This Privacy Policy describes how Kharcha Bol, a product under EagleX (eaglex.co.in), ("we", "our", "the App") handles information when you use the application. We are committed to being transparent about our data practices.
🔒 Short version: Kharcha Bol is a privacy-first, self-hosted application. We do not sell your data. We do not run analytics on your financial information. Your data stays in YOUR database.
1. Information We Collect
1.1 Information You Provide Directly
- Account credentials — Email and password (managed by Firebase Authentication; we do not store your password).
- Financial data — Transaction amounts, categories, dates, and notes you enter into the App. This data is stored in your own Supabase database.
- API keys & credentials — Supabase URL/key, Groq/OpenAI API keys you provide in Settings. These are stored in your browser's localStorage and, if Cloud Sync is enabled, encrypted with AES-256 before being stored in Firebase Firestore.
1.2 Automatically Collected Information
- We do not collect analytics, telemetry, or usage data. We have no tracking scripts, third-party analytics (Google Analytics, Mixpanel, etc.), or crash reporters.
- Your browser may store preference data (currency, page size, theme) in localStorage on your device only.
2. How We Use Your Information
We use information solely to provide the App's features:
- Authenticating you via Firebase Authentication
- Saving and retrieving your expense records from your Supabase database
- Passing your transaction data to AI services (Groq/OpenAI) via your own API key to generate insights — we do not store this data on our servers
- Encrypting and decrypting your API keys for Cloud Sync mode
3. Data Storage & Location
| Data Type | Stored Where | Encrypted? |
|---|
| Transactions / Expenses | Your Supabase DB (you control) | At rest by Supabase |
| API Keys (Local Mode) | Browser localStorage only | No — stays on your device |
| API Keys (Cloud Sync) | Your Firebase Firestore | Yes — AES-256 |
| Auth tokens | Browser localStorage (Firebase SDK) | Yes (Firebase-managed) |
| App preferences | Browser localStorage | No — not sensitive |
| Voice input audio | Not stored — processed live | N/A |
4. Security Measures & Limitations
We implement reasonable security measures including:
- AES-256 encryption for API keys stored in Firebase Firestore
- HTTPS-only communication
- Firebase Authentication for identity verification
- Supabase Row-Level Security (recommended to be configured by the user)
Important Security Disclaimer: Despite these measures, no system is 100% secure. In the event of a security breach — including unauthorized access to your database, exposure of API keys, or interception of encrypted data — Kharcha Bol and its contributors cannot be held liable for any resulting damages, unauthorized API charges, or data loss. You use this application at your own risk. We strongly recommend rotating your API keys periodically and monitoring third-party service dashboards.
5. Data Sharing with Third Parties
We do not sell, rent, or trade your data. Your data is shared with third parties only in these cases:
- AI providers (Groq / OpenAI): When you use the AI features, your recent transaction data (amounts, categories, dates, notes) is sent to the AI provider you configured, using your own API key. This data is subject to that provider's privacy policy. We do not retain this data after processing.
- Supabase: Your financial records are stored in your Supabase project. Supabase's privacy policy applies: supabase.com/privacy
- Firebase / Google: Authentication and (optionally) encrypted key storage. Google's privacy policy applies: policies.google.com/privacy
- Legal requirements: We may disclose information if required by law, court order, or governmental authority — though given the self-hosted nature of this app, we hold very little data ourselves.
6. Your Rights & Data Control
Since you own your database, you have complete control:
- Access & Export: You can directly query your Supabase database at any time.
- Deletion: You can delete individual transactions in the App or drop the entire database table.
- Account Deletion: You can delete your Firebase account through Firebase Authentication console, which removes your auth record and any cloud-synced keys.
- Portability: Your data is in a standard PostgreSQL database — you can export it at any time via Supabase Dashboard → Backups.
7. Children's Privacy
Kharcha Bol is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided information to us, please contact us immediately.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the Effective Date at the top. Your continued use of the App constitutes acceptance of the revised policy.