Privacy Policy

Last updated 27 October 2026

Hisabzo is a personal ledger for money you lend and borrow. This page explains what information the service handles, why, and the choices you have. We keep it short and plain on purpose.

1. What we collect

• Account details: your name and email address, and a password. The password is stored only in hashed form, so we cannot read it. We also keep the date you last signed in, which we use only to count, in aggregate, how many people use the service.
• Sign in with Google (optional): if you choose it, Google tells us your name, your email address (confirmed by Google) and a Google account identifier. We use them only to create or find your account. We never see your Google password and we do not read anything else in your Google account.
• Your ledger: the people you add (name, optional phone number and notes) and the transactions you record (amount, category, date, note and reference). You decide what to enter.
• Personal Expenses: if you use it, the income and spending entries you record (amount, category, date, currency and an optional note). They are private to your account, kept apart from your people and transactions, and used only to show you your monthly totals. You can hide this feature in Settings, and your entries are included in the data you can download or delete.
• Change history: a log of what you add, edit, delete and restore in your ledger (for example "Deleted Loan · received Rs 5,000", with the person's name and the time). It is shown to you on the History page and is not used for anything else.
• Contacts you import: if you choose "Import people", the app reads the contacts you pick on your phone, or the contacts file you choose, in your browser. Only the names and phone numbers of the people you confirm are saved to your ledger. The rest of your contacts, and the file itself, are never uploaded or kept.
• Contact form messages: the name, email address, subject and message you send us.
• Preview visits: starting the sample-data preview creates a temporary account with sample data. We also count preview starts per day, by country and by where the visit came from (for example a website name). In the same anonymous way we count how many sign-ups are started, have a confirmation code emailed, and are confirmed, so we can see whether sign-up works. These counts contain no email address or other personal details and are not linked to you.
• Website analytics (public site): we use Vercel Web Analytics to understand how the public site is used. It records page views along with the page address, the website you came from, your approximate location (country or region), and your browser, operating system and device type. It does not use cookies, and it does not store your name, email address or anything you type into the app. Visitors are told apart only by a temporary, anonymous identifier that Vercel does not keep beyond a short period, so we cannot tell who you are or follow you across other websites. We also use Vercel Speed Insights, which measures how quickly pages load (loading times, the page route, your approximate location, and your browser, operating system and device type). It also works without cookies and does not store your name, email address or anything you type into the app.
• Technical data: your IP address is used briefly to limit repeated requests (sign-in attempts, account creation, password reset requests, preview starts and contact messages) and to protect the service from abuse. These short-lived records are cleared automatically, usually within a day.

2. How we use it

• To run your account and show you your own ledger, balances and statements.
• To send emails you ask for, such as a password reset link, and to read and reply to messages you send through the contact form.
• To send you a short daily reminder email about loans that are due or overdue, only if you switch reminders on in Settings. They are off by default and you can turn them off at any time. The email lists the names and amounts from your own ledger and goes only to your account email address.
• To keep the service secure and to understand, in aggregate, how many people try the preview.

We do not sell your information, and we do not use your ledger for advertising.

3. Cookies and similar technology

We use one essential cookie to keep you signed in. It is HTTP-only and is not used for tracking. On the public site we also use Vercel Web Analytics (see section 1), which works without cookies and counts visits without identifying you. Your browser may also keep a small note in session storage about where your visit came from, which is cleared when you close the tab. The app can be installed on your device and uses a service worker for that; it does not store your private financial records for offline use.

4. Who handles data for us

We rely on a small number of providers to run the service: a hosting and analytics provider (Vercel, which also provides Vercel Web Analytics), a managed PostgreSQL database (Neon) and an email delivery provider (Resend). They process data only to provide their service to us.

You can block analytics with your browser's tracking protection or a content blocker. Hisabzo works the same either way. You can read how Vercel handles this data in Vercel's Web Analytics privacy documentation.

5. How long we keep it

• Analytics data is kept by Vercel for the period set by their service, and is used only in aggregate.
• Preview accounts and everything entered in them are deleted after 24 hours.
• Regular accounts are kept until you delete them. You can delete your account yourself in Settings at any time, and everything in it (your people, transactions and change history) is removed immediately.
• Deleted entries: when you delete a transaction it is hidden straight away, but it is kept for up to 30 days so you can restore it from the History page. After that it is permanently removed.
• Change history is kept for as long as your account exists and is deleted with it.
• Backups: our database provider may keep copies of the database for a short period for recovery. Deleted data leaves those copies as they expire.
• Contact messages are kept only as long as needed to answer you and keep a reasonable record.

6. Security

Passwords are hashed, sessions are signed and expire, connections use HTTPS, and each account can reach only its own records. No online service can promise perfect security, so please choose a strong, unique password.

7. Your choices

You can edit or delete the people and transactions in your ledger at any time. In Settings you can change your name and password, sign out of your other devices, switch reminder emails on or off, download a copy of all your data as a file, and delete your account. You can also ask us to correct or delete your data, or ask a question about this policy, through the contact form.

8. Children

Hisabzo is not directed at children under 13, and we do not knowingly collect their information.

9. Changes

If we change this policy we will update the date at the top of this page. Continuing to use Hisabzo after a change means you accept the updated policy.

10. Contact

Questions about privacy? Reach us through the contact form.