Privacy Policy

1. What we collect

Nothing. We do not collect, receive, store, transmit, sell, rent, share, broker or cross-sell any information about you or your money.

Specifically, Lekhya does not collect:

• Your name, email address, phone number or any other identifier
• Your transactions, balances, budgets, goals, holdings or any financial figure
• Your bank messages or payment notifications
• Your location, contacts, photos or device identifiers
• Usage analytics, crash reports, advertising identifiers or behavioural data

There is no sign-up, no login and no profile. We have no database of users, because there is nothing for us to put in one. We could not identify you if we wanted to.

We will never use your information to market anything to you, and we will never send you promotional email or make a marketing call — we do not have your address or your phone number. Nothing is sold, shared or handed to any third party.

2. What stays on your device

Everything Lekhya knows lives in a private database on your phone, readable only by the app. That includes your transactions, categories, budgets, savings goals, accounts, investment and asset entries (including the account, UAN, PRAN, folio and bill numbers you choose to keep with them), shared-expense groups, bank-message templates, reminders and app settings. Those numbers are shown hidden by default.

You control all of it. From within the app you can export it as an encrypted .lkh backup or as a CSV file, restore it, edit it, or delete it. Uninstalling Lekhya removes it permanently.

Scheduled backups (Pro). If you turn them on, Lekhya writes an encrypted .lkh backup daily or weekly at the time you choose. On Android it goes to a folder on your phone. On iPhone it goes to a folder you pick — on the iPhone, or in your own iCloud Drive. If you pick an iCloud Drive folder, iOS (not Lekhya) syncs that file to your Apple account, under Apple's terms. The file is encrypted with your passphrase before it is written, so neither Apple nor we can read it. Lekhya itself still opens no network connection.

3. How you can verify this

You do not have to take our word for any of the above.

• Android: open Settings → Apps → Lekhya → Permissions. There is no internet or network permission listed, because the released app does not request one. An Android app without that permission is prevented by the operating system from opening any network connection.
• Both platforms: the app installs a network block as the very first thing it does at startup. Any attempt by any part of the code to open a network connection throws an error instead of connecting. This is covered by an automated test that must pass before any release is built.
• Offline test: turn on aeroplane mode. Lekhya works exactly the same, because it never needed a connection.

4. Permissions and why they exist

Lekhya asks for as little as possible, and every permission is optional except where noted. You can decline any of them and still use the app.

Lekhya does not request SMS, camera, photo library, microphone, location, contacts or calendar access. It cannot read your messages inbox — that permission is not in the app.

5. Third parties

The Lekhya app contains no advertising networks, no analytics services and no crash-reporting services. There is no Firebase, no Mixpanel, no Amplitude, no Crashlytics and no advertising SDK of any kind. Its fonts are bundled inside the app rather than downloaded, so even loading a screen contacts nobody.

There is exactly one exception, and it is not Lekhya reaching the internet:

Purchases. If you buy Lekhya Pro or leave a tip, the payment is handled entirely by Google Play or the Apple App Store, in their app, under their privacy policy. Lekhya never sees your card, your billing address or your identity — it only receives a yes-or-no answer about whether the purchase succeeded, and stores that answer on your device. Please refer to Google's Privacy Policy and Apple's Privacy Policy for how they handle payments.

Crash information, if the app ever fails, is written to a small local file on your device and is never transmitted. You can delete it by clearing the app's storage.

6. How your data is protected

• Encrypted backups. A .lkh backup is encrypted with AES-256-GCM using a key derived from a passphrase you choose, via PBKDF2 with 310,000 iterations. We cannot open your backup. Nobody can, without your passphrase.
• Bank message text is encrypted at rest using a key held in the Android Keystore or the iOS Keychain — hardware-backed storage that other apps cannot read.
• Card numbers are never stored in full. Any long run of digits is masked before it is saved, so at most the last four digits are kept. Lekhya never stores a CVV or a PIN, and never asks for one.
• Excluded from cloud backup. The app's database is explicitly excluded from Android's automatic cloud backup and from device-to-device transfer, so your finances cannot leak through a phone migration.
• App Lock can require your fingerprint, face or device PIN each time the app opens, and the app hides its contents in the task switcher.

7. Your rights

India's Digital Personal Data Protection Act, 2023 gives you rights over personal data a company holds about you — to access it, correct it, have it erased, and to complain.

Lekhya is designed so those rights are satisfied by architecture rather than by a request form: we hold no personal data about you, so there is nothing for us to disclose, correct, erase or transfer. You exercise every one of these rights directly, in the app, without asking anyone's permission and without waiting:

• Access — export everything as CSV or as a .lkh backup.
• Correction — edit or delete any entry at any time.
• Erasure — delete entries in the app, or uninstall it to remove everything.
• Portability — the CSV export opens in any spreadsheet application.

If you believe we hold data about you, please write to us (§10) and we will respond. We expect the answer to be that we do not, and we would like the chance to prove it.

8. Children

Lekhya is a personal finance tool intended for adults and is listed for users aged 18 and over. It is not directed at children, and since it collects no data, it collects no data from children either.

9. Changes to this policy

If this policy changes we will update the version and effective date at the top of this page and keep a record of what changed below. Because the no-collection guarantee is built into the app rather than into a promise, any change that weakened it would require shipping a different app — and we would say so plainly in the release notes rather than quietly editing this page.

10. Contact

Questions about this policy, or about privacy in Lekhya:

vinosmig@gmail.com

We aim to reply within five working days.

11. Website: feedback form and visit statistics

This section is about this website, not the app. The app still collects nothing.

Like most websites, this one uses Google Analytics to count visits and see which pages and links are used. It receives nothing from the app and none of your financial information.

The feedback form on the Lekhya home page asks for your name, your email address, whether it is feedback or a feature request, and your message. When you press Send, those details are passed through a Google Apps Script service run by us and emailed to the Lekhya team's inbox (a Google Group). We use them only to read and reply to your message. We do not add you to any list, share them with anyone, or use them for marketing. If the form cannot send, it offers to open your own email app instead; that path does not use Google's script.

To have a message deleted, write to the address above.

Lekhya · Made in India · Home · Terms · FAQs · Data safety · Security