Terms, and how your data is kept

1. What this is

   • A set of books for one household, kept by the people in it. Nothing is read from your bank, your messages or your phone: every figure here is one that you or someone in your household typed, scanned and confirmed, or recorded from a schedule.
   • You can keep more than one household, and belong to households other people opened. Each is its own set of books.

2. Who can see your books

   • The members of your household, at the role its owner gave them, and no one else. No other household, no advertiser, no analytics service — none is connected.
   • Someone who is invited sees the books only after they have made their own account and opened the invitation sent to their address.
   • Whoever runs this copy of the app can, in principle, reach the database it stores. That is true of every service that keeps anything for you, and it is worth saying plainly here rather than leaving you to assume.

3. How it is kept

   • The books live in a Postgres database. The storage underneath it is encrypted at rest, and every connection to it is over TLS — the app refuses a plain one.
   • Your password is never stored. What is stored is a salted scrypt hash of it, which is enough to check the password and useless for recovering it.
   • A Google AI key you add for receipt scanning is encrypted with AES-256-GCM under a secret that exists only on the server. It is decrypted only to scan, and sent nowhere but Google.
   • Every request checks, on the server, that you belong to the household you are asking about and that your role allows what you are doing. The database checks it again: the app connects to Postgres as a role that can only see the household a request is for, so a query cannot reach another household’s rows even by mistake. Sessions can be cut off: changing your password or tapping Sign out everywhere ends every other phone’s session on its next tap.
   • Invitation and password-reset links carry a one-time token, expire, and are sent without a referrer so the address bar does not leak them to the next site.

4. What leaves your phone

   • Entries go to the app’s own server and nowhere else. An entry saved without signal waits on the phone and goes when there is one.
   • If you turn on receipt scanning, the photo you scan goes to Google’s Gemini API under your own key and your own quota. That is the only third party, and only when you choose it.

5. The source is public

   • The whole app is at github.com/idiot95/Saree-al-Hisab. You can read exactly what it does with your data rather than take this page’s word for it.
   • You can also run your own copy against your own database. A Postgres connection string and one secret are all it needs; the README in the repository says how. Then nobody but you holds the books.

6. Your account

   • Change your password, or sign every phone out, under Household. An owner can remove anyone from a household; the entries that person recorded stay, because they are the household’s record, not theirs.
   • There is no delete-my-account button yet. Until there is, ask whoever runs your copy and they can remove the account and any household only you belong to.

7. What this is not

   • It is not a bank and it moves no money anywhere. It does not give advice. The figures are what was recorded, so they are as right as the recording, and a budget met here is not a guarantee of anything outside it.
   • It is provided as it is, without warranty. If this copy is ever taken down, you will be told first — and because the source is public, the books can always be moved to a copy you run.

Using the app means agreeing to these. Questions go to whoever sent you the link.