Privacy policy

The short version

• No advertising, no data resale, no third-party trackers.
• This website collects nothing about you and sets no cookies.
• In the application, your records are yours and are shown to nobody except you — and, if you choose to join a household, its admins.
• Email is sent only when the service has to: no marketing.
• Ask, and your account and its records are deleted.

1. Who is responsible

Chanakya is designed, developed, owned and operated by Abhijith C M, an individual based in Bengaluru, Karnataka, India, who is the data controller for everything described here. Contact details are in section 10.

2. This website

These pages are static files. There is no analytics script, no advertising pixel, no social embed and no cookie. Your light or dark theme choice is stored in your own browser, and never leaves it. The hosting provider that serves the files keeps ordinary server logs, which may include your IP address, for security and abuse prevention.

3. What the application records

The application is not yet open to sign-ups. When it opens, it will hold three kinds of data, and nothing beyond them:

• Your account. Your name, your email address, your password — stored only as an Argon2id hash, never in a form that can be read back — your currency preference, your two-factor setup, and your recovery codes.
• Security records. The devices and sessions signed in to your account, and a security activity log: sign-ins, changes to your password or two-factor settings, and similar events, with their time, IP address and browser. This exists so that you can see and end unexpected access, and so that abuse can be investigated.
• The ledger you enter. Your expenses and income, their amounts, dates, categories and notes; your accounts, cards, wallets and UPI handles, and their balances; the contacts, businesses and household members an entry is attached to; and itemised bills with their line items, fees and taxes.

Chanakya is not connected to your bank. It never asks for net banking credentials, card numbers, CVVs or one-time passwords from your bank, and it does not import your statements automatically. Everything in the ledger is there because someone typed it in.

4. Why it is held, and what it is never used for

Your data is processed to run the service you asked for: to keep your records, to show you your own totals and reports, to keep your account secure, and to answer you when you ask for help. It is not used to profile you, is never sold or rented, is not shared with advertisers or data brokers, and is not used to train anything.

5. Who else can see it

• Household admins. If you join a household, its admins can see your entries, accounts and totals, and can record entries for you. A member who is not an admin sees only their own data. This is the whole point of a household — and it is opt-in, so if you do not want it, do not join one.
• People you record. Adding a contact, a business or a family member stores what you typed about them. Where they are real people, you are the one deciding to hold that data and are responsible for it. A household member who does not sign in has an internally generated, non-deliverable address so that no mail ever reaches a real inbox by accident.
• Infrastructure providers. Hosting, database and email delivery providers process data strictly on instruction, only to the extent needed to run the service. They are not permitted to use it for anything of their own.
• The owner. As the sole operator, the owner has the technical access needed to run and fix the service, and uses it only for that.
• Nobody else — unless the law compels disclosure, in which case it will be no wider than required.

6. Email

Email is transactional only: verifying an address, one-time codes, password resets and security notices such as a new sign-in. There is no newsletter, and you are not added to a mailing list by signing up. Should marketing email ever be introduced, it will be opt-in and every message will carry an unsubscribe link that works immediately.

Mail is sent through Amazon Simple Email Service. Bounces and spam complaints are recorded and acted on: an address that hard-bounces or complains is suppressed and not written to again. You can ask for your address to be suppressed at any time, in which case security-critical notices stop as well.

7. How it is protected

Traffic runs over HTTPS. Passwords are stored only as Argon2id hashes. Two-factor authentication, one-time recovery codes, session listing and revocation, and a security activity log are part of the product rather than an afterthought. Every request is checked against the household rules above on the server, so a rewritten request from a browser cannot reach another member's data. Requests are validated strictly: a payload in the wrong shape is rejected rather than guessed at.

Being honest about what is not in place yet: the ledger is stored on managed infrastructure without application-level encryption of individual fields, so it is protected by access control and by the database's own protections rather than by a key only you hold. End-to-end encryption is intended but not built, and this page will be updated when it is. No system is perfectly secure, and this one is still in development.

8. How long it is kept, and deletion

Your records are kept for as long as your account exists, because they are the point of the account. Delete an entry and it goes; ask for your account to be deleted and the account and its ledger are removed. Backups age out on their own cycle, so a deleted record can persist in a backup for a short period before it is overwritten. Where a security or abuse record must be kept longer for legal reasons, it is kept on its own and used for nothing else.

9. Your rights

You can see, correct and delete your data from inside the application, and you can ask the owner for a copy of everything held about you, for its correction, for its deletion, or for an explanation of how it is processed. Requests are answered as quickly as one person reasonably can, and within 30 days. If you are in a jurisdiction that gives you a right to complain to a data protection authority, that right is unaffected.

Chanakya is not intended for children. An adult household admin may record entries about a child in their family, and is responsible for that data.

10. Contact

For access, correction or deletion requests, or anything else on this page, reach the owner directly: Abhijith C M on LinkedIn. A dedicated contact address will be published on this page before the application opens to sign-ups.

11. Changes

This policy will change as the service does; the date at the top always shows the current version. A change that materially affects registered users will be notified by email to the address on the account before it takes effect.