Privacy Policy

🛡️ The Short Version Your financial data is private, encrypted, and never sold or shared with anyone. TotalRupee is a self-hosted personal finance tool — your data exists solely to serve you.

1. Information We Collect 2. How We Use Your Information 3. Data Storage & Security 4. Data Sharing 5. Your Rights 6. Cookies & Sessions 7. Data Retention 8. Children's Privacy 9. Changes to This Policy 10. Contact Us

📋

1. Information We Collect

We collect only the information necessary to provide TotalRupee's personal finance management features. We do not collect any information beyond what you explicitly provide.

Data Type	What We Collect	Why
Account Info	Full name, email, mobile number, username	Account creation & authentication
Financial Data	Expenses, income, EMIs, loans, credit cards	Core app functionality
Bank & UPI	Bank name, account type, last 4 digits, UPI app name	Payment categorisation
Usage Data	Login timestamps, session data	Security monitoring

What we do NOT collect We never collect full bank account numbers, full card numbers, passwords in plain text, biometric data, or any government ID numbers.

🎯

2. How We Use Your Information

Your information is used exclusively to operate TotalRupee's features for your benefit. We do not use your data for advertising, profiling, or any commercial purpose beyond the service itself.

To provide expense tracking, income management, and financial analytics
To authenticate your identity and maintain session security
To send account-related emails such as password reset links
To display your financial data on the dashboard and reports
To detect and prevent unauthorised access or fraudulent activity
To improve the application based on usage patterns (anonymised)

⚠️ We will never Use your financial data to target advertisements, sell insights to third parties, or share your data with marketing companies under any circumstances.

🔐

3. Data Storage & Security

TotalRupee takes security seriously. Your data is stored on GoDaddy's secure servers in a MySQL database with multiple layers of protection.

AES-256-CBC encryption — Sensitive fields (name, mobile, card details, bank last4, UPI handles) are encrypted at rest
bcrypt password hashing — Passwords are never stored in plain text
Prepared statements — All database queries use parameterised statements to prevent SQL injection
CSRF protection — Every form submission is validated with a unique token
HTTPS enforced — All data in transit is encrypted via TLS
Session isolation — Every data query is scoped to your user ID
Login lockout — Accounts are temporarily locked after repeated failed login attempts
Security headers — CSP, HSTS, X-Frame-Options, and other headers are enforced

🔑 Encryption Key Location The AES encryption key is stored outside the web root at the server level, inaccessible via HTTP requests.

🤝

4. Data Sharing

We do not sell, rent, trade, or share your personal or financial data with any third party for commercial purposes.

The only limited exceptions where data may be disclosed:

Legal obligation — If required by Indian law or a valid court order
Fraud prevention — To prevent, investigate, or report fraudulent or illegal activity
Service providers — GoDaddy (hosting infrastructure only — they do not access application data)

No advertising networks. No data brokers. No analytics platforms. TotalRupee does not integrate with Google Analytics, Facebook Pixel, or any third-party tracking service.

⚖️

5. Your Rights

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and general data protection principles, you have the following rights:

Right to Access — You can view all your data within the app at any time
Right to Correction — You can update your personal information from your account settings
Right to Deletion — You can request deletion of your account and all associated data
Right to Portability — You can export your financial data as CSV at any time
Right to Withdraw Consent — You can stop using the service and request data deletion at any time

To exercise any of these rights, contact us via the Support tab or at support@totalrupee.in.

🍪

6. Cookies & Sessions

TotalRupee uses only essential session cookies required for authentication. We do not use any tracking cookies, advertising cookies, or third-party cookies of any kind.

Cookie	Purpose	Duration
Session Cookie	Keeps you logged in during your visit	Session only (expires on browser close)
Theme Cookie	Remembers your dark/light mode preference	Persistent (local storage)

All session cookies are set with HttpOnly, Secure, and SameSite=Strict flags for maximum security.

🗓️

7. Data Retention

We retain your data for as long as your account is active. If you request account deletion, all your personal and financial data will be permanently deleted within 30 days.

Active accounts — data retained indefinitely while account is active
Inactive accounts — may be flagged for deletion after 24 months of inactivity
Deleted accounts — all data permanently removed within 30 days of deletion request
Backup copies — purged within 60 days of account deletion

👶

8. Children's Privacy

TotalRupee is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has created an account, we will promptly delete the account and all associated data.

If you believe a minor has registered on TotalRupee, please contact us immediately at support@totalrupee.in.

📝

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make significant changes, we will notify registered users via the in-app Announcements section.

The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of TotalRupee after changes are posted constitutes acceptance of the revised policy.

📬

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out:

📧 Email support@totalrupee.in

💬 In-App Support Login → Support tab → Send a message

We aim to respond to all privacy-related requests within 5 business days.

Table of Contents