Privacy Policy

Document

Privacy Policy

Applies to

The money web app at money.rasoi.io, and nothing else.

Operator

rasoi labs, a small team based in India.

Effective

28 August 2026

Contact

contact@rasoi.io

Read it against the plain-words version rather than instead of it: neither is a summary of the other, and where a clause here looks heavier than the promise there, it is the same fact written so that it can be relied on.

1. 1.Who this is, and how to reach us

   money is a household ledger at money.rasoi.io. It is built and run by rasoi labs, a small team based in India. rasoi labs is the data fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023, and the controller of it for readers to whom the UK or EU GDPR applies. Every question, request and complaint goes to contact@rasoi.io, which reaches us and nobody else.

2. 2.What the app collects

   Six things, and this is the whole of it:

   • Your account — the name, email address, account identifier and profile picture address Google returns when you sign in, and which palette you read in. The picture itself is never stored: what is held is the address Google gives for it, refreshed at each sign-in, and your browser draws it from there. Nothing else is asked for, and no password ever reaches this server.
   • Your household — its name, the people in it, each person's name, role and whether they earn, the month your financial year starts in, and the currency you keep. A member of a household is not necessarily a person who signs in. Where you write an email address against one of them so that they can, that address is held on their row until it is cleared, and clearing it withdraws the invitation.
   • Your figures — every transaction you import or enter, with its date, amount, accounts, category and the narration the bank wrote; the accounts, holdings, prices, liabilities and dated demands behind them; your budget's plan lines, goals, tax years and the summaries the screens are drawn from.
   • What you upload — the workbook or file itself, held encrypted while an import is being previewed and deleted automatically after 24 hours if it is never committed, plus a receipt for each committed import so that it can be undone.
   • What you publish — anything you post to the requests board: the request itself, your votes on other people's, and your replies, each carrying the first word of the name on your account. It is separated from the lines above because it is the only thing in this app shown to anybody outside your household, and it carries no figure and no household name.
   • Records the service keeps for itself — a signed session cookie, server logs, a record of sign-in attempts, counts of which features an account uses, and a count of which screens are opened. The sign-in log and the feature counts are written to the operator's own portal, and the screen counts to the operator's own analytics; both run on the same machine and both are described in clause 4. The screen counts alone carry no identifier for you or your household, and so are not tied to your account at all.

   The app asks for no bank or broker credentials, no card or account numbers for the purpose of connecting to anything, no phone number, no contacts, no device location and no advertising identifier, and it has no way to collect any of them. A free-text field will hold whatever you type into it; a spreadsheet you upload will be read in full, including any column you had forgotten was in it.

3. 3.Why it is processed, and on what basis

   Your account, your household and your figures are processed to provide the app you asked for — necessary for performance of the agreement between us, and a legitimate use under section 7 of the DPDP Act. Reading a Google Sheet you link, and valuing a live grant from public market data, are processed on your instruction, given by pasting the link or writing the formula and withdrawn by removing it. Server logs, the record of sign-in attempts and the feature counts are kept in the legitimate interest of running and securing the service, and to meet a legal obligation where one applies. None of it is processed for advertising, credit scoring, profiling, or any automated decision that produces a legal or similarly significant effect on you. **Nothing in this app gives financial advice**, and clause 3 of the Terms says so at length.

4. 4.Who it is given to

   It is never sold, never rented, never exchanged, and never used to build an advertising or credit profile. It is disclosed only to the services below, only to the extent named, and — for the ones marked optional — only if you have brought them into play:

   • Google, when you sign in — your name and email address, through Google's own sign-in page. The app requests the openid, email and profile scopes and no others: it cannot read your Drive, your Gmail or your contacts, and it never sees your password. The only thing any page of this app fetches from Google afterwards is your own profile picture, on the next line; there is no webfont and no other remote image of any kind (see app/security.py, whose Content-Security-Policy refuses every host but the one that serves that picture).
   • Google's image server (optional) — if your Google account has a profile picture, your browser fetches it from Google to draw the face in the corner. Only your browser makes that request, never this server; it discloses your IP address to Google and is sent with no referrer, so the page you were on is not disclosed with it. The image is never copied onto this server. An account without a picture makes no such request.
   • Google Sheets (optional) — if you paste the address of a spreadsheet to import from, this server asks Google's servers for it. It must be shared to anyone with the link; the app holds no credential of yours and cannot open a private sheet. Uploading a file instead sends nothing to anybody.
   • Yahoo Finance (optional) — if a budget line carries a live RSU formula, one fixed endpoint is asked for two public figures, the USD/INR rate and one listed share price. Nothing identifying you, your household, your holding or your answer is sent with the request.
   • AMFI (optional) — if you hold a mutual fund, one fixed endpoint is fetched once a day for the public file of every scheme's net asset value, and only the schemes you hold are kept from it. The request carries nothing at all: it is the same file served identically to every reader, so which funds you hold is not disclosed by asking. Hold none and it is never fetched.
   • IBJA (optional) — if you hold gold, one fixed page is fetched once a day for the day's published bullion rates, and one figure is kept from it: the 999 rate per gram, which each item's carat is applied to here. The request carries nothing at all: it is the same page served identically to every reader, so what jewellery you hold is not disclosed by asking. Hold none and it is never fetched.
   • Anthropic (optional) — if you press *ask about the rows your own rows couldn't settle* on the review screen, that many statement rows are sent to Anthropic's API to be labelled: the bank's own wording of each one, its date and its amount, and the list of category names you already use, which is the only thing the answer may contain. Nothing identifying you or your household goes with it — no name, no address, no account number, no balance, no total — and no row you have already labelled is ever included. Anthropic does not train on it. Every other row is categorised here, on this server, against your own history, with nothing sent anywhere; the button is the whole of it, and a deployment can be run with no model configured at all, in which case it is not drawn.
   • Our own mail server (optional) — if you write an email address against somebody in your household, one invitation is sent to that address through the mailbox this domain already has: the address you typed, the household's name, the name you are known by in it, and a link. No figure and nothing else about the household goes with it, no marketing service handles it, and no further message is ever sent to anybody. Clearing the address withdraws the invitation and stops the link working.
   • The operator's own portal, on the same machine — sign-in attempts (address, outcome, IP address, browser) and counts of which features an account uses. It is a separate service run by the same person on the same server, over the loopback interface, deliberately out of this app's own reach so that a compromise here cannot rewrite the record of it. No third party receives any of it, and it carries no figure of yours.
   • The operator's own analytics, on the same machine — the name of the screen you moved to and the fact that an import finished, together with what any web server is told (your IP address, your browser and the page you came from). It is self-hosted software at stats.rasoi.io, run by the same person on the same server; it sets no cookie, it is sent no figure, no category, no account and no identifier of you or your household, and nothing it records is passed to anybody.
   • Nobody else. There is no third-party analytics, no advertising network, no error-reporting service in the browser, no mailing list, no payment processor and no aggregator. The list above is the whole of what leaves this app.

