Privacy Policy for KhataBook: Easy Hisab

Information We Do NOT Collect or Transmit

2. Information We Do NOT Collect or Transmit

Because KhataBook operates entirely locally on your Android device:

• No Personal Identity Information (PII): We do not ask for, collect, or store your real name, government identification, national identity numbers, home address, or phone number.
• No Account Credentials or Social Logins: There is no registration, sign-up, or login system. We do not use Google Sign-In, Firebase Authentication, Facebook Login, or any third-party single sign-on (SSO) service.
• No Financial or Banking Records: We do not monitor, inspect, sync, harvest, or store your bank accounts, credit card details, transaction notes, invoice images, customer debit/credit ledgers (hisab kitab), or balance totals.
• No Telemetry, Usage Analytics, or Behavior Tracking: We do not embed analytics SDKs (e.g., Google Analytics for Firebase, Mixpanel, Adjust, AppsFlyer) to record your screen views, clicks, or in-app behavior.
• No Advertising Identifiers or Trackers: We do not read or collect your Android Advertising ID (AAID), IMEI, MAC address, SIM serial number, or any cross-app tracking identifiers.
• No Location Data: We do not request, access, collect, or monitor GPS, Wi-Fi, or cellular network location coordinates.

Information Processed Locally on Your Device

3. Information Processed Locally on Your Device

All data entered into KhataBook is processed and stored strictly within the sandboxed, app-scoped internal storage of your individual mobile device.

3.1 Financial Ledger & Transaction Data

• Entries & Balances: All records of cash flow (Cash In and Cash Out), running balances, custom income/expense categories, payment modes, transaction notes, dates, and timestamps are saved in an isolated local SQLite database managed via Android's Room persistence library.
• Multi-Business & Multi-Book Entities: Multiple business profiles and cashbooks created within the application reside strictly in the local SQLite database.
• Contact & Customer Linking: Names or phone numbers associated with transaction entries (e.g., customer or supplier ledger attribution) are stored solely within your device's local database and are never synced to any remote server.

3.2 Receipt & Document Attachments

• When you attach a photo of a physical bill, invoice, or receipt to a transaction, the image file is copied directly into the application's private, internal storage directory.
• These files are inaccessible to other third-party applications on your device and are never uploaded to any external server or cloud service by KhataBook.

3.3 Security, PIN & Biometric Data

• 4-Digit Security PIN: If you choose to enable the in-app PIN lock, your PIN is cryptographically hashed using a cryptographic salt and the SHA-256 algorithm on your device. The plain-text PIN is never stored anywhere on the device or transmitted over a network.
• Biometric Authentication (Fingerprint / Face Authentication): Biometric authentication is handled exclusively through Android's official androidx.biometric.BiometricPrompt system framework. KhataBook never accesses, scans, collects, processes, or stores your raw fingerprint data, facial geometry, or biometric templates. All biometric matching occurs strictly within your device's secure hardware enclave (Trusted Execution Environment / Secure Element), and the Android operating system merely returns a binary success or failure confirmation to the application.
• Security Recovery Question: If you set a security recovery question to reset your PIN, the question and hashed answer are stored solely in your device's private, encrypted SharedPreferences.

Android Permissions & Justifications

4. Android Permissions & Justifications

KhataBook adheres strictly to Google Play's principle of data minimization and requests only the minimum device permissions necessary to perform user-requested actions:

| Android Permission | Technical Name | Purpose & Data Handling |

| :--- | :--- | :--- |

| Biometric Sensor | android.permission.USE_BIOMETRIC, USE_FINGERPRINT | Required solely to authenticate the user using the hardware fingerprint sensor via Android's system dialog. No biometric data is accessed or transmitted. |

| Haptic Feedback | android.permission.VIBRATE | Required to provide tactile vibration feedback when pressing keys on the in-app arithmetic calculator keypad and confirming transactions. No data is collected. |

| Camera (Optional) | android.permission.CAMERA | Requested only if you choose to take a photo of a physical receipt or invoice directly within the app. Images are saved locally to private app storage. |

| Media / Photos (Optional) | android.permission.READ_MEDIA_IMAGES (Android 13+) / Photo Picker | Allows you to select an existing receipt or bill photo from your gallery. Uses Android's modern, privacy-preserving Photo Picker where supported. |

| Network State (System) | android.permission.INTERNET, ACCESS_NETWORK_STATE | Present for standard Android system intent dispatching (such as launching the email client when tapping "Contact Support" or launching the Google Play Store page for app updates). KhataBook does not transmit user data or ledger records over the internet. |

Note Regarding File Storage Permissions:

KhataBook does not request broad legacy storage permissions (such as READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE). All database exports and imports utilize Android's secure Storage Access Framework (SAF), which ensures you explicitly choose the exact folder or file location with granular, operating system-level authorization.

