Privacy Policy
How Rozbahi handles your data, in plain language.
Last updated: 23 October 2026
Short version: we collect only what the app needs to keep your expense records, sign you in and sync them across your devices. We do not sell your data and we do not show ads. We do not read your SMS, contacts, photos, location or bank accounts. You can delete your account and all its data from inside the app at any time.
Contents
- Who we are
- What this policy covers
- Information we collect
- Information we do not collect
- How we use your information
- Why we are allowed to use it
- Who can see or receive your information
- Shared groups
- Backups
- How we protect your information
- How long we keep it
- Your rights and choices
- Deleting your account
- Cookies and the website
- Children
- Where your data is stored
- Changes to this policy
- Contact and grievance officer
1. Who we are
Rozbahi is a personal and family expense tracker for Android and iPhone, with this website at rozbahi.com. Rozbahi is a brand of W3CTRL (w3ctrl.com), based in India. In this policy "Rozbahi", "we", "us" and "our" mean W3CTRL acting as the operator of Rozbahi. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here.
2. What this policy covers
This policy applies to the Rozbahi mobile app, the Rozbahi servers the app talks to, and this website (including the contact form). It does not cover websites or services run by others that we link to, such as the Google Play Store or Apple App Store, which have their own policies.
3. Information we collect
3.1 Information you give us
| What | Details | Why |
|---|---|---|
| Mobile number | The number you sign in with, in international format (for example +91…). | To create your account, send your one-time password (OTP) and identify you. |
| Profile | Your name (optional), app language (English or Hindi) and currency. | To show your name in the app and in shared groups, and to display the app in your language. |
| Expense and income records | Amount, date, category, payment method (cash, UPI or card), and any note or shop/vendor name you type. | This is the core of the service: storing, syncing and reporting on your records. |
| Categories, budgets, templates | Categories you create, monthly budget limits, and quick-add templates. | To organise your spending and warn you near a budget limit. |
| Recurring bills | Label, amount, category, how often it repeats, next due date and reminder settings. | To post recurring entries and remind you before a bill is due. |
| Groups | Group name, members, your display name in the group, expenses you add to the group and settlements you confirm. | To let a family or flatmates track shared spending and settle up. |
| Backups | Backup files you choose to upload (see section 9). | So you can restore your data on a new phone. |
| Contact form and emails | Your name, email, optional mobile number and company, and your message. | To reply to you and resolve your request. |
We do not verify what you type in notes or vendor names. Please do not put card numbers, bank passwords, UPI PINs or other secrets in them.
3.2 Information collected automatically
| What | Details | Why |
|---|---|---|
| Device and app details | An app-generated install ID, platform (Android or iOS), device model, manufacturer and brand, OS version, app version and build, time zone, language/locale, country code, screen size, whether it is a tablet, install source, and first-install and last-active times. | To link your installs to your account, show the right update prompt, fix device-specific bugs and count active installs. |
| Push notification token | A Firebase Cloud Messaging token and whether notifications are allowed. | To send bill reminders and important account messages. |
| Sign-in records | The mobile number an OTP was sent to, a one-way hash of the code (never the code itself), expiry time, number of attempts, and the IP address and install ID of the request. | To check your OTP, stop abuse such as repeated guessing, and keep the service secure. |
| Access tokens | Random tokens issued when you sign in, with the time they were last used. | To keep you signed in without asking for an OTP every time. |
| Server and security logs | IP address, time, requested address, response status and browser or app user agent, plus error reports. | To run the service, detect attacks and fix errors. |
3.3 Information from other people
If you join a group with an invite code, the other members' entries in that group (for example an expense they paid that is split with you) are stored with the group and shown to you. Your name in a group is the name you give.
4. Information we do not collect
- We do not read your SMS inbox, call logs, contacts, photos, files or location.
- We do not connect to your bank, card or UPI accounts, and we never ask for net-banking passwords, card numbers, CVVs or UPI PINs.
- We do not process payments. "Settle up" only records that a payment was made between group members; the money itself moves outside Rozbahi.
- We do not use advertising SDKs, and we do not build advertising profiles.
5. How we use your information
- Provide the service: sign you in, store and sync your records across devices, calculate reports, budgets and group balances, post recurring entries and store backups.
- Send messages you need: your OTP, bill reminders you set up, and important notices about your account or our terms.
- Support: answer questions you send through the app, email or the contact form.
- Security and abuse prevention: rate-limit sign-in attempts, detect fraud and protect accounts.
- Improve the app: count installs and active devices, and find crashes and errors. We use totals and device details for this, not the contents of your expense notes.
- Legal obligations: respond to lawful requests and keep records the law requires.
We do not use your expense data for advertising, credit scoring or lending decisions, and we do not sell it.
6. Why we are allowed to use it
Under the DPDP Act we process your personal data on the basis of the consent you give when you sign up and use the features, and for legitimate uses the Act allows, such as data you share voluntarily for a purpose, complying with law and responding to legal orders. If you use Rozbahi from outside India and your local law requires a legal basis, we rely on performing our contract with you (running the app you asked for), our legitimate interest in keeping the service secure, your consent, and legal obligations.
You can withdraw consent at any time by deleting your account (see section 13). Withdrawing consent does not affect processing that already happened.
7. Who can see or receive your information
We do not sell or rent personal data. We share it only as follows:
- Other members of your groups see the group name, member names, the group's expenses and settlements. See section 8. Your personal (non-group) records are never shown to other users.
- Service providers who process data for us under contract and only on our instructions:
- our server hosting provider, which stores the database and backups;
- Cloudflare, which protects and speeds up the website and API (it sees IP addresses and request details in transit);
- our messaging gateway and its SMS or WhatsApp delivery partners, which receive your mobile number and the OTP to deliver it;
- Google Firebase Cloud Messaging, which receives your push token and the reminder text to deliver notifications;
- our email provider, when we reply to you by email.