   Where the law requires it, or to establish or defend a legal claim, we may disclose what we hold to a court or a competent authority. Nothing has ever been requested.

5. 5.Where it is kept

   On a single virtual server rented in Europe, running MongoDB, with hourly encrypted backups. That is a transfer outside India for the purposes of the DPDP Act and outside the EEA for the purposes of the GDPR; where the GDPR applies to you it rests on Article 49(1)(b), the transfer being necessary to perform the agreement you asked us to perform. If you would rather it did not leave your machine at all, write to contact@rasoi.io: this app is open source and running your own copy is a supported answer.

6. 6.How it is protected

   Sign-in is Google's, so no password is stored here. The session is a signed cookie, HTTP-only and same-site. Every request is bounded by your household before it reaches the database. The narration on every transaction and the whole of any workbook you upload are encrypted with a key held outside the database, and the app refuses to start without that key rather than quietly writing them in the clear. Traffic is HTTPS only and the browser is sent a Content-Security-Policy with no inline script and no third-party origin in it. No system is perfect and none of this is a guarantee; it is what is actually done.

7. 7.How long it is kept

   Only as long as it is doing something:

   • Your household's figures — until you delete them or delete the household. There is no inactivity sweep and nothing expires on its own.
   • An uncommitted import: deleted 24 hours after it was parsed, by the database itself, whether or not anybody comes back to it.
   • A committed import's receipt: kept with your household's figures, and for 730 days it can also be undone.
   • The session cookie — 30 days, then you sign in again.
   • Feature-use counts — 180 days on the operator's portal, then deleted automatically.
   • Screen counts — kept on the operator's own analytics, with nothing in them that says which account or which household. Its record of a visitor is a one-way hash that is re-salted daily, so a reader today and the same reader tomorrow are two readers to it. There is nothing here to attach to you, which is why there is no expiry on it and nothing to delete when a household is deleted.
   • Sign-in attempts — kept as a security record on the operator's portal. This app cannot delete them, which is the point of keeping them there, and it is the one thing that survives deleting your household.
   • Backups — an encrypted hourly copy on separate storage, pruned to 120 hourly, 7 daily, 4 weekly and 6 monthly copies. So a household deleted today can still exist in a backup for up to about six months, after which the rotation removes the last copy.

8. 8.What you can make us do

   Under the DPDP Act you may ask for a summary of the personal data being processed and who it has been shared with; ask for it to be corrected, completed or updated; ask for it to be erased; nominate somebody to exercise these rights if you die or become incapable; and complain to the Data Protection Board of India. Where the GDPR applies you additionally have the rights of access, rectification, erasure, restriction, portability and objection, and may complain to your own supervisory authority. Where the CCPA applies you may know, delete, correct and opt out of sale or sharing — there is no sale or sharing to opt out of, and there never has been.

   Delete everything, in the app, does the erasure without asking anybody. For anything else, write to contact@rasoi.io. There is no charge and no form; a person answers, normally within a week and at the latest within thirty days.

9. 9.Cookies

   One: a signed session cookie that remembers you are signed in and expires on its own after 30 days. It is not an advertising cookie and it is not shared. There are no analytics cookies, no advertising cookies and no cross-site trackers — which is why this app has no cookie banner: there is nothing to consent to. The one script loaded from another address is the screen counter named in clause 4, which is our own, on our own server, and sets no cookie of any kind; there is no third-party script besides it. The browser's own local storage holds which palette you chose and whether you were signed in last time, so that a cold load is not a flash of the wrong colours; neither leaves your machine.

10. 10.Children

    The app is not directed at children and no account may be created by anybody under 18. A household may name a child as a member — school fees have to go somewhere — and that is a line of the account holder's own budget rather than an account: it has no sign-in, no email address and no session, and nothing about it is processed beyond the figure the household wrote.

11. 11.Changes

    This page is versioned in the repository the app is built from, so what changed and when is a matter of record. The date at the top moves when the substance does. A change that materially reduces the protection described here will be said out loud in the app rather than quietly published.

12. 12.Grievances

    The operator is also the grievance officer for the purposes of section 13 of the DPDP Act and can be reached at contact@rasoi.io. A grievance is acknowledged within 72 hours and answered within thirty days. If the answer does not satisfy you, the Data Protection Board of India is the next step, and nothing here is a condition of going to it.

Something here unclear, or something you want done? Write to contact@rasoi.io — a person reads it, and it is one of the people who wrote this page.