Privacy

Last updated 28 September 2026

Almostry helps you understand your own money. This page explains, in plain words, what we keep, why, where, for how long, and how you stay in control. It follows India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Financial information is sensitive personal data under those rules, and we treat it that way.

Who we are

Email hello@almostry.com; privacy and grievances: privacy@almostry.com.

What we keep

• Your account: name, email address, and your password, stored only as a one-way hash that no one, including us, can read. The date and time you agreed to these terms.
• What you enter: accounts and balances, cards and loans, investments, transactions, commitments and goals, friends you add (a name and, if you choose, a phone number), receipt photos, your UPI ID and your settings. For your own records we also keep each transaction’s edit history (what changed, from what, when) and your closed months’ totals.
• Messages you send us: feedback you write in the app, kept with your account so we can follow up, and a copy emailed to our support inbox.
• Household: who is in your household with you, and the email address of anyone you invite until they accept or decline, or you cancel.
• Usage totals: how many times each feature was used each day, counted in totals that aren’t linked to you, and the date you last opened the app, so we can count how many people use Almostry. No analytics trackers.
• Security details: the IP address and browser of each signed-in session, which devices you’ve confirmed (as a one-way hash), and short-lived counters of sign-in attempts, so we can stop password guessing and spot a sign-in from somewhere new. Passkeys store only a public key; your fingerprint or face never leaves your device.

What we never ask for

• Bank or card passwords, net-banking logins, full card numbers, CVVs or UPI PINs. At most you add the last 4 digits of an account yourself.
• Your bank statements. A statement PDF you import is read on your device; the file, and its password if it has one, never reach our server. Only the transactions you choose to add are saved.
• Access to your SMS inbox or contacts. A bank SMS you paste is read on your phone. A payment receipt or bank SMS you share into Almostry, or send from an iPhone Shortcut or automation app you set up, is read on our server to make the transaction: we keep the amount, payee, account and time, never the text itself. A receipt image is never read or kept.

Why we use it, and on what basis

Only to run Almostry for you: to calculate what’s truly yours to spend, show what’s ahead, send the codes, reminders and summaries you get, show your household what you choose to share, answer your feedback, and keep your account secure. Feature totals, which aren’t linked to you, tell us what to improve. You give consent when you create your account; you can withdraw it at any time by deleting your account. We also use security details to protect the service and meet legal duties, which the DPDP Act allows.

We don’t sell or rent your data, show ads, use advertising or analytics trackers, or use your data to offer you loans, cards or investments.

Who helps us run it

• Vercel hosts the app; our servers run in Singapore. Vercel may keep short-lived request logs, including IP addresses.
• Neon stores the database.
• Resend sends our emails (codes, reminders, summaries, household invitations, and copies of your feedback to our support inbox).
• Your browser’s push service (Google, Apple or Mozilla) delivers notifications if you turn them on.

They process data only on our instructions, to provide these services to us. Your data is stored and processed outside India, which the DPDP Act permits except for countries the Government restricts. We share data with anyone else only if the law requires it, such as a valid order from a court or authority.

How we protect it

Everything travels over HTTPS. Data is encrypted at rest by our providers. Passwords, sign-in codes, device IDs and quick-capture keys are stored only as one-way hashes. Sign-up and code requests include a small puzzle your browser solves, to stop bots; it runs on our own server, involves no other company and sets no cookie. Sign-in attempts are rate-limited, a new device needs an emailed code, and every request is checked so you can only ever reach your own data. If a breach ever affects your data, we will tell you and the Data Protection Board of India as the law requires.

How long we keep it

• Your account and what you enter: until you delete your account.
• Deleted transactions: 30 days in Recently deleted, then removed for good (or at once, if you choose “Delete now”).
• Sign-in codes: a few minutes. Sessions: until you sign out, or after a week without use. Sign-in attempt counters: minutes.
• Feedback: until you delete your account, or sooner if you ask. Household invitations: until accepted, declined or cancelled. Feature totals: kept, as they aren’t about anyone.
• Backups: our database provider keeps short-lived backups for recovery, which expire on their own within days.

Cookies

Only the cookies needed to sign you in and keep your account secure; no analytics or advertising cookies. The full list is on the Cookies page.

Your rights

• See and take your data: from Import & reconcile, download your transactions as a CSV, or everything we hold about you (accounts, commitments, friends, edit history, monthly closes, receipts) as one JSON file.
• Correct it: edit anything in the app. Edits are kept as history on the transaction, visible only to you.
• Delete a transaction: it moves to Recently deleted, where you can restore it for 30 days. After that, or at once if you choose “Delete now”, it is removed for good, with its history.
• Delete everything, and withdraw consent: Settings → Delete my account removes your account and everything in it at once, including Recently deleted, edit history and closed months.
• Stop emails: weekly and monthly summaries can each be turned off in Settings; daily reminders follow the settings you choose.
• Nominate someone to exercise these rights if you die or can’t, and ask about anything we hold: write to privacy@almostry.com.
• Complain: write to our grievance contact below first. If you’re not satisfied, you can complain to the Data Protection Board of India.

Household

If you join a household, the people in it see only what you tick as shared: those accounts’ balances, and the amounts and dates of those bills, income and goals. Never your transactions, notes or anything you haven’t ticked. You can change what you share, or leave, at any time from Household, and sharing stops at once. An invitation is emailed to the address you enter, so please invite only people who’d want it.

Friends you add

A friend’s name and phone number are used only for your own splits, and the number only to open WhatsApp on your device with a message you choose to send. Please add a number only if your friend is happy for you to. A friend who wants their details removed can write to privacy@almostry.com.

Children

Almostry is for people aged 18 and over. If we learn an account belongs to someone younger, we delete it.

Grievances and changes

Questions, requests or complaints: our grievance contact, privacy@almostry.com. We aim to reply within 7 days, and always within 30. If this policy changes in a way that matters, we’ll email you before the change applies.