This Privacy Policy explains how Aayna Khata (the “App”, “we”, “us”, or “our”),
the Cashz digital khata and bookkeeping application, collects, uses, stores, protects, and shares
information when you use the App. By installing or using Aayna Khata you agree to the practices
described here. If you do not agree, please do not use the App.
The short version. Your business records — customers, suppliers, dues, sales,
expenses, notes and challan/invoice photos — are stored only on your own device in an
encrypted database. We do not upload your ledger to our servers and we never sell your
data. A small amount of account and app-control information is processed through Google Firebase so
the App can sign you in, send notifications, and operate. You can export an encrypted backup or delete
your account at any time.
1. Who we are & how to contact us
Aayna Khata (Cashz) is the data controller for the information described in this policy. For any
privacy question, request, or complaint, contact us:
2. Information we collect
2.1 Information you provide
- Account details: your name, business name, and mobile phone number provided
during registration.
- Security credentials: a 4-digit PIN (and, optionally, a backup password) that
you set to lock the App and protect backups. Your PIN is used on-device and to encrypt backups;
we do not transmit it to our servers in readable form.
- Business & bookkeeping data: the records you enter — customer and supplier
names and (optionally) phone numbers, transaction amounts, dues/credits, sales, purchases,
expenses, cash entries, order notes, remarks, and dates.
- Photos: challan / invoice / bill images you capture or attach to a purchase.
- Business location (optional): if you choose a location for your business, it is
selected through Google Places autocomplete (a place name/address you pick). The App does not
track your real-time GPS location.
- Voice input (optional): when you use the voice-entry or voice-note feature, your
speech is processed by your device’s Google speech-recognition service to convert it to text.
- Communications: any information you include when you contact us by email or
WhatsApp.
2.2 Information collected automatically
- Device & usage data (analytics): via Google Analytics for Firebase, we may
receive aggregated, app-functioning data such as device model, operating-system version, app
version, language, general region, and anonymous usage events (e.g., screens opened, features
used) to understand performance and improve the App.
- Identifiers: an anonymous Firebase authentication ID, a Firebase Cloud Messaging
(push) token, and similar app/instance identifiers.
- Connection data: standard technical data such as IP address and timestamps,
processed by Google when the App communicates with Firebase services.
- Diagnostics: basic error/diagnostic information that helps us keep the App
stable.
2.3 Device permissions and why we request them
| Permission | Why it is used |
|---|
| Camera | To photograph challan/invoice/bill images you choose to attach to a purchase. Photos are stored on your device only. |
| Internet & network state | To sign in, sync account/app-control status, and deliver notifications via Firebase. The App is designed to work offline; internet is needed only for these limited functions. |
| Notifications | To show due reminders and important account or service messages. |
| Biometric (fingerprint / face) | Optional — to unlock the App using your device’s screen-lock biometrics, as an alternative to your PIN. Biometric data never leaves your device and is handled by the Android system. |
| Phone (call) | Optional — to let you place a call to a customer or supplier number you saved. We do not read your call logs. |
| Microphone (voice input) | Used only while you actively use voice entry; speech is processed by Google’s speech-recognition service to produce text. |
| Contacts (picker) | If you choose to add a customer/supplier from your contacts, the Android system picker returns only the single contact you select. The App does not read your full contact list in the background. |
You can grant or revoke any permission at any time in your device Settings. Some features will not
work without the related permission.
3. How we use your information
- To create and secure your account and lock/unlock the App.
- To provide the core service: recording and displaying your khatas, transactions, dues, reports,
and business insights.
- To send reminders and notifications you have enabled.
- To enforce fair-use limits and, where applicable, to verify or temporarily lock accounts (for
example, account-status flags processed through Firebase, which you can resolve by contacting
support on WhatsApp).
- To create encrypted backups at your request and restore them when you choose.
- To maintain security, prevent abuse, fix bugs, and improve the App.
- To respond to your support requests.
4. How your data is stored and protected
- Local-first & encrypted at rest: your business and bookkeeping data is stored
in an on-device database that is fully encrypted using AES-256 (SQLCipher). The encryption key is
protected by your device’s hardware-backed secure keystore.
- Not uploaded: your ledger entries, amounts, notes, and challan photos are
not uploaded to our servers. They remain on your device unless you choose to back
them up or share them.
- Encrypted backups: backups you create are encrypted and protected by your PIN or
a backup password that only you know. If you forget it, the backup cannot be recovered.
- Limited cloud data: a small set of account/app-control data (such as your phone
number, name, business name, an anonymous user ID, push token, and account-status flags) is
processed and stored through Google Firebase to operate the App.
- Safeguards: we apply reasonable technical and organizational measures to protect
data. However, no method of electronic storage or transmission is 100% secure, and we cannot
guarantee absolute security.
5. Sharing & third-party services
We do not sell your personal information and we do not share it for third-party
advertising. We do not display third-party advertisements in the App. We share limited data only with
the service providers that make the App work:
- Google Firebase (Authentication, Realtime Database, Cloud Messaging, and Google
Analytics for Firebase) — for sign-in, account/app-control status, push notifications, and
analytics.
- Google Play services / Google Maps & Places — for optional business-location
selection.
- Google speech recognition — to convert your voice to text when you use voice
input.
- WhatsApp — only when you choose to share a statement/reminder or contact support;
the content you send is governed by WhatsApp’s own privacy policy.
These providers process data under their own privacy policies, including
Google’s Privacy Policy. We may also disclose
information if required by law, regulation, legal process, or to protect the rights, safety, or
security of users and the public.
6. Data retention
Your on-device data remains until you delete it, delete your account, clear the App’s data, or
uninstall the App. Limited account/app-control data held in Firebase is retained for as long as your
account is active and for a reasonable period afterwards as needed for legitimate operational, legal,
or security purposes, after which it is deleted or anonymized.
7. Your rights and choices
- Access & export: you can view all your data in the App and export an encrypted
backup at any time.
- Delete: you can delete individual entries, or use the in-app “Delete account”
option to remove your account and associated data. Uninstalling the App removes the local
encrypted database from your device.
- Permissions: you can revoke camera, notification, microphone, phone, or other
permissions in device Settings.
- Notifications: you can turn off notifications in the App or device settings.
- Requests: to request access, correction, or deletion of any data we hold, email
hello@aayna.site. We will respond within a reasonable time
and in line with applicable law.
8. Children’s privacy
Aayna Khata is a business tool intended for adults (shop owners, traders, and businesses). It is not
directed to children, and we do not knowingly collect personal information from children under the age
of 13 (or the minimum age required in your jurisdiction). If you believe a child has provided us
personal information, contact us and we will delete it.
9. International data transfers
The Firebase services we use may store and process data on Google servers located in regions
including Asia-Southeast and other countries where Google operates. By using the App, you understand
that limited account/app-control data may be processed in these locations, with protections consistent
with this policy and Google’s safeguards.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update
the “Last updated” date above and, where appropriate, notify you in the App. Your continued use of the
App after changes take effect means you accept the updated policy.
11. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or your data: