Your records should be understandable. So should your privacy.
This policy explains the information used by the Bachat Kro app and this website, how it is shared, and how to contact us about it.
Who operates Bachat Kro
Bachat Kro is operated by Shahbaz Khan. For privacy questions and requests about your information, email krshahbaz@gmail.com.
Information we use
The information involved depends on the login method, features and permissions you use.
- Login and sessions. Google sign-in supplies your Google identity, name, email address and profile image. We use account and session records to keep you signed in. Session information can include IP address and user-agent information. Email or phone details are used when the corresponding sign-in method is enabled.
- Profiles and account books. Profile names, pictures, designations, business or home account details, team membership, roles, joining and leaving history, tenure, invitations and join decisions.
- Vendor connections. Vendor profiles, contact and UPI details, business connections, connection decisions and vendor payment requests.
- Expense and payment records. Amounts, quantities, prices, categories, descriptions, notes, payment methods, transaction references, approval and payment status, recurring schedules, and the activity associated with these records.
- Files and payment details. UPI IDs, QR content, receipts and profile or account pictures you choose to provide. Camera or photo-library access is used for features such as scanning a QR or adding an image.
- Notifications and diagnostics. Device push tokens, notification preferences, notification records, provider delivery results and push diagnostics are used to register your phone, send relevant alerts and investigate delivery problems.
- Support messages. If you email support, we receive the information you include in your message and attachments.
Why we use this information
We use information to authenticate users, operate account books and profiles, enforce permissions, review requests, record expenses and payments, store files, show activity history, deliver reminders and notifications, respond to support requests, and protect the service from misuse.
Bachat Kro does not transfer funds or verify a transaction with your bank. Payment status and references are recorded by users. The app does not require your bank password or UPI PIN.
Who can see your records
Sharing follows the profile, account membership and access permissions associated with a record. Owners and authorized managers can see and manage account activity. Teammates can see information allowed by their account role and the account’s access settings. Vendors can see their own connections and payment requests; a vendor connection does not give access to a business’s internal team or other expenses.
Team profile and membership information is shared within the relevant team. During a team change, the new owner may see the immediately previous business and tenure when reviewing the join request. The previous owner is notified of departure and can learn the new business after the new join is approved.
Leaving a team revokes current access but preserves the team’s expense records and membership history. Restricted recurring-payment records, including salary records, follow their access settings.
Services that help run the app
We use the following providers for the functions described here:
- Cloudflare: application API hosting, D1 database storage and private R2 file storage.
- Google: Google sign-in and Firebase Cloud Messaging for Android notification delivery.
- Expo: app updates and push-notification services.
- Resend, when email login is enabled: delivery of email sign-in codes.
These providers process information needed to perform their respective functions. An external payment app you choose to open handles the payment under its own terms and privacy practices.
We do not integrate advertising or analytics tools into the app or these website pages. Operating infrastructure can still process technical request and security information to deliver the service.
Device permissions and local storage
Camera, photo-library and notification permissions are optional and support the features that need them. You can manage these permissions in your phone’s settings. Denying a permission may prevent its associated feature from working.
The app uses Expo SecureStore for sign-in information on your device. Signing out disconnects that phone’s registered push token. Turning off notifications does not remove your in-app records.
How long information is kept
Sign-in codes expire after five minutes. Push diagnostics are purged after 30 days. These periods do not mean the associated account or expense records are automatically deleted.
There is no general automatic deletion period for server-side account, membership, expense or file records. Records remain available for the account’s continuing history. Leaving a team, signing out or uninstalling the app does not delete server-side data.
Access, correction and deletion requests
To request access to, correction of, or deletion of your information, email krshahbaz@gmail.com. Include the email or other login identifier you use and describe your request. Do not send a password, sign-in code, bank password or UPI PIN.
We may need to verify that the request comes from the account holder. Some records form part of a business or shared account book and involve other people. We will review the requested change in that context and explain what can be removed or retained. This policy does not promise automatic deletion of another account’s ledger history.
Updates to this policy
We may update this policy as the service changes. The date at the top identifies the current version. Contact support if anything is unclear.