What this app stores, who can read it, and how to make it stop existing. It is a ledger, so the answer matters more here than in most apps.
Not a net-banking password, not a card number, not a broker's credentials, not a read-only aggregator token. This app has no field for any of them and no code that could use one. What it reads is the file you already download or the spreadsheet you already keep.
Not to advertisers, not to lenders, not to a credit bureau, not to anybody building a model of what households spend. It isn't a product this app has.
Every document carries the household it belongs to, and every query is filtered by it — including lookups by id. One household cannot reach another's, not even by accident. The one exception is the requests board, which is a page you post to on purpose: what you write there is meant to be read, and it is the only place in this app where anything of yours is.
The narration on a row — “CROMA GURUGRAM”, a UPI handle, somebody's name against a loan — is the part that says where your money goes and who you pay, and it is sealed with a key before it reaches the database, along with the whole workbook you upload. Amounts and dates are not, because a sealed number cannot be added up; the reasoning is written out in full in app/services/crypto.py.
Categories are worked out from the rows you have labelled yourself, on this server, with nothing sent anywhere. Where your own history recognises nothing, the review screen offers to ask a model — and only then, only about the rows it names, and only the bank's own wording of them with your category names to choose from. Never an account number, never a balance, never anybody's name from your family list, and never a row you have already labelled. What comes back is a suggestion beside the row; nothing is written until you say so.
Nothing you upload, type or categorise is used to train a model — not ours, not anybody's — and nothing here is sold or used to build another product.
Delete everything erases the household outright: every transaction, every holding, every loan, every plan line. No soft delete, no grace period, no email asking you to reconsider.
When you close a tab, your browser sends four numbers to our machine: how long the page took to appear, how long it took to respond when you tapped, how much it moved while loading, and when this app first drew a screen. They are added to a running count and then thrown away. There is no cookie, no account number, no address and nothing kept about your visit — only four totals that tell us the app got slower, never who it was slow for. Nothing about your ledger is in them.
The Google account you signed in with: your email address, your name, the identifier Google returns, and the address of your profile picture — the address, not the picture, which stays on Google's servers and is never copied here. Nothing else about you is asked for, and the app never sees your password.
Its name, the people in it, what each of them is called and what their role is, whether they earn, which month your financial year starts in and which currency you keep. A child with school fees against her name is a member of the household and has no sign-in of her own. If you write an email address against somebody so they can join, that address is kept on their row until you clear it — which is also how you take the invitation back.
Every transaction you import or type: its date, its amount, the two accounts it moved between, the category you filed it under, and the words the bank wrote about it. Alongside it, what you own and what you owe — accounts, holdings, prices, loans, the demands ahead of them — the budget's plan lines, your goals, the tax years, and the summaries the screens read.
The workbook itself, sealed, kept only while the import is in progress: step 5 of setting up shows a preview with nothing saved, and the parse behind it has to live somewhere between two requests. An import you walk away from deletes itself a day later without anybody doing anything. A committed import keeps a receipt — what came from where, and how much — so that it can be thrown away again for thirty days.
A request, a vote or a reply on the requests board is public to everybody signed in: it carries your first name and the words you wrote, and never your email address, never your household's name, and never a figure from it. The board has no idea which household you are in. Withdraw is how you take a post back.
A signed session cookie, server logs, and — on our own machine, where this app has no credentials to reach them — a record of sign-in attempts and counts of which parts of the app an account uses. Never a figure, never a narration, never a category.
Your name and email address, so the app knows whose household this is. Sign-in happens on Google's own page; your password never reaches this server, and the app asks Google for nothing but who you are — no Drive, no Gmail, no contacts.
Pasting the address of a Google Sheet asks Google's servers for that spreadsheet, from this server rather than from your browser. It has to be one you have shared to “anyone with the link” — the app holds no Google credentials of yours and cannot open a private one. Import a file from your own machine instead and nothing is asked of anybody.
One fixed address is asked for two public numbers — the dollar-rupee rate and one listed share price — so that a grant can be valued at today's figures rather than last year's. Nothing about your household goes with the request: not who asked, not how many shares, not the answer. A budget with no live formula in it asks nothing.
Writing an email address against a person in your household sends one message to that address: who added them, what the household is called, and a link. It goes out from our own mailbox on rasoi.io rather than through a marketing service, it carries no figure of yours, and nothing else is ever emailed to anybody — no digest, no reminder, no receipt. Invite nobody and no mail is sent at all.
The face in the corner of this app is an address on Google's own servers rather than a copy kept here, so your browser fetches it from them: they see your IP address, and the request carries no referrer, so they are not told which screen of your money you were on when it was drawn. An account with no picture on it makes no such request, and your initial is drawn instead — as it is anyway until the picture arrives, and if it never does.
The Association of Mutual Funds in India publishes one plain text file of every scheme's price, once a business evening, for anybody who asks. This server fetches that whole file and keeps only the funds you hold, so a fund is worth today's figure rather than the one you last typed. Nothing goes with the request — not which funds, not how many units, not who you are — because it is the same file everybody gets. Hold no fund with a scheme code on it and nothing is fetched at all.
The India Bullion and Jewellers Association publishes the day's gold rate on its own page, on business days, for anybody who asks. This server reads that page once a day and keeps one number from it — the rate for a gram of 999 gold — and each piece you have recorded a carat for is worked out from it, so your jewellery is worth today's rate rather than the one you last typed. Nothing goes with the request — not your grams, not your carats, not who you are — because it is the same page everybody gets. Record no gold and nothing is fetched at all.
Every attempt to sign in — the address, whether it worked, the browser and the address it came from — is written to the portal that runs these apps, on the same machine. It is how an account that somebody else is trying to get into is noticeable, it is the one thing that outlives deleting your household, and no third party is involved in any of it.
When a household finishes setting up, this app records that it happened — the kind of thing and the account it belongs to, and a count. Never a figure, never a narration, never a category, never an account name. It stays on our own server for 180 days and then deletes itself. It is how we know which screens are worth keeping and which nobody opens.
Which of the six screens you opened, and whether an import finished — counted by software running on the same server as this app, not by Google and not by anybody who sells advertising. It is the word “Budget”, not a budget. Never a figure, never a category, never an account, never a payee, and no identifier for you or your household, so a screen it counts is one somebody opened rather than one you opened. It sets no cookie, and if your browser blocks it the app is unchanged.
One: a signed session that remembers you're signed in and expires on its own. No analytics cookies, no advertising cookies, no cross-site trackers — which is why there's no cookie banner in front of this page. There is nothing to consent to. The screen counter above sets none either: it counts visits without them.
Settings deletes the household outright: every transaction in every year, along with the accounts, holdings, loans, plan lines and goals. Delete means delete. Nothing is kept and nothing can bring it back — with two exceptions, named because a promise with a quiet hole in it is worse than a smaller promise. The first is the record of sign-in attempts, which is a security log held where this app has no credentials to reach it. The second is a backup, for up to about six months, until the rotation prunes the last copy.
Your sign-in itself, and anything you posted to the requests board. A Google identity is not a household document — the same person may sign in tomorrow and start over — and a request you filed is yours rather than your household's, so Withdraw on the board is how you take one back. To remove the account itself, write to contact@rasoi.io.
Something here unclear, or something you'd like removed? Write to contact@rasoi.io — a person reads it.