy.

Because we receive so little, the list of things we do with it is short. We use account information to:

• Create your account and let you sign in and stay signed in.
• Show your name and details in the app, and let you correct them.
• Verify your email address where sign-in requires confirmation, and help you recover access to your account.
• Record and check your Pro status, and handle any Pro request you send us from this website.
• Reply to you when you contact us for support, or to handle a privacy or deletion request.
• Keep the service secure — for example detecting abuse of the Pro request process — and comply with legal obligations that apply to us.

For users in regions with a lawful-basis requirement such as the EU and UK GDPR, we rely on: performance of a contract (running your account and your Pro entitlement); your consent (where the app asks for it, such as the iOS tracking prompt); and our legitimate interests (security, preventing fraudulent or duplicate Pro requests, and funding the free version through advertising).

We do not sell your personal information, and we do not use your business records for any purpose — we never receive them.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising of our own. Information is shared only in these situations:

• Service providers. The hosting provider that runs the account system processes account data on our behalf, under its own security and privacy commitments. See section 13.
• Advertising. The advertising SDK in the free version communicates directly with its provider, as described in section 5. We are not the recipient of that data.
• Sign-in providers. If you sign in with Google or Facebook, the sign-in exchange happens with that provider, which will know that you signed in to Khaata.
• Legal reasons. If we are required by valid legal process to disclose information, or need to do so to protect someone's safety or our legal rights, we may do so.
• Business transfer. If the app changes ownership, account information may transfer with it. This policy, or a policy at least as protective, would continue to apply.

Anything you share yourself — a bill you send to a customer, a backup file you save to cloud storage — is shared by you, to a destination you chose, and is then handled under that service's terms.

• On-device data is kept for as long as you keep it. You control it: delete records inside the app, clear the app's storage, or uninstall the app. We cannot retain it, because we never have it.
• Account and profile data is kept while your account exists. If you ask us to delete your account, we delete it as described in section 9.
• Pro status is kept while your account exists so your entitlement can be honoured on a new device.
• Pro requests you send us from this website are kept while your account exists, so we have a record of what was asked for and what we granted. They are deleted with your account.
• Support emails are kept for as long as needed to handle your request and to keep a record of what was asked and done.

You can delete your data at any time, and there are two separate kinds of deletion because there are two separate places data lives.

Data on your device

Delete individual records inside the app, or remove everything by clearing the app's storage or uninstalling it. This is immediate and permanent. There is no server copy, so once local data is gone it cannot be recovered unless you made a backup file first.

Your account and profile

To have your account, profile, Pro record and any Pro requests you submitted deleted from our hosting provider, email pandeysandesh98@gmail.com from the address you signed up with. We act on verified requests within 30 days.

Full step-by-step instructions, including exactly what is deleted, are on the Data Deletion page.

We take reasonable measures appropriate to a small app:

• Your business data does not travel over the internet at all in normal use, which removes an entire category of risk.
• Sign-in tokens and your app-lock PIN hash are stored in the device's secure keystore rather than ordinary app storage.
• All communication with our hosting provider uses encrypted HTTPS connections.
• Account records are protected by row-level access rules so that a signed-in user can read and change only their own row. Pro status can only be set by us on the server: neither the app nor any signed-in user is able to grant it.
• The app can require a PIN, or your device's fingerprint or face unlock, before Khaata opens.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. Your device is the most important part of this: keep your operating system updated, use a device lock, and be careful where you store backup files, since a backup contains your business records in readable form.

The app can create a backup file containing your data, which you then save or send wherever you choose — your own storage, a computer, or a cloud drive. That file leaves the app only because you chose to share it, and once it does, it is covered by whatever service you sent it to, not by this policy.

Restoring a backup replaces the data currently on the device. Treat backup files as sensitive: they contain your business records in readable form.

Because the app works offline, most features keep working with no internet connection at all. Advertising and signing in are the parts that need a connection.

Khaata asks for a permission only at the moment a feature needs it, and explains why. You can decline, and you can change your mind later in your device settings — the rest of the app keeps working.

Camera

Scanning product barcodes when you add or look up a product.

Photos / photo library

Attaching product photos and your business logo, which stay on your device.

Photos you attach and barcodes you scan are processed on your device and stored locally. They are not uploaded to us.

On iOS you may also see Apple's App Tracking Transparency prompt, which relates to advertising and is covered in section 5.

These are the third parties involved in running Khaata. Each operates under its own privacy policy, which we link rather than summarise, because only they can describe their practices accurately and keep that description current.

Account data is processed by our hosting provider on our instructions, as a processor acting on our behalf. Your business records are never sent to it.

This list is maintained in the app's configuration, so it is updated whenever the services the app uses change. We will update this policy when a change affects how your information is handled.

Khaata is a tool for running a business and is not directed at children. We do not knowingly collect personal information from children under the age of KHAATA: 13.

If you believe a child has created an account with us, please contact pandeysandesh98@gmail.com and we will delete the account and its profile data.

Khaata can be used from anywhere. Your business records stay on your own device wherever you are, so they do not cross borders because of us.

If you create an account, that account data is stored and processed on our hosting provider's infrastructure, which may be outside your own country. Where such a transfer involves personal data protected by the EU or UK GDPR, it is made using the safeguards our provider offers for international transfers, such as the European Commission's standard contractual clauses.

We operate from KHAATA: Nepal. If you use the app from elsewhere, you understand that your account information is processed as described in this policy.

Depending on where you live, you may have some or all of the rights below. We honour these requests for everyone, wherever you are, rather than only where the law compels us.

• Access. Ask what account information we hold about you and get a copy of it.
• Correction. Fix anything inaccurate. Most profile fields you can edit yourself in the app.
• Deletion. Ask us to delete your account and profile. See section 9.
• Portability. Receive your account information in a structured, commonly used format.
• Objection and restriction. Object to, or ask us to restrict, processing based on our legitimate interests.
• Withdraw consent. Where we rely on consent, withdraw it at any time — for example by turning off tracking permission for the app in your device settings.
• Non-discrimination. We will not degrade the app because you exercised a privacy right.
• Complain. If you are in the EU, EEA or UK, you may lodge a complaint with your local data protection authority.

How to make a request

Email pandeysandesh98@gmail.com from the address associated with your account, telling us what you want us to do. We may need to confirm that you control the address before we act, to make sure we are not handing your data to someone else. We respond within 30 days, and free of charge, unless a request is excessive or repetitive.

For data held on your device, you do not need us at all: you can view, edit, export and delete it directly in the app.

We may update this policy as the app changes — for example if we change advertising provider, or add a feature that handles data differently. When we do, we update the "Last updated" date at the top of this page and publish the new version at this same address.

If a change materially affects how your personal information is handled, we will give notice that is reasonable in the circumstances, such as a notice in the app or an email to the address on your account, before it takes effect. Continuing to use Khaata after a change takes effect means you accept the updated policy.

For any question about this policy, or to exercise a privacy right, contact us:

• Publisher: KHAATA: Legal business or individual name
• Privacy email: pandeysandesh98@gmail.com
• Deletion requests: pandeysandesh98@gmail.com (see the Data Deletion page)
• Website: https://khaata-website.vercel.app

Please also read our Terms & Conditions, which govern your use of Khaata.