Privacy Policy

1. Who we are

Kasho is operated by Sweyam Technologies, a limited liability partnership registered in India and based in Kozhikode, Kerala, India ("Sweyam", "we", "us"). Kasho is a Sweyam product.

For any privacy question, request, or complaint, write to us at [email protected]. We are the data fiduciary for the personal data described here and process it in accordance with the Digital Personal Data Protection Act, 2023 and other applicable Indian law.

2. What this policy covers

This policy applies to the Kasho web application, the Kasho mobile apps for Android and iOS, the Kasho marketing site, and any related support we provide. Signing in to Kasho is handled by Sweyam Auth, our identity service, which has its own notice; where that service processes data on our behalf it follows the same standards described here.

The mobile apps can ask for device permissions — contacts, camera, photos, and notifications. Each is optional, requested only when you use the feature that needs it, and can be withdrawn in your device settings. What we do with contact data if you choose to sync it is described in section 3.

It does not cover third-party websites you reach through links from Kasho, or data you choose to export and store elsewhere.

3. What we collect

Account and identity data

When you create an account through Sweyam Auth we receive your name, email address, and a stable account identifier. We do not receive or store your password — authentication secrets stay inside the identity service.

Financial records you enter

Kasho stores what you put into it: accounts and balances, transactions, categories, budgets, savings goals, recurring items, notes, attachments you upload, and the labels and amounts involved in split expenses, lending, and family planning. You decide what to record; Kasho does not connect to your bank or import statements automatically.

Relationship and sharing metadata

If you use Connections or Family features we store the links you create, the role and permissions on each link, invitation status, and any account-balance disclosure you choose to make. Invitations are referenced by a one-way hash of the invite token, never the raw token.

Contacts you choose to sync

In the mobile app you can sync contacts from your device to find and add the people you split, lend, and borrow with. This only happens after you tap to sync and grant your device's contacts permission — the app works without it. When you do, we upload the name, phone number, and email address of the contacts from your address book and store them on your Kasho account. We use this data only to provide the contacts and people features you switched on; we do not use it for advertising, profiling, or messaging your contacts, and we do not share it. You can delete synced contacts individually in the app, and they are removed when you delete your account. You are responsible for having a proper basis to add other people's details.

Technical and usage data

Our servers keep operational logs that include your IP address, device and browser type, timestamps, request paths, and error diagnostics. We use these to keep the service running, investigate abuse, and fix bugs.

Advertising technical data (free plan)

If you use Kasho without an ad-free plan, we show advertisements through Google AdMob (mobile apps) and Google AdSense (web app). Those networks receive standard ad-request technical data such as device or browser type, IP address, approximate location derived from IP, and an advertising identifier where the platform provides one. We configure mobile ad requests as non-personalised only. We do not send your ledger balances, transactions, or notes to ad networks.

Payment and subscription data

If you buy Kasho Pro, payment is handled by Google Play Billing (Android) or Razorpay (web). We receive subscription status, product identifiers, and non-sensitive billing metadata needed to grant access. Card numbers and UPI secrets stay with the payment provider; we do not store full payment credentials.

Cookies and local storage

Kasho uses strictly necessary cookies and browser storage for your session, security, and interface preferences such as theme. We do not run our own advertising cookies or product analytics/tracking scripts. When you allow advertising cookies, Google AdSense on the free web plan may set or read cookies or similar identifiers as described in Google’s advertising policies and our Cookies Policy. The marketing site may reference our AdSense publisher account for programme verification; it does not load a separate analytics suite beyond what that programme requires.

• Cookies Policy

4. How we use your data

• Provide the service — store and show your records, run budgets, goals, planning, and the connections, family, and contact-sync features you switch on (contract / service you asked for).
• Keep it secure — authenticate requests, enforce per-account access, detect and rate-limit abuse (security / legitimate use under DPDP).
• Support you — respond to messages you send us and investigate issues you report (consent or service request).
• Maintain reliability — monitor errors, capacity, and backups (security and service operation).
• Show ads on free plans — load AdMob/AdSense units so we can offer a free tier (consent where required by regional law; otherwise as disclosed here for the free product).
• Process subscriptions — verify Play or Razorpay purchases and maintain Pro entitlement (contract).
• Meet legal obligations — respond to lawful requests and keep records the law requires.

Under the DPDP Act we rely on your consent where required and on legitimate uses permitted for providing a service you asked for and keeping it secure. You can withdraw consent that is not required to run the core service by contacting us, changing device permissions, upgrading to an ad-free plan, or deleting your account; this does not affect processing already carried out.

Purpose and basis (summary)

• Account, ledger, budgets, sharing you enable — necessary to provide the service you requested.
• Security logs, abuse prevention, backups — legitimate use to protect the service and users.
• Optional contacts sync, camera/photos, push notifications, family email invites — consent / permission you grant in-product.
• Ads on free plans — disclosed advertising; non-personalised on mobile; web AdSense loads only after advertising-cookie consent via the on-site CMP.
• Paid Pro billing — necessary to perform the subscription contract.

