1. Scope and who we are
Hisab is a personal finance record-keeping application provided under the TruMesha brand. In this policy, "Hisab," "TruMesha," "we," "us," and "our" refer to the provider of the Hisab mobile application and related services.
This Privacy Policy applies to the Hisab Android application, its application programming interfaces, and related support and billing services. By using Hisab, you acknowledge the practices described in this policy.
2. Information we collect
Account and profile information
Mobile sign-in uses your verified mobile number and account identifiers. Your name and email are optional for accounts created using mobile sign-in. Existing password accounts retain their profile and authentication information. Passwords sent to our service are converted into a cryptographic hash for server-side authentication; we do not retain your plain-text password on our servers.
For mobile verification, your phone number is sent to Google Firebase Authentication. Google sends a verification SMS and processes and stores phone numbers to prevent spam and abuse across Google services. Hisab Book receives a verified identity token; it does not store your SMS verification code.
Financial records you choose to enter
To provide Hisab's core features, we process records that you create, such as wallets or accounts, income and expense entries, amounts, transaction types, dates, notes, categories, customer names and phone numbers, and balances. If an attachment or receipt feature is available and you choose to use it, we also process the files you upload and related metadata.
Hisab is a record-keeping tool. We do not access your bank account or payment card merely because you enter a transaction into the app.
Optional text-to-entry suggestions
The on-device entry helper reads your description on your phone. If AI suggestions are available and you expressly choose them, we send only the description you type and the date used to interpret your entry through our server to OpenAI to prepare a draft. The description may contain the financial information or names you choose to include. We do not send your saved ledger, contact list, receipt photos or login credentials to the AI provider. We do not keep a separate history of these prompts or include them in application logs. We request that API response storage be disabled; provider security and abuse-monitoring retention may still apply. You can use the on-device helper or manual form instead. Suggestions are not saved as transactions until you review the details and choose to save. See OpenAI API data controls.
Optional contact import
When you choose to add a customer from your contacts, we request permission to read contacts and open your phone's contact picker. Only the selected customer's name and phone number that you review and confirm are saved to your Hisab account. We do not upload your entire address book or change your phone's contacts. You can enter customers manually without contact permission and revoke permission in your device settings.
Subscription and payment information
If you purchase a paid plan, we may process your selected plan, subscription status, payment status, amount, currency, and payment or order identifiers. Payment details such as card or bank credentials are collected and processed by the payment provider, such as Razorpay, under that provider's privacy policy. We do not receive or store complete card numbers or banking credentials.
Device, security, and diagnostic information
We use Google Firebase Crashlytics to diagnose app crashes and reliability issues. Reports may contain app and operating-system versions, device model, installation identifiers, crash stack traces and technical API timing or failure categories. We do not attach transaction entries, receipt photos, contacts, OTPs or login tokens to these reports. JavaScript exception messages and API paths are reduced to technical categories. You can turn optional app reporting off under Account → Crash and performance reports. Server request logs retain technical request identifiers, response status and timings to operate the service. See Firebase privacy information.
We may process device or app information, IP address, request timestamps, authentication tokens, server logs, error details, and security events. We use this information to operate the service, prevent abuse, diagnose failures, and protect accounts.
Optional encrypted backup files
You can export your device's saved entries, parties, categories, receipt photos and pending entries to a password-protected backup file. Encryption happens on your device. We do not receive or store your backup password and cannot recover it. Only a service you choose through the share sheet receives the encrypted file. Restoring sends the selected financial records to your authenticated Hisab account; it does not restore login credentials or subscription entitlements. Copies you export remain under your control and are not removed when you delete your Hisab account.
Information stored on your device
Authentication tokens and optional remembered sign-in details use the device's protected secure storage. The app also saves your synced transactions, parties and their contact details, wallets, categories, budgets, payment requests, subscription status and receipt photos in its private local database for offline viewing. New entries and photos are queued locally until they can sync. Local copies are separated by account; signing out removes the active session but retains each account's offline data for its next sign-in. Deleting your account removes its local copy. Clearing app data or uninstalling also removes local data. A download interrupted by loss of connection or storage space retains the previous complete copy.
Customer messages and payment-request links
At your request, the app prepares a message and opens SMS, WhatsApp or your chosen sharing app. You review the recipient and message and tap Send yourself. Hisab Book does not read your messages or automatically send them. The receiving app's privacy policy applies to messages you send.
