Privacy Policy.

1. What we collect

We collect what Monidhi needs to give you an account, keep your journal in sync across web and mobile, and keep the service secure:

• Account basics: the name and email you sign up with, and a mobile number if you choose to add one. We contact you by email only; nothing is sent to the number. We also record when you joined and when you last used Monidhi.
• Sign-in: you sign in with a six-digit code we email you, a passkey in the web app, or a key your phone keeps behind Face ID, Touch ID or your fingerprint. Your phone checks your face or fingerprint itself; Monidhi receives only the key it unlocks. We store a one-way hash of each emailed code and phone key, and only the public half of a passkey. If you choose to set a password in your profile, we store it only as a salted scrypt hash, never the password itself, and you can remove it and go back to emailed codes at any time. We also record wrong password attempts against an email address, so we can stop someone guessing. If you continue with Google or Apple, we keep the ID that provider uses for you, the email address it confirmed (for Apple, possibly a private relay address) and when you last used it. For Apple we also keep a token, locked with a key only our server holds, that lets us disconnect Monidhi from your Apple ID when you remove it or delete your account. Your Google or Apple password is never shared with us.
• Your journal: the accounts, cards, transactions, categories, budgets, goals, trips, loans, recurring items, investments, assets and planned purchases you add or confirm, and your settings.
• Bank messages: the parsed fields of each bank SMS or email you send us. Section 3 explains how this works.
• Devices: a label for each phone or browser you connect for sign-in, SMS capture or push notifications (for example "iPhone", your Android phone's model name, or "Chrome on macOS"), and when it was last used. If you turn on push notifications, we also store the push token that Firebase Cloud Messaging gives that phone or browser.
• Support requests: what you write to us under Help & support, and our replies.
• IP address: our server reads the IP address of each request to limit how many requests one address can make, and to check the admin console's allow-list for staff. It is used only in the server's memory and is not written to our database or logs. Cloudflare and DigitalOcean, which carry traffic to our server, also see it (see section 4).

We do not collect your contacts, your location or your browsing history, and Monidhi never reads your SMS inbox. The website and the apps have no advertising, analytics or crash-reporting tools.

2. Where it lives

Our API runs on DigitalOcean App Platform in Singapore. Your journal is stored in a Postgres database run by Neon in Singapore, and our operational logs are kept in MongoDB Atlas in Mumbai, India. If you live elsewhere, your data is processed in Singapore and India, and the providers in section 4 may process it in other countries.

Connections to Monidhi use HTTPS (TLS), and Neon and MongoDB Atlas apply their own storage encryption to the disks that hold our databases. Neither stops Monidhi's own servers from reading your journal: they read it to show it to you, sync it between your devices, send the reminders and alerts you turn on, and build your exports.

The apps show your journal only to your signed-in account. Our staff tools show your name, email, masked mobile number, when you joined and last used Monidhi, the names, types and last four digits of your bank accounts and cards, and how many entries you have. They do not show your transactions or balances. Support staff read the requests you send us. People who operate Monidhi's servers can technically reach the database, so we keep that access narrow and record staff actions in an audit log.

On your phone, the app keeps your sign-in session, the key behind Face ID or fingerprint sign-in (in the iOS Keychain or Android Keystore), a snapshot of your net worth, account balances and trips for the home-screen widgets, and any bank SMS still waiting to upload.

3. SMS & email parsing

Monidhi can fill in entries from your bank SMS and bank emails. You turn each route on yourself, and nothing is filed until you confirm it. Every message is read on our server, and only the parsed fields are stored, never the text. Specifically:

• Android: if you turn on SMS capture, the app uses Android's permission to receive new SMS. It has no permission to read your inbox. When an SMS arrives, the phone skips it unless it looks like a bank transaction, so one-time passwords and promotional messages are left alone. For a bank message, the app sends the text and sender to our server. Until the upload succeeds, Android holds the message on your phone.
• iPhone: iOS doesn't let apps read SMS. If you build the Shortcuts automation from our guide, it sends matching messages from your bank to our server in the same way, and the app holds a message on your phone until it uploads.
• Email: you can get a private forwarding address at in.monidhi.com. Cloudflare Email Routing receives mail sent to it, and a Cloudflare Worker passes the message to our server. If you set up forwarding from Gmail, we also store the confirmation code Gmail sends and the address that asked for forwarding, so the app can show them to you.
• A message you paste into the app is read the same way.
• What we keep: the server reads each message in memory and stores only the amount, merchant, sender and time, plus a fingerprint: a keyed one-way hash of the text, used to spot the same message arriving twice. The fingerprint can't be turned back into the text. Our logs record what happened to a message, never its text.
• You choose which senders are trusted in Parser settings, and you can turn SMS capture or email forwarding off at any time without losing past entries.

