// legal

Privacy Policy

Last updated: September 2026

Hisab ("the app") is a personal finance app that helps you track income and spending by reading bank alert emails and imported statements. This policy explains what data the app handles and how.

The short version: Your financial data is encrypted and stored only on your device. Hisab does not operate a server that stores your transactions, account balances, or email content. The only data that passes through a server we control is a short-lived authentication token needed to keep your Gmail connection working — never the email content itself. Hisab does not sell or share your data with third parties for advertising purposes.

What Hisab accesses, and why

Bank alert emails (Gmail, Outlook, or IMAP): read-only access, used solely to detect transaction alerts from your bank and extract amount, date, and merchant. Hisab cannot send, delete, or modify any email.
Bank statements you upload (CSV, PDF, or scanned image): parsed entirely on your device to extract transactions.
Account and category information you enter: stored locally to organise your transactions.

Where your data is stored

All transaction, account, and category data is stored in an AES-256 encrypted database on your device, unlocked only by the password you set. This data is never uploaded to a Hisab-operated server. Hisab does not automatically back up your data to any cloud service.

Backups

You may create an encrypted backup file at any time from within the app, protected by a password you choose. This file is yours to store and share as you see fit — Hisab does not receive a copy.

On-device AI

Hisab uses a small language model that runs entirely on your device to help categorise transactions and answer questions about your finances. This data is used solely to provide these on-device features and for no other purpose. No transaction data or email content is sent to any external AI service, server, or third party for this or any other purpose.

Crash & Diagnostics

Hisab uses Firebase Crashlytics to help identify and fix crashes. When the app crashes or encounters an error, Crashlytics automatically sends a diagnostic report containing:

Stack trace of the error
Device model, OS version, and app version
App usage state leading up to the crash (e.g. screen name)

This report never includes your transaction data, account information, email content, or any financial data — Crashlytics only sees app-level error information. This data is governed by Google's Privacy Policy.

What our server does receive

To keep your Gmail connection working reliably, Hisab uses a small server-side relay (hosted on Firebase Cloud Functions) that exchanges authentication tokens with Google on the app's behalf. This relay:

Receives only OAuth authentication codes and refresh tokens — never your email content, subject lines, or transaction data.
Verifies each request comes from a genuine, unmodified copy of Hisab before responding.
Does not log or store the tokens it relays beyond the time needed to process the request.

Data security

Hisab implements industry-standard security measures to protect your sensitive data:

Encryption in transit: all network communication, including the OAuth token relay between the app and our server, uses TLS/HTTPS.
Encryption at rest: all transaction, account, and category data is stored in an AES-256 encrypted database on your device.
Access controls: the on-device database is unlocked only by the password you set; Hisab does not operate a server that stores your transactions, account balances, or email content.
No plaintext exposure: sensitive data obtained via restricted scopes (e.g. Gmail transaction alerts) is never transmitted or stored unencrypted at any point.

Third-party services

Google (Gmail API, Google Sign-In): used to connect your Gmail account. Governed by Google's Privacy Policy. Hisab's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft (Outlook / MSAL): used to connect your Outlook account. Governed by Microsoft's Privacy Statement.
Google Play Billing: used to process any in-app purchase or subscription. Hisab does not receive or store your payment details.
Firebase Crashlytics: used to collect crash and error diagnostics to improve app stability. Governed by Google's Privacy Policy.

Data deletion

Uninstalling Hisab removes all locally stored data, including the encrypted database. Disconnecting an email account from within the app immediately revokes Hisab's access to it. For full step-by-step instructions, see our Data Deletion page.

Children's privacy

Hisab is not directed at children and does not knowingly collect data from anyone under 13.

Changes to this policy

If this policy changes, the "Last updated" date above will reflect it. Material changes will be noted within the app.

Contact

Questions about this policy or your data can be sent to sanganakramadeshak@gmail.com.