Privacy policy
Last updated 17 October 2026
This policy covers the Daybook Android app, the Daybook Cloud service (sync and the web app) and this website. It is written to be read, not skimmed past: where something is a trade-off, it says so.
Who we are
Daybook is run by Mohammed Khalid, India (“we”, “us”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data Daybook Cloud holds. Contact us at hello@openkhalix.com.
The short version
- The Android app on its own sends us nothing. There is no account, no analytics and no crash reporting in it.
- Your SMS and notifications are read on your phone and never uploaded, even with Daybook Cloud on.
- With Daybook Cloud, the entries in your ledger are stored on our servers. They are encrypted in transit but not end-to-end encrypted: our server can read them.
- We do not sell personal data, use it for advertising, or share it except with the processors listed below.
- You can export everything, and deleting your account deletes your ledger.
1. The Android app without an account
The app keeps its data in its own private storage on your phone. It asks for these permissions, and uses them only as described:
| Permission | What it is for |
|---|---|
| Read and receive SMS | To find bank, card and UPI messages, in your inbox and as they arrive. A privacy gate drops everything else — OTPs, messages from people, anything without an amount — before it is stored. |
| Notification access (optional) | To capture payments from payment-app notifications. Only notifications from known payment apps are looked at. |
| Notifications | Budget alerts and capture confirmations. |
| Internet | Daybook Cloud sync only. Without an account the app makes no network requests. |
Backups and exports you create are files you choose where to save. We never see them.
2. Daybook Cloud
If you create a Daybook Cloud account, we process:
| Data | Details | Why |
|---|---|---|
| Account | Name, email address, time zone, a one-way hash of your password (Argon2id; we cannot recover the password), whether your email is verified. | To sign you in and contact you about your account. |
| Ledger | Transactions (amount, currency, date, direction, merchant, category, notes, tags, the bank’s reference number, the balance the bank stated, how it was captured), accounts (name, type, last four digits, opening balance), categories, tags, budgets and detected subscriptions. | To sync your devices and show the web app. |
| Devices | For each signed-in device: its name, browser or app version, IP address, and when it signed in and was last used. | So you can see and sign out your devices, to enforce the device limit, and to detect stolen sessions. |
| Billing | Plan, billing period, Razorpay’s subscription and payment ids, the state you chose for the place of supply, and the receipts or tax invoices we issue (with your name and email on them). | To charge you, and to keep the tax records the law requires. |
| Logs | IP address, time, the address requested and the result, for each request to our servers. | Security and fixing faults. |
We do not receive the text of your messages, your contacts, your location, or any card, UPI or bank login details. Payments are made on Razorpay’s checkout; we only learn whether a payment succeeded.
We process this data with your consent, given when you create the account, and — for tax records and responding to lawful requests — because the law requires it. You can withdraw consent at any time by deleting your account.
3. Who else processes it
- Our hosting provider, which runs the servers and stores the encrypted backups, in Finland (Hetzner, via dnspark hosting).
- Razorpay Software Private Limited, which processes payments and mandates under its own privacy policy and RBI’s rules.
- Our email provider, which delivers verification, password-reset and billing emails.
Each processes data only on our instructions and only for that job. We disclose data to authorities only when Indian law requires it, and will tell you unless the law forbids us to.
This website has no analytics, advertising or tracking scripts, and sets no cookies.
4. How it is protected
- All traffic uses TLS (HTTPS). Database backups are encrypted before they are stored.
- Every request is checked against the signed-in account, so one account can never read another’s data.
- Session tokens are stored only as keyed hashes; a stolen, already-used token signs out the device it came from.
- Access to production systems is limited to the people who run Daybook, and used only to keep the service working or to fix a problem you report.
Daybook Cloud is not end-to-end encrypted. We chose that so the web app can search, total and chart your ledger on the server. If you would rather nothing left your phone, use the app without an account — it is complete on its own.
If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires.
5. How long it is kept
- Your account and ledger: until you delete them. Items you delete in the app are kept as deletion markers so your other devices learn of the deletion.
- When you delete your account: your account, ledger and devices are deleted immediately from the live database, and any subscription is cancelled. They leave the encrypted backups as those expire, within 14 days.
- Receipts and tax invoices: kept for as long as Indian tax law requires (currently up to eight years), even after the account is deleted, with only the name and email printed on them.
- Logs: kept in rotating files that are overwritten, normally within a few weeks.
We do not currently delete inactive accounts. If that changes, we will email you well before.
6. Your rights
Under the DPDP Act you can:
- Access your data — in the web app, Settings → Export gives you all of it as CSV.
- Correct it — everything in your ledger and profile is editable.
- Erase it — Settings → Delete account, in the web app.
- Nominate someone to exercise these rights if you die or become unable to — write to us.
- Raise a grievance with our Grievance Officer (below). We will reply within 7 days and resolve it within 30.
- Complain to the Data Protection Board of India, once you have raised it with us.
7. Children
Daybook Cloud is for adults. Do not create an account if you are under 18.
8. Changes to this policy
If we change what we collect or why, we will update this page and its date, and email account holders before a material change takes effect.
9. Grievance Officer and contact
Mohammed Khalid
Mohammed Khalid, India
hello@openkhalix.com