4. What we share

We share information only with the service providers that run Monidhi, and when the law requires it:

• Hosting and storage: DigitalOcean (our API) and Neon (the Postgres database that holds your journal), both in Singapore, and MongoDB Atlas (operational logs) in Mumbai.
• Cloudflare: hosts monidhi.com and the web app at app.monidhi.com, and runs the DNS and the proxy in front of our API, which every app talks to, so it sees request details including your IP address. It also receives mail sent to your in.monidhi.com forwarding address and to our support@, privacy@ and grievance@ addresses.
• SendGrid: sends our emails, so it handles your email address and the contents of each email: sign-in codes, invitations, notices that support has replied (with your request's subject), notices that a password was added, changed or removed, the confirmation that your account was deleted, and, unless you turn it off, the Monday weekly summary (your week's spending and income totals, number of entries and top category).
• Google: Firebase Cloud Messaging delivers push notifications. When you turn them on for a phone or browser, Firebase issues it a push token, and for each notification we send Google the token with the notification's title and body (for example "Dining budget exceeded" and "₹ 6,200 of ₹ 6,000 spent"). If you sign in with Google, Google tells us your name, your email address and the ID it uses for you. Separately, the web app loads its fonts from Google Fonts, so Google sees your IP address when the web app opens. On iPhone, the app's network check may request clients3.google.com/generate_204, with no account data, to tell "you're offline" from "our server is down".
• Apple: if you sign in with Apple, Apple tells us the ID it uses for you and your email address, or a private relay address if you choose Hide My Email, and your name the first time. Our emails to a relay address pass through Apple's relay. When you remove Apple sign-in or delete your account, we ask Apple to revoke Monidhi's access.
• Exchange rates: our server fetches daily rates from open.er-api.com. Only currency codes are sent, from our server, never from your device.
• App stores: Apple's App Store and Google Play distribute the mobile apps, under their own privacy policies.
• Legal: a valid Indian court order or a comparable request from another jurisdiction where we operate. We will challenge overbroad requests.
• Aggregated & anonymized: we may publish high-level usage statistics ("X% of users use recurring schedules"), never tied to any individual.

Each provider handles data only to provide its service to Monidhi, under its own data-processing terms. We do not sell or rent personal information. Ever. Even if we changed hands, this commitment binds any acquirer.

5. How long we keep it

We keep your account and journal for as long as you have an account. In detail:

• Account and journal: until you delete your account. That includes parsed bank messages you dismissed, your notifications and your support requests.
• Push tokens: until you turn notifications off or remove that phone or browser in Settings, Firebase tells us the token no longer works, or you delete your account.
• Google and Apple sign-in: the link stays until you remove it in Settings or delete your account. Removing Apple, or deleting the account, also asks Apple to revoke Monidhi.
• Sign-in records: an emailed code works for 10 minutes. We keep a record of each code (the email address, a hash of the code and when it was sent) and of each wrong password attempt. We delete these records a day after they expire, and any still left for your email address when you delete your account.
• Operational logs: when a request fails on our server, we log the error message and the request's method, path and status code. The path is the address of the request and can include a record's ID or a search term; the entry has no IP address, name or email. When we send an email, we log it with your address masked (for example p***@gmail.com). These logs have no automatic expiry yet; we keep them until we delete them.
• Staff audit log: staff actions, such as suspending an account, scheduling a deletion or replying to a support request, are recorded with the staff member's name and a message that can include your name and account ID. The audit log can't be edited and is kept with no end date, including after your account is deleted, as our record of what staff did.
• Emails you send us: messages to support@, privacy@ or grievance@ stay in our mailbox until we delete them.
• Backups: our database provider keeps point-in-time recovery copies that expire within 30 days, so deleted data is gone from them within 30 days.

6. Your rights

Wherever you are, you can:

• Export your transactions as a CSV file (date, merchant, amount, currency, amount in rupees, account, category, items, source and note) from Settings → Data export in the web app, or Insights → Export in the mobile app. The export covers transactions only; it does not include your goals, recurring items, trips, loans, investments or assets. To ask for anything else we hold about you, write to privacy@monidhi.com.
• Correct your name and mobile number in Settings → Profile, and your entries wherever they appear. To change the email on your account, write to privacy@monidhi.com.
• Switch off SMS capture, email forwarding, push notifications and the weekly summary, each from its own setting.
• Delete your account yourself: in the web app under Settings → Profile, or in the mobile app from your profile. It is immediate and permanent: your account and everything in it is deleted, every signed-in device is signed out, and the app clears its data from that phone. If you can't sign in, email privacy@monidhi.com from the address on your account. We suspend the account straight away and delete it 30 days later, so a mistaken request can still be cancelled. Our account deletion page has the steps and lists what is kept afterwards.
• Object to specific processing. If we can't honor it, we'll tell you why.

7. Contact

For privacy questions, write to privacy@monidhi.com. We answer within 5 working days. For India-specific grievances, you may also reach our Grievance Officer at grievance@monidhi.com.