Privacy Policy

Only what the ledger needs to work:

• Your account: the name you type, your mobile number, and your 4-digit PIN. The PIN is stored only as a bcrypt hash — we cannot read it, and nor can anyone with database access.
• Your ledger: the credits, debits and withdrawals you record. Each one has an amount, a type, a date, whether it is done or pending, whether it was cash or UPI, an optional note, an optional tag you named yourself, and any custom fields (such as a client name or an invoice number) the owner of that ledger asks for.
• Attachments: a photo or PDF (for example a bill) attached to an entry through a custom field. Photos are reduced in size on your device before they are sent. They are stored privately and open only for someone who can already see that ledger, through a link that expires within minutes. Deleting the entry, the group or single user, or your account deletes them too.
• Your groups and the people in them, including the permissions an owner gives each member.
• If you use Bills: your business details (name, GSTIN, PAN, address, bank and UPI details, logo and signature), your item list, and the bills you make — including the name, mobile, GSTIN and addresses of the people you bill. A bill you share can be opened by anyone holding its private link until you switch the link off.
• Your devices: one entry per signed-in device, so you can be signed in on more than one and sign them out individually. Each entry is a random session id and a timestamp.
• Your preferences: display language and display currency.
• A last-seen timestamp, so an administrator can see how many people are active. It is a time, not a location and not an activity log.
• Payment records: what was charged, when, for which plan, and the payment reference. Plans are bought on the website.
• When you accepted these terms, and which edition.

To run the service you asked for, and nothing else. Your mobile number and PIN sign you in. Your entries are the product. Your permissions decide who may do what in a group. Your device list is how sessions are revoked. Payment records are how we know which plan you are on and how we answer a billing question.

We do not profile you, we do not build an advertising audience, and we do not sell or rent anything to anyone.

• No contacts, photos, files, camera, microphone or location data. The app never asks for those permissions.
• No third-party analytics and no session recording. One analytics tool was trialled in September 2026 and removed; nothing of the kind runs today.
• No IP address is stored BY US. Your address is held in our server's memory only, for a few minutes, to limit repeated failed logins and bulk sign-ups. It is written to no database and no log we keep. (Google's advertising system receives it the way any website you visit does — see the advertising section below.)
• Nothing about your ledger — no amount, note, tag, custom field, group or person — is ever used for advertising, shared with an advertiser, or sent to Google's ad system.
• No card number, CVV or bank credential ever reaches us. Those are typed on the payment provider's own page.

The Khatamel website shows advertisements supplied by Google AdSense. So does the version you install to your home screen from a browser.

The Android app from Google Play shows no advertising at all. It loads no advertising code, defines no ad space, and sets no advertising cookie. That is deliberate and it is enforced in the code, not by policy: the advertising script refuses to load when the page is running inside the app.

Where ads do appear, Google and its partners may set cookies and use your IP address, your browser type and the pages you visited to choose which ad to show and to stop the same one repeating. We never give them anything from your ledger. You can control or turn off personalised advertising at google.com/my/adcenter, and your browser can block the cookies outright.

Five companies process data on our behalf, each for one job:

• MongoDB Atlas stores the database, in the Mumbai (India) region. The application servers are in the same region.
• Cloudflare R2 stores the photos and PDFs attached to entries, in a private bucket. Nobody can open a file without a link our server issues to someone allowed to see that ledger, and every link expires within minutes.
• Razorpay processes plan payments made on the website. They receive what a payment needs — amount, your name and mobile number. We receive back only a confirmation, the amount and a reference. Card and bank details are entered on Razorpay's own page and never pass through us. The Android app sells nothing, so it sends Razorpay nothing.
• Google Firebase Cloud Messaging delivers browser notifications on the website, if you allow them. It holds an opaque device token, not your name or number. The Android app does not use notifications at all — Android's WebView has no support for them — so it registers nothing with Firebase.
• Google AdSense serves the advertisements on the website and the installed browser version. It receives what any web request carries — IP address, browser, the page being viewed — and sets its own cookies. It receives nothing from your ledger, and it runs nowhere inside the Android app.

Beyond those, we share your data with nobody. The exception is a lawful order from a court or authority with jurisdiction over us, which we would comply with.

Inside the product, the people you share a group with see that group’s entries. That is the point of a shared ledger. A group you do not belong to is invisible to you.

• PINs and the administrator password are hashed with bcrypt and are never stored in a readable form.
• Your session lives in a cookie that JavaScript cannot read, is marked Secure and SameSite, and carries a per-device id that can be revoked on its own.
• Six failed sign-in attempts lock that number for fifteen minutes. Sign-up is capped at three accounts an hour from one address.
• Traffic runs over HTTPS. Database access is restricted to the people who operate the service.
• ⚠️ API responses are obfuscated, not encrypted. The scrambling in the app makes a response unreadable at a glance; it is not cryptography and we do not present it as a security control. HTTPS is what actually protects data in transit.

Your data stays while your account exists. You can delete your account yourself at any time, from Settings → Delete account, in the app or on the website. It takes effect immediately and cannot be undone.

Deleting removes your account, the groups you own and every entry in them, the single users you created, your own entries, your tags, your custom fields and your bills. Two things are kept, and we say so plainly: entries you made in a group somebody else owns stay in that group’s history, because removing them would silently change that group’s balances for everyone else, and your name on them becomes “Deleted user”; and records of payments you made are kept as a financial record, carrying no name or number once your account is gone.

The full process is on the account deletion page.

Khatamel is a bookkeeping tool for adults and is not directed at children. We do not knowingly create accounts for children, and we collect nothing from them deliberately. If you believe a child has an account, tell us and we will remove it.

If this policy changes materially we update the date at the top of this page. Continuing to use Khatamel after a change means the new version applies to you.

Questions about your data, or a request to see a copy of it: ask us through the Khatamel website. We confirm any request against the mobile number on the account before acting on it.

See also our Terms & Conditions, which cover plans, payment and the rules of the service.