Privacy Policy.

1. What we collect

We collect what Monidhi needs to give you an account, keep your journal in sync across web and mobile, and keep the service secure:

• Account basics: the name and email you sign up with, and a mobile number if you choose to add one. We contact you by email only; nothing is sent to the number. We also record when you joined and when you last used Monidhi.
• Sign-in: you sign in with a six-digit code we email you, a passkey in the web app, or a key your phone keeps behind Face ID, Touch ID or your fingerprint. Your phone checks your face or fingerprint itself; Monidhi receives only the key it unlocks. We store a one-way hash of each emailed code and phone key, and only the public half of a passkey. If you choose to set a password under Security in Settings, we store it only as a salted scrypt hash, never the password itself, and you can remove it and go back to emailed codes at any time. We also record wrong password attempts against an email address, so we can stop someone guessing. If you continue with Google or Apple, we keep the ID that provider uses for you, the email address it confirmed (for Apple, possibly a private relay address) and when you last used it. For Apple we also keep a token, locked with a key only our server holds, that lets us disconnect Monidhi from your Apple ID when you remove it or delete your account. Your Google or Apple password is never shared with us.
• Your journal: the accounts, cards, card EMIs, transactions, categories, budgets, goals, trips, loans, recurring items, balances, investments, assets and planned purchases you add or confirm, and your settings. If you have Monidhi value an investment or asset for you, we also keep the details it needs (such as a fund's scheme code and units, a share's ticker, a deposit's rate and dates, or a car's price and purchase date) and each value it works out.
• People you lend to or borrow from: the name you give each person in Lend & Borrow, and their email address if you add one. Section 4 explains how an email address is used.
• Bank messages: the parsed fields of each bank SMS or email you send us. Section 3 explains how this works.
• Devices: a label for each phone or browser you connect for sign-in, SMS capture or push notifications (for example "iPhone", your Android phone's model name, or "Chrome on macOS"), and when it was last used. If you turn on push notifications, we also store the push token that Firebase Cloud Messaging gives that phone or browser.
• Support requests: what you write to us under Help & support, and our replies.
• IP address: our server reads the IP address of each request to limit how many requests one address can make, and to check the admin console's allow-list for staff. It is used only in the server's memory and is not written to our database or logs. Cloudflare and DigitalOcean, which carry traffic to our server, also see it (see section 4).

We do not collect your contacts, your location or your browsing history, and Monidhi never reads your SMS inbox. The website and the apps have no advertising, analytics or crash-reporting tools.

2. Where it lives

Our API runs on DigitalOcean App Platform in Singapore. Your journal is stored in a Postgres database run by Neon in Singapore, and our operational logs are kept in MongoDB Atlas in Mumbai, India. If you live elsewhere, your data is processed in Singapore and India, and the providers in section 4 may process it in other countries.

Connections to Monidhi use HTTPS (TLS), and Neon and MongoDB Atlas apply their own storage encryption to the disks that hold our databases. Neither stops Monidhi's own servers from reading your journal: they read it to show it to you, sync it between your devices, value the investments and assets you ask it to, send the reminders and alerts you turn on, and build your exports.

The apps show your journal only to your signed-in account. Our staff tools show your name, email, masked mobile number, when you joined and last used Monidhi, and what you have set up by name, type and date: your accounts and cards (with their last four digits), loans, goals, trips, recurring items, the people you lend to or borrow from, and your entries with their dates, payees and categories. They never show an amount, a balance, a credit limit, a value or anything worked out from one, and the server leaves those out of what it sends the staff console rather than hiding them on screen. Support staff read the requests you send us. Each time a staff member opens your record it is written to the audit log, as their other actions are. People who operate Monidhi's servers can technically reach the database, so we keep that access narrow.

On your phone, the app keeps your sign-in session, the key behind Face ID or fingerprint sign-in (in the iOS Keychain or Android Keystore), a snapshot of your net worth, account balances and trips for the home-screen widgets, and any bank SMS still waiting to upload.

3. SMS & email parsing

Monidhi can fill in entries from your bank SMS and bank emails. You turn each route on yourself, and nothing is filed until you confirm it. Every message is read on our server, and only the parsed fields are stored, never the text. Specifically:

• Android: if you turn on SMS capture, the app uses Android's permission to receive new SMS. It has no permission to read your inbox. When an SMS arrives, the phone skips it unless it looks like a bank transaction, so one-time passwords and promotional messages are left alone. For a bank message, the app sends the text and sender to our server. Until the upload succeeds, Android holds the message on your phone.
• iPhone: iOS doesn't let apps read SMS. If you build the Shortcuts automation from our guide, it sends matching messages from your bank to our server in the same way, and the app holds a message on your phone until it uploads.
• Email: you can get a private forwarding address at in.monidhi.com. Cloudflare Email Routing receives mail sent to it, and a Cloudflare Worker passes the message to our server. If you set up forwarding from Gmail, we also store the confirmation code Gmail sends and the address that asked for forwarding, so the app can show them to you.
• A message you paste into the app is read the same way.
• What we keep: the server reads each message in memory and stores only the amount, merchant, sender and time, plus a fingerprint: a keyed one-way hash of the text, used to spot the same message arriving twice. The fingerprint can't be turned back into the text. Our logs record what happened to a message, never its text.
• You choose which senders are trusted in Parser settings, and you can turn SMS capture or email forwarding off at any time without losing past entries.