We do not currently send marketing newsletters or promotional email campaigns. Product messages you opt into (such as push notifications or family invitations you trigger) are not marketing consent. If we introduce marketing email, we will ask for separate opt-in and record it.

5. What we never do

• We do not sell, rent, or trade your personal data.
• We do not use your financial records for advertising targeting, profiling, or building ad audiences.
• We do not ask for, store, or use your bank login credentials.
• We do not embed session recorders or social pixels in the application.
• We do not share synced contacts for advertising or message your contacts ourselves.

6. When we share data

We share personal data only in these situations:

• Service providers (data processors) who help us run Kasho under written instructions, only as needed for their function. Current categories and named providers include: Sweyam Auth (identity and Google sign-in); Google (AdMob, AdSense, and Play Billing where you use those features); Razorpay (web subscriptions); Cloudflare (edge HTTPS / tunnel); object storage and hosting providers for application, database, and file storage in India; transactional email and error-monitoring vendors we engage to operate the service.
• Identity — Sweyam Auth, to verify who you are at sign-in (including Google account profile fields the identity service returns).
• Other users you choose — when you accept a connection, join a family workspace, or disclose an account balance, the specific data you approve becomes visible to those people. You can revoke most disclosures.
• Legal and safety — when we are required by law, court order, or a valid government request, or where it is necessary to protect rights, safety, or the integrity of the service.
• Business transfer — if Sweyam is involved in a merger, acquisition, or asset sale, data may transfer to the successor, who must honour this policy or give you notice and a choice.

We do not transfer personal data to any country the Government of India restricts for such transfers. Some processors (notably Google and Cloudflare) may process technical data in other regions as part of their global networks; we choose India-hosted application and database storage for Kasho account and ledger data.

• Current subprocessors list

7. Where and how long we keep it

Kasho application and database data for hosted accounts is kept on servers located in India. Your records are kept for as long as your account is active. See the Security page for how the data is protected while we hold it.

When you delete your account, access is revoked promptly and the account is marked deleted so it cannot be used. Live product surfaces stop serving your data. Encrypted backups rotate and drop deleted material within about 35 days. We may retain a minimal set of records longer where the law requires it (for example tax, accounting, dispute, or fraud-prevention records), and we keep only what is necessary for that purpose.

Operational and security logs are retained only as long as needed for reliability, abuse investigation, and legal compliance (typically up to 12–24 months unless a longer hold is required). Soft-deleted account rows and uploaded files in object storage are scheduled for hard purge as retention automation matures; until then, deleted accounts remain inaccessible to sign-in and excluded from normal product use.

8. How we protect it

All traffic to Kasho is encrypted in transit with TLS. The database runs on a dedicated host, isolated on a private network and not reachable from the public internet, with LUKS full-disk encryption and database-level encryption at rest; backups are encrypted. Access to production data is limited to the people who need it to operate the service.

The Security page describes our controls in detail.

9. Your rights

Under the DPDP Act and this policy you can:

• Access — get a summary of the personal data we hold about you and how it is processed, including an in-app/web export of your Kasho data where available.
• Correct and update — fix inaccurate or incomplete data (most of this you can do directly in the app).
• Erase — delete your account and associated personal data, subject to the retention note above.
• Withdraw consent — for processing that relies on consent.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal — raise a complaint with us and, if unsatisfied, with the Data Protection Board of India.

To exercise any of these, email [email protected] from your registered address. We will verify your identity and respond within the timelines set by law, and in any case without undue delay.

10. Users in the EEA, UK, or Switzerland

Kasho is designed and offered primarily for users in India under Indian law (including the DPDP Act). If you access Kasho from the European Economic Area, the United Kingdom, or Switzerland, this section supplements the rest of this policy.

Where the GDPR or UK GDPR applies, Sweyam Technologies is the controller for hosted Kasho personal data. Typical lawful bases (GDPR Art. 6) map as follows: performance of a contract for account and ledger features; legitimate interests for security logging, fraud prevention, and reliability (balanced against your rights); consent for optional permissions and for advertising where regional law requires it; legal obligation where we must retain or disclose records.

• You may request access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests, subject to legal limits.
• You may lodge a complaint with your local supervisory authority.
• Ledger and account data for hosted Kasho is stored in India. Technical processing by global providers (for example edge networks or ad/payment platforms) may involve transfers outside your country; contact us for current transfer details.
• We do not currently maintain an EU/UK Article 27 representative. Email [email protected] for GDPR-related requests; we will respond without undue delay and within one month where that timeline applies.

11. Children

Kasho is intended for adults. We do not knowingly create accounts for anyone under 18. If you believe a minor has an account, contact us and we will remove it.

12. Changes to this policy

We may update this policy as the product or the law changes. If a change is material, we will notify you in the app or by email before it takes effect. The "last updated" date at the top of this page always reflects the current version.

13. Contact and grievance officer

Grievance Officer, Sweyam Technologies, Kozhikode, Kerala, India. Email: [email protected]. We acknowledge grievances within 72 hours and aim to resolve them within 30 days.