Creating a payment request produces a private, unguessable link. Anyone with that link can see the requester name and mobile, customer name, amount, note and optional UPI ID. The page does not show your other transactions or account balance. Links expire after 30 days and can be cancelled in the app. A UPI button opens a separate payment app; Hisab Book never collects a UPI PIN and does not automatically verify these payments. A paid status means the requester marked it paid.
Notifications between registered users
When you save an entry for a party whose mobile number matches a verified Hisab Book account, we can notify that account automatically. You can also send a dues reminder from the party's dues. The recipient sees your name, the last four digits of your verified mobile number, the entry amount, type and date or outstanding due. These notifications do not change the recipient's records or balance. Notes, receipt photos and other parties' records are not included. Recipients can turn off these alerts under Account → Party notifications.
If you enable phone notifications, we store a device push token linked to your sign-in session and use Google Firebase Cloud Messaging to deliver a generic alert. Financial details are only shown after opening the app's authenticated inbox. Signing out on the server removes the session's push registration. Notification permission can also be managed in your phone settings. See Google's privacy policy.
Support communications
If you contact us, we collect the information included in your message and any details reasonably needed to investigate and respond to your request.
3. How we collect information
We collect information:
- directly from you when you register, enter records, or contact support;
- automatically when the app communicates with our service;
- from payment providers when they report checkout or payment status; and
- from service providers that help us operate, secure, and diagnose the service.
This privacy policy page does not use advertising trackers or analytics cookies.
4. How we use information
We use information to:
- create and secure your account;
- save, synchronize, organize, and display your financial records;
- calculate balances and provide the features you request;
- process subscriptions and confirm payment status;
- provide support and respond to account or privacy requests;
- detect fraud, abuse, unauthorized access, and security incidents;
- monitor reliability, troubleshoot errors, and improve the service; and
- comply with applicable law and enforce our agreements.
Depending on where you live, these activities may rely on performance of our agreement with you, your consent, our legitimate interests in operating and securing Hisab, or compliance with legal obligations.
6. Data retention
We retain account and financial records while your account is active and for as long as reasonably necessary to provide the service. Authentication and security records are retained for their operational lifetime and for a limited period needed to protect the service. Payment, tax, dispute, and transaction records may be kept longer when required by law or legitimate accounting and fraud-prevention needs.
When information is no longer needed, we delete or anonymize it. Deleted information may remain temporarily in protected backups until those backups are replaced through our normal retention cycle.
7. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information. These include encrypted network connections, hashed server-side passwords, access controls, and protected authentication tokens. No storage or transmission system is completely secure, so we cannot guarantee absolute security.
Keep your device and login details secure, use a unique password, and contact us promptly if you suspect unauthorized access to your account.
8. Your choices and rights
Depending on applicable law, you may ask to access, correct, export, or delete your personal information, object to or restrict certain processing, or withdraw consent where processing is based on consent. You may also update certain information directly in the app.
To protect your information, we may need to verify your identity before completing a request. Some information may be retained where required by law, needed to complete a transaction, or necessary to prevent fraud and protect legal rights.
9. Account and data deletion
You can delete your Hisab account and associated data at any time from the Account screen in the app by verifying your mobile number or entering your current password and confirming deletion. You can also request deletion by email:
- Email us from the address registered to your account, when possible.
- Use the subject "Hisab account deletion request" and include the mobile number or email address associated with the account. Never send a password or OTP.
- Complete any reasonable identity-verification step we request to prevent an unauthorized deletion.
After verification, we aim to complete the deletion request within 30 days. We will delete or anonymize account and user-created financial data, except information that must be retained for legal, security, fraud-prevention, payment, tax, or dispute-resolution purposes. Residual copies may remain in protected backups until the normal backup cycle completes.
Deleting the mobile app does not by itself delete information stored in your account. Deleting an account also does not reverse completed payments or transactions.
10. Children's privacy
Hisab is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information without appropriate permission, contact us and we will take appropriate steps to delete it.
11. International processing
Our service providers may process information in countries other than the country where you live. Where required, we use appropriate contractual, technical, and organizational safeguards for these transfers.
12. Updates to this policy
We may update this policy when our practices, services, or legal obligations change. We will post the revised policy on this page and update the effective date. When required by law, we will provide additional notice in the app or ask for consent.
13. Contact us
For privacy questions, account deletion, data requests, or complaints, contact:
Hisab / TruMesha Privacy
Email:
office@aasthasolutions.com