What Khaata knows, and what it never will.
Khaata is an expense and udhaar ledger for Indian households and small shops, made by the Khaata team (“we”). This policy explains what we collect when you use the Khaata app and khaata.net, why we collect it, where it lives, who else sees it, and what you can do about it. It is written to be read, not skimmed; if anything is unclear, write to support@khaata.net.
1. What we collect
We collect only what the ledger needs to work. Nothing is gathered in the background.
Account
- Your name, as you typed it.
- Your phone number or email address, whichever you signed up with. It is your login and the way other members of a chapter recognise you.
- A password hash (scrypt, with a random salt). We never store your password and cannot read it.
- Your UPI id, only if you add one, so people who owe you can pay you.
What you write in the book
- Chapters (for example “Flat 2B”, “Goa trip”, your shop) and the names, and optionally phone numbers and UPI ids, of the people you add to them.
- Entries: amounts, notes, merchant, category, payment mode, who paid and how it was split.
- Settlements: who says they paid whom, how much, by which method, and whether the receiver confirmed, held or disputed it.
- Photos you attach, receipts and payment proofs, and nothing else from your camera roll.
Device
- A push-notification token for the devices you sign in on, so we can tell you when someone claims a payment or confirms yours.
- Server logs with the time, route and status of each request and an IP address, kept for 30 days for security and debugging. We do not build profiles from them.
2. What we never do
- We never read your SMS, your bank statements or your UPI app. Khaata has no connection to any bank or payment network.
- We never move money. Payments happen in your own UPI app; Khaata only records what you and the other person say.
- We do not sell, rent or trade your data. We show no ads unless you switch on a sponsor line under You; it is never built from your slips, never shown on an entry or settle screen, and never a loan offer.
- We do not use your entries, photos or voice notes to train AI models. A bill photo or a question is sent to our model provider only after you switch on AI reading under You; names are replaced before it leaves, it is not retained by the provider, and the photo is read once and not kept.
- We do not read your contacts. When you add a person by phone number, we check only whether that number has a Khaata account, return no name or other detail, and limit how many such checks an account can make in a day. The number you typed is kept with the chapter you added it to.
3. Where your data lives
Your account and everything you write is stored on Khaata's server, with attachments stored as files alongside the database. All traffic between the app, khaata.net and the server is encrypted in transit (HTTPS). The server is backed up regularly; backups are retained for 30 days and then overwritten.
Each chapter is visible only to its members. A member who has not installed the app (a “guest” you added by name) cannot see anything; if they later join with your invite code, they see the chapter they joined and nothing else.
4. Third parties
A short list, and each one receives only what its job needs.
| Who | What they receive | Why |
|---|---|---|
| Expo push service | Your device push token, a notification title and body (for example “Priya says they paid you ₹2,000”) | To deliver notifications to iOS and Android |
| Our hosting provider | The encrypted server and its backups | To run Khaata |
| Anthropic (AI) | Only a bill photo you choose to scan, or a question you ask the book, and only after you switch on AI reading under You. People's names are replaced with labels before anything is sent. The provider does not retain it or train on it. | To read the amount, merchant and date so you don't have to type them, and to answer a question with figures from your own slips |
AI reading is the only time anything you wrote leaves our server for a third party, and it only happens when you tap Scan or Ask with AI reading switched on. Photos you attach without scanning are never sent anywhere. We do not use analytics or advertising SDKs. A sponsor line, if you switch one on, is a plain line of text chosen without reference to your slips.
5. How long we keep it
- Your account and ledger: for as long as your account exists.
- Attachments: for as long as the entry they belong to exists.
- Push tokens: until you sign out of that device or delete your account.
- Server logs: 30 days.
- Backups: 30 days after the data was deleted from the live server.
6. Your rights
- See and export. Everything in your account is visible in the app and at khaata.net. You can ask for a full export by email and we will send it within 7 days.
- Correct. Your name and UPI id can be changed in the app under You, or on the khaata.net dashboard. Entries are never silently edited: a correction appends a reversal so the book still adds up.
- Delete. Delete your account from the app (You → Delete account) or at khaata.net/delete-account. Your account, the chapters you own, their entries, settlements and photos, your wallet, inbox and device tokens are removed within 7 days (immediately from the live server; backups age out within 30 days). In chapters that other people own, your name stays on the lines you were part of, so their book still balances, but it is no longer linked to you.
- Object or ask. Write to support@khaata.net and a person will answer.
7. Children
Khaata is for people aged 13 and over. We do not knowingly collect data from anyone younger; if you believe a child has created an account, tell us and we will delete it.
8. Security
Passwords are hashed with scrypt. Sessions use short-lived access tokens and rotating refresh tokens; signing out revokes the device's token. Receipts can be fetched only by members of the chapter they belong to. If we ever learn of a breach that affects you, we will tell you by the email or phone number on your account.
9. Changes
If this policy changes in a way that matters, we will say so in the app before the change takes effect. The date at the top is the date of the current version.
10. Contact
Khaata · support@khaata.net · India