Privacy policy

Chukta is made by Waseem Ahmad (OrchestrateIT on Google Play), Islamabad, Pakistan. Write to privacy@chukta.app about anything on this page.

Your account: your name, email, and — if you add them — phone number, photo and pronoun, and your default currency. When you sign in with Google, we receive your Google account's email, name and profile-photo address.

What you enter: expenses, splits, payments, fund contributions and comments, and which hisaab you belong to.

People you add: the name and optional phone number of anyone you track without the app, including a contact you pick from your phone.

Photos: your profile photo, hisaab photos and receipts, if you add them.

Everything lives on your device first and syncs encrypted to our servers so your other devices and your hisaab can see it.

Supabase stores the database, sign-in and photos. Google Firebase delivers notifications (Cloud Messaging), receives crash reports (Crashlytics) and performance timings (Performance Monitoring), and tells the app when an update is available (Remote Config); it identifies your installation of the app with a Firebase installation ID, and Performance Monitoring uses your IP address to tell which country a timing came from. Google ML Kit reads receipt text and QR codes on your phone; the images never leave it, but ML Kit sends Google information about the device and app, performance metrics and an identifier for your installation.

Cloudflare sits in front of our website and web app and forwards mail sent to our addresses. The company that hosts our web servers runs them for us. An email provider sends sign-in codes, the invitations you ask Chukta to send, and report notices to us. Our servers and Cloudflare keep request logs, including IP addresses, for a short time to run and protect the service.

These companies process data only to run Chukta for us. We do not sell or share personal data with anyone else.

No ads and no advertising identifiers. Contacts are never uploaded: when you pick someone from your phone's contacts, only that person's name and number are saved, in that hisaab.

If the phone app crashes, it sends a crash report to Google Firebase Crashlytics so we can fix it: the error and where in the app it happened, the app version, and the phone’s model and system version. The app also sends timings to Firebase Performance Monitoring — how long it takes to start and how long each request to our servers takes, with the address of the request (without its query or any account or hisaab id) and none of what was sent. Neither says whose phone or account it came from, and we never add your expenses or balances to either.

To send notifications, the phone app registers a push token with Firebase and stores it with your account. The web app does the same when you turn on browser notifications, and removes it when you turn them off or sign out. You can turn notifications off in your phone's settings. A notification carries what it announces (who added what, the amount, or a comment's text) and is delivered through Firebase Cloud Messaging.

A no-app member is a name and an optional phone number that the group tracks. If phone sign-in becomes available and that person joins with the same number, they can claim their history.

Receipt text recognition runs on your device. Profile and hisaab photos are stored at web addresses that cannot be guessed. Anyone who has the address can open the photo, so a member of your hisaab could pass it on. Receipts are private to the hisaab.

A pay link you send shows both names, the amount, the hisaab's name and what it covers to anyone who has the link. It can be paid until it is used, revoked or 30 days pass; after that, it still shows both names and the hisaab's name.

When you report a comment, we receive the comment's text, the reason you chose and any note you add, by email and in our database, so we can review it, and we record who reported it (never in the email). We delete a report, and the email about it, 12 months after we resolve it, or sooner if its hisaab is deleted.

Export your data at any time as a CSV, or as a printable statement you can save as a PDF. Delete your account in the app — Settings → Delete account and data — or ask by email; see Delete your account for what is deleted and what stays.

We keep your data while your account exists. Deleting your account removes your profile, devices and settings, and every hisaab only you use, at once. Hisaab you share keep your entries, comments and receipts under “Former member” (see Delete your account). Copies in our hosting provider's encrypted backups expire within 30 days. Firebase keeps crash reports for 90 days. Reports, and the emails about them, are kept for 12 months after they are resolved.

Data is encrypted in transit and at rest. Access to production is limited to the people who need it. Lookups through our internal console are logged, and the console cannot render an amount, a description, a member name, a receipt or a comment at all. When a comment is reported, the developer reads it in the report email and the database, only to review it.

Chukta is for adults. It is not directed at children, and we do not knowingly collect data from anyone under 18.

If this policy changes, we update this page and the date at the top.