4. What we share

We share information only with the service providers that run Monidhi, and when the law requires it:

• Hosting and storage: DigitalOcean (our API) and Neon (the Postgres database that holds your journal), both in Singapore, and MongoDB Atlas (operational logs) in Mumbai.
• Sentry: tracks errors on our server. When a request fails, Sentry receives the error message, the request's path and method and an internal request ID, never your IP address, name or email.
• Cloudflare: hosts monidhi.com and the web app at app.monidhi.com, and runs the DNS and the proxy in front of our API, which every app talks to, so it sees request details including your IP address. It also receives mail sent to your in.monidhi.com forwarding address and to our support@, privacy@ and grievance@ addresses.
• SendGrid: sends our emails, so it handles your email address and the contents of each email: sign-in codes, invitations (including one you ask us to send to someone in Lend & Borrow, which goes to their address and gives your name), notices that support has replied (with your request's subject), notices that a password was added, changed or removed, the confirmation that your account was deleted, and, unless you turn it off, the Monday weekly summary (your week's spending and income totals, number of entries and top category).
• Google: Firebase Cloud Messaging delivers push notifications. When you turn them on for a phone or browser, Firebase issues it a push token, and for each notification we send Google the token with the notification's title and body (for example "Dining budget exceeded" and "₹ 6,200 of ₹ 6,000 spent"). If you sign in with Google, Google tells us your name, your email address and the ID it uses for you. Separately, the web app loads its fonts from Google Fonts, so Google sees your IP address when the web app opens. On iPhone, the app's network check may request clients3.google.com/generate_204, with no account data, to tell "you're offline" from "our server is down".
• Apple: if you sign in with Apple, Apple tells us the ID it uses for you and your email address, or a private relay address if you choose Hide My Email, and your name the first time. Our emails to a relay address pass through Apple's relay. When you remove Apple sign-in or delete your account, we ask Apple to revoke Monidhi's access.
• Exchange rates: our server fetches daily rates from open.er-api.com. Only currency codes are sent, from our server, never from your device.
• Prices for automatic valuation: our server fetches mutual fund NAVs from AMFI, share and ETF prices from Yahoo Finance, crypto prices from CoinGecko and the gold rate from goldprice.org. Yahoo Finance and CoinGecko receive the tickers and coin IDs to price, and the words you type when you search them for a holding. AMFI and goldprice.org receive nothing but the request. These calls come from our server, never from your device, and carry nothing that identifies you.
• Other Monidhi customers: if another customer adds your email address to someone in their Lend & Borrow, and you have a Monidhi account with that address, they see the name on your account in place of the one they typed. Nothing else about you is shown to them. In the same way, if you add the email of someone who has an account, you see their name. Neither of you sees the other's entries or balances.
• App stores: Apple's App Store and Google Play distribute the mobile apps, under their own privacy policies.
• Legal: a valid Indian court order or a comparable request from another jurisdiction where we operate. We will challenge overbroad requests.
• Aggregated & anonymized: we may publish high-level usage statistics ("X% of users use recurring schedules"), never tied to any individual.

Each provider handles data only to provide its service to Monidhi, under its own data-processing terms. We do not sell or rent personal information. Ever. Even if we changed hands, this commitment binds any acquirer.

5. How long we keep it

We keep your account and journal for as long as you have an account. In detail:

• Account and journal: until you delete your account. That includes parsed bank messages you dismissed, your notifications and your support requests.
• Push tokens: until you turn notifications off or remove that phone or browser in Settings, Firebase tells us the token no longer works, or you delete your account.
• Google and Apple sign-in: the link stays until you remove it in Settings or delete your account. Removing Apple, or deleting the account, also asks Apple to revoke Monidhi.
• Sign-in records: an emailed code works for 10 minutes. We keep a record of each code (the email address, a hash of the code and when it was sent) and of each wrong password attempt. We delete these records a day after they expire, and any still left for your email address when you delete your account.
• Operational logs: when a request fails on our server, we log the error message and the request's method, path and status code. The path is the address of the request and can include a record's ID or a search term; the entry has no IP address, name or email. When we send an email, we log it with your address masked (for example p***@gmail.com). The error log is kept for 90 days, and the same error record is also sent to Sentry (see section 4). The email log is kept until we delete it.
• Staff audit log: staff actions, such as suspending an account, scheduling a deletion or replying to a support request, are recorded with the staff member's name and account (their staff ID and email) and a message that can include your name and account ID. The audit log can't be edited and is kept with no end date, including after your account is deleted, as our record of what staff did.
• Emails you send us: messages to support@, privacy@ or grievance@ stay in our mailbox until we delete them.
• Backups: our database provider keeps point-in-time recovery copies that expire within 30 days, so deleted data is gone from them within 30 days.

6. Your rights

Wherever you are, you can:

• Export your transactions as a CSV file (date, merchant, amount, currency, amount in rupees, account, category, the person for a Lend & Borrow entry, items, source and note) from Settings → Data export in the web app, or Insights → Export in the mobile app. The export covers transactions only; it does not include your goals, recurring items, trips, loans, card EMIs, balances, investments or assets. To ask for anything else we hold about you, write to privacy@monidhi.com.
• Correct your name and mobile number in Settings → Profile, and your entries wherever they appear. To change the email on your account, write to privacy@monidhi.com.
• Switch off SMS capture, email forwarding, push notifications and the weekly summary, each from its own setting.
• Delete your account yourself: in the web app under Settings → Profile, or in the mobile app from your profile. You confirm it with a code we email you; every signed-in device is signed out and the app clears its data from that phone. Your account and everything in it is then deleted 7 days later, for good. Signing in before then and choosing Keep my account cancels it. If you can't sign in, email privacy@monidhi.com from the address on your account. We suspend the account straight away and delete it 30 days later, so a mistaken request can still be cancelled. Our account deletion page has the steps and lists what is kept afterwards.
• Object to specific processing. If we can't honor it, we'll tell you why.

7. Contact

For privacy questions, write to privacy@monidhi.com. We answer within 5 working days. For India-specific grievances, you may also reach our Grievance Officer at grievance@monidhi.com.