Privacy Policy

1. Who we are and how to contact us

HissabOne is currently operated on an individual basis and is not, as of the date above, registered as a separate company or other legal entity. This section will be updated with a registered business name and address if and when HissabOne is incorporated.

For any question about this policy, or to exercise a privacy right described below, contact us at support@hissabone.com or call +91 70302 42527. This mailbox and number are monitored by the person operating HissabOne.

2. Information we collect

We collect information in three ways: what you give us directly, what is created automatically as you use the Service, and what a third-party sign-in provider shares with us if you use it.

3. Why we collect and use this information

We use personal information for the following purposes:

• To create and secure your account, sign you in, and let you reset a forgotten password.
• To provide the Service itself: storing and showing you the financial records, documents, reports and calculations you create.
• To operate shared features you choose to use: showing a group's members their shared expenses, or mirroring a lending/borrowing ledger to a contact who accepts your connection request.
• To process subscription payments through Razorpay, apply the plan you purchased, and send you payment-related notices.
• To send account, security, and service emails and SMS (verification codes, password resets, payment confirmations, reminders you set up) through our email and SMS providers.
• To respond to support requests, including requests to export or delete your data.
• To enforce our Terms and Conditions, and to detect and prevent fraud, abuse or unauthorised access.

4. Required versus optional information

Full name, email and password are required to create any account. Mobile number, date of birth and full postal address are also required by our current registration form; without them, registration cannot be completed. Address line 2, city and the profile picture are optional — leaving them blank does not prevent registration or affect how the Service works for you.

Within a workspace, the financial records, documents and contacts you enter are entirely your choice — the Service works with only the records you actually create.

5. Who your information is shared with

We do not sell personal information, and we do not use it for third-party advertising. Information is shared only in the following circumstances.

6. The help assistant and automated processing

HissabOne's in-app help assistant is a locally built, rule-based feature. It answers using a fixed set of help content plus your own already-stored data (for example, your recent transactions or upcoming payments), read through the same API the rest of the app uses. As of this policy's effective date, the assistant does not call any third-party AI or language-model provider, and no personal information is sent to an external AI service for this feature.

HissabOne does not use personal information for automated decision-making that produces legal or similarly significant effects on you (for example, automatically approving or denying you a loan or service) without human involvement.

7. Cookies, analytics and browser storage

HissabOne does not set cookies, and does not use any analytics, advertising or tracking scripts (no Google Analytics, advertising pixels, or similar tools) as of this policy's effective date.

Signing in stores your session token in your browser's sessionStorage, not a cookie — it is cleared automatically when you close your browser. We also use your browser's localStorage for a small number of non-sensitive preferences: your chosen display language, which workspace you last had open, a few interface show/hide toggles, and which in-app notices you have dismissed. None of this is financial data, and none of it is sent to us automatically — it stays on your device.

8. How long we keep information

We keep your account and workspace information for as long as your account is active, so the Service continues to work as expected.

Account deletion is currently handled through a support request (see section 10). Once a deletion is scheduled, there is a 14-day window (configurable by us) in which it can still be cancelled; after that, associated workspace data — accounts, transactions, contacts, categories, goals, budgets and documents you own — is deleted, and your account record is removed. Some references inside other people's records that only involve your identifier are cleared or detached rather than deleted outright, so their own records stay intact.

Exported data download links expire 7 days after they are created.

Some information — particularly billing and payment records — may be kept for longer than the rest of your account where we are required to for tax, accounting or legal recordkeeping purposes, even after an account is otherwise deleted.

Routine backups of our database and file storage may retain copies of deleted information for a limited operational period after deletion, until those backups themselves are cycled out in the normal course of our providers' backup schedules.

9. Security

Passwords are stored as salted bcrypt hashes, never in plain text. Session tokens are signed and expire; they are never stored in a cookie. Uploaded documents are stored in a private Cloudflare R2 bucket with no public access. Sign-in is protected by a JSON Web Token issued only after a successful login, and sensitive account actions require re-authentication.

No method of storing or transmitting information is completely secure, and we cannot guarantee absolute security. We do not make, and this policy should not be read as, a guarantee against every possible security incident.

10. Where your information is processed

HissabOne's hosting providers are Render (application backend), Vercel (application frontend), MongoDB Atlas (database) and Cloudflare (file storage). These are all established international cloud providers; the specific data-centre region each is configured to use is an operational setting in each provider's dashboard rather than something fixed in our application code, and is not separately published here as of this policy's effective date. If you are located outside the country where a given provider processes data, your information may be processed in a different country than the one you are in.

We have not independently verified, and do not claim, that any particular cross-border transfer safeguard (such as Standard Contractual Clauses, an adequacy decision, or a specific transfer framework) is in place with a given provider beyond that provider's own standard terms. If this matters to you — for example because you are in the EEA, UK or another jurisdiction with transfer restrictions — please contact us before relying on the Service, and see section 13 for the regional assessment we have done so far.

11. Your rights and how to exercise them

Subject to the law that applies to you (see section 13 for jurisdiction-specific detail), you generally have the right to know what personal information we hold about you, to correct it, to ask us to delete it, and to ask questions about how it is used.

You can update most of your own profile information directly from Settings inside the app. To request a copy of your data, or to request deletion of your account, contact support@hissabone.com or raise a support ticket in-app under the "Data export" or "Account deletion" category — these are the mechanisms currently implemented for these requests; both are reviewed and actioned by us, rather than fully automatic and instant.

To protect your account, we will ask you to confirm your identity (for example, by verifying you can access the email or mobile number on the account) before acting on a request — we do not ask for government ID or other unnecessary identity documents to do this.

12. Children's privacy

HissabOne is a financial record-keeping application and is not directed at children. Our registration form asks for a date of birth but, as of this policy's effective date, does not technically block a date of birth that would indicate the person is a minor — this is a known gap we are tracking, not a claim that no minor could register.

Some features (for example, a savings goal you label "Education" or "Child's college fund") may let you record information that relates to a child as part of your own financial planning; this does not create a separate account or profile for that child, and we do not knowingly collect personal information directly from a child.

If you believe a child has provided us with personal information directly, contact support@hissabone.com and we will investigate and remove it as appropriate.

13. Changes to this policy

If we make a material change to how we collect or use personal information, we will update the "Last updated" date above and, where practical, post a notice in the app or email registered users ahead of the change taking effect. Continuing to use the Service after a change takes effect means you accept the updated policy; if you do not agree, you should stop using the Service and may request account deletion as described in section 11.

14. Regional privacy law supplement

This section explains, region by region, whether and how a particular privacy law currently applies to HissabOne. It is based on our actual operations (an individually operated service, primarily used in India, with some international sign-ups possible) and on our understanding of each law at the time of writing — it is not legal advice, and we recommend qualified legal review before treating any of it as a compliance guarantee.