Data Backup, Export & Portability

5. Data Backup, Export & Portability

Because KhataBook does not operate cloud servers, backup and data portability are under your complete control:

• Dual-Snapshot Local Anti-Loss Protection: The application maintains local, dual-snapshot database redundancy within the private internal storage directory to protect against data corruption during abrupt device shutdowns or battery depletion.
• User-Initiated Manual Export: You may generate a full JSON database backup at any time via the "Backup & Restore" menu.
• Destination Sovereignty (SAF): When exporting a backup, Android's native file picker allows you to save your backup file wherever you choose—such as your internal device storage, an external micro-SD card, or a personal cloud drive (such as Google Drive, Microsoft OneDrive, or Dropbox) linked on your device. MoboDevs has no access to your exported files, credentials, or personal cloud storage accounts.
• PDF & CSV Reports: When you export an A4 PDF statement, a CSV spreadsheet, or a WhatsApp PNG receipt voucher, the document is generated locally on-device. When you share it via third-party messaging apps (such as WhatsApp, Telegram, or Gmail), the file is transferred directly via Android's system share sheet (Intent.ACTION_SEND).

Data Retention & Total User Sovereignty

6. Data Retention & Total User Sovereignty

You retain total ownership and control over your data at all times:

• Modification & Deletion: You can edit or delete individual transactions, cashbooks, customer contacts, or business profiles directly within the app at any time. Deleted records are immediately and permanently removed from the local SQLite database.
• Complete Data Wiping: You can permanently destroy all data stored by KhataBook at any time through any of the following methods:

1. Navigating to your device's Android Settings > Apps > KhataBook > Storage > Clear Data (or "Clear Storage").
2. Uninstalling the KhataBook application from your device.

• Irretrievability Warning: Because we do not possess copies of your records on external servers, once data is deleted locally or the app is uninstalled without a prior export, MoboDevs cannot recover or restore your records.

Third-Party Advertising & External Disclosures

7. Third-Party Advertising & External Disclosures

• No Advertisements: KhataBook contains zero third-party commercial advertisements. We do not integrate ad networks (such as Google AdMob, Unity Ads, AppLovin, or ironSource).
• No Sale or Commercial Transfer of Data: MoboDevs does not sell, rent, license, trade, disclose, or distribute your financial records, personal information, or device data to data brokers, advertisers, financial institutions, credit bureaus, or marketing partners under any circumstances.

Operating System Security & Device Protections

8. Operating System Security & Device Protections

KhataBook implements multi-layer local defense mechanisms to safeguard your confidential ledger:

• Android Application Sandboxing: Data is stored within private application directories accessible only by the application's unique Linux User ID (UID), preventing unauthorized apps from reading your books.
• Task Switcher Privacy Scrim: The application employs a dynamic frosted Gaussian blur and secure flags in the Android Recent Tasks switcher, preventing shoulder-surfing or screen-capture exposure of sensitive balances when switching apps in public environments.
• Immediate Lock on Backgrounding: When configured by the user, the app automatically locks its interface the moment the application loses focus or the device screen turns off.

Children's Privacy (COPPA & GDPR Compliance)

9. Children's Privacy (COPPA & GDPR Compliance)

KhataBook is designed as a business accounting and personal ledger utility for merchants, professionals, and individuals capable of managing financial accounts. The Application is not directed toward children under the age of 13 (or under 16 in applicable European jurisdictions), and we do not knowingly solicit, collect, or store data from children.

Compliance with Global Privacy Frameworks

10. Compliance with Global Privacy Frameworks

• Google Play Developer Policy: This policy adheres fully to the Google Play Developer Program Policies on User Data, Permissions, and Data Safety disclosures.
• GDPR (General Data Protection Regulation - EU/EEA/UK): Under GDPR, you are the sole data controller of your personal and financial ledger records. Because all processing occurs locally on your hardware without remote transmission, MoboDevs acts neither as a data controller nor as a data processor of your business ledgers.
• CCPA / CPRA (California Consumer Privacy Act): We do not "sell" or "share" consumer personal information as defined under the CCPA/CPRA.
• International Data Transfers: Because all data remains strictly on your local device, no international cross-border data transfers occur.

Changes to This Privacy Policy

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to the Application, updates to legal frameworks, or changes in regulatory guidelines. Any modifications will be reflected with an updated "Last Updated" date at the top of this document. We encourage you to review this policy periodically.

Contact Information

12. Contact Information

If you have questions, feedback, inquiries, or concerns regarding this Privacy Policy or the security architecture of KhataBook: Easy Hisab, please contact us:

• Operating Entity / Developer: MoboDevs
• Application Name: KhataBook: Easy Hisab
• Application ID / Package: com.mobodevs.KhataBook
• Official Support Email: support@mobodevs.net