- App stores: Google and Apple process data when you download the app, under their own privacy policies.
- Legal reasons: when required by law, court order or a lawful request from a government authority, or to protect the rights, property or safety of our users, the public or us.
- Business change: if Rozbahi or W3CTRL is merged, sold or reorganised, data may pass to the new operator, who must keep honouring this policy. We will tell you before that happens.
8. Shared groups
Groups are for people who share costs, such as a family or flatmates. Anyone with a group's 6-character invite code can join it, so share the code only with people you trust. Inside a group:
- all members see each other's display names, the expenses added to the group, who paid, the balances and confirmed settlements;
- the group admin can remove members;
- if you delete your account, your own expenses are removed. If you created a group and other members remain, admin rights pass to another member so the group keeps working for them; a group with no other members is deleted.
9. Backups
The app can save a backup to our server so you can restore on a new phone. There are two kinds:
- Encrypted backups are encrypted on your phone (AES-256-GCM) with a PIN only you know before they are uploaded. We store the encrypted file and cannot read it. If you forget the PIN, we cannot recover the backup.
- Server snapshots are a copy of your records that our server makes when you ask for one. They are protected by the same access controls as your live data, are linked only to your account, and are deleted with your account.
Backup download links are signed and expire after 15 minutes.
10. How we protect your information
- All traffic between the app, the website and our servers uses HTTPS (TLS).
- OTPs are stored only as one-way hashes, expire within minutes, and lock after 5 wrong attempts. OTP requests are limited per number and per network.
- Sign-in tokens are random, short-lived (1 hour for access, 30 days for refresh), rotated on use and revoked when you log out.
- Every record is tied to its owner's account on the server; requests for another user's data are refused.
- Servers are firewalled and kept up to date, and the admin panel requires two-factor authentication. Only authorised staff who need it to run the service can access personal data.
- Database backups for disaster recovery are kept on secured storage.
No system is perfectly secure. Keep your phone locked and do not share OTPs with anyone; Rozbahi staff will never ask you for one. If we learn of a personal data breach that affects you, we will notify you and the Data Protection Board of India as the law requires.
11. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, records, groups, backups | Until you delete them or delete your account. Deleted entries are kept briefly as hidden markers so your other devices remove them too, and are erased with your account. |
| OTP records | Deleted automatically after 2 days. |
| Expired sign-in tokens | Deleted automatically within about a day of expiry; all tokens are deleted when you delete your account. |
| Device and push-token records | Until you delete your account or the install stays inactive for a long time. |
| Contact form messages and support emails | Up to 2 years after the conversation ends, so we can follow up on the same issue. |
| Server and security logs | Usually up to 90 days, longer only when needed to investigate an incident. |
| Disaster-recovery database backups | Rolling copies replaced within about 30 days. Data you deleted disappears from them as they rotate. |
We may keep specific data longer if the law requires it or to resolve a dispute, and only for as long as that need lasts.
12. Your rights and choices
Subject to applicable law, you have the right to:
- Access a summary of the personal data we hold about you, how we process it, and who we have shared it with;
- Correct and update it: you can edit your name and records directly in the app;
- Erase it: delete individual entries in the app or delete your whole account;
- Withdraw consent at any time, as easily as you gave it;
- Nominate another person to exercise your rights if you die or become unable to;
- Grievance redressal: complain to our Grievance Officer and, if unsatisfied, to the Data Protection Board of India.
You can also turn off notifications in your phone settings at any time; the app keeps working without them.
To use these rights, email [email protected] and include the mobile number on your account. To protect you, we may ask you to confirm the request from inside the app or with an OTP before we act. We reply within 30 days.
13. Deleting your account
You can delete your account from inside the app at any time; the steps are on our account deletion page. Deleting your account immediately and permanently removes your profile, all your expense and income records, categories, budgets, templates, recurring bills, group memberships, backup files, devices and sign-in tokens from our live systems. Groups you created are handed to another member or deleted, as described in section 8. Copies in disaster-recovery backups expire as described in section 11.
If you cannot open the app, email [email protected] with your registered mobile number and we will delete the account after confirming it is yours.
14. Cookies and the website
This website uses only the cookies it needs to work: a session cookie and a security (CSRF) cookie that protect the contact form. They expire when you close your browser or shortly after. We do not use advertising or cross-site tracking cookies.
Cloudflare may set a short-lived security cookie to tell real visitors from bots.
15. Children
Rozbahi is meant for adults managing household money. You must be 18 or older to create an account, or use it with the permission and supervision of a parent or lawful guardian, who agrees to this policy on your behalf. We do not knowingly track or target children. If you believe a child has given us personal data without a guardian's consent, contact us and we will delete it.
16. Where your data is stored
Our application servers and databases are hosted with a professional data-centre provider. Some of our service providers (such as Cloudflare and Google Firebase) process data on servers in other countries. We transfer data outside India only to countries not restricted by the Government of India under the DPDP Act, and we require providers to protect it to the standard in this policy.
17. Changes to this policy
We may update this policy when the app or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you in the app or by another reasonable method before it takes effect, and ask for fresh consent where the law requires.
18. Contact and grievance officer
For any question, request or complaint about privacy, contact our Grievance Officer:
| Grievance Officer | Rozbahi Privacy Team, W3CTRL |
|---|---|
| [email protected] | |
| Web | rozbahi.com/contact |
| Response time | We acknowledge within 48 hours and resolve within 30 days. |
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
See also: Terms of Service · Delete your account