Privacy Policy

HisaabCore is a shared-expense app operated by My Code Magic (“we”, “us”). For any privacy question or request, email info@mycodemagic.com.

• Account details: your name, email address, and a securely hashed password (we never store the password itself). If you sign in with Google, we receive your name, email address and profile picture from Google.
• What you add to the app: groups, members you invite, expenses (description, amount, currency, category, date, who paid and who owes), settlements, comments, budgets and recurring expenses.
• Receipt photos you upload, and the text read from them if you use receipt scanning.
• Preferences: home currency, notification settings and, if you turn them on, a push-notification subscription for your browser.
• Security and technical data: sign-in events and the IP address they came from (to protect accounts and limit abuse), and error reports when something breaks.
• Billing: your plan and subscription status. Card details are entered directly with Stripe and never reach our servers.

We don’t sell your data, show ads, or use advertising trackers.

• To run the app: calculate balances, show your groups and activity, and settle up.
• To send the emails you’d expect: email verification, password resets, and (unless you turn it off) a weekly balance reminder.
• To send the in-app and push notifications you’ve enabled.
• To process payments for paid plans.
• To keep the service secure, prevent abuse, and fix errors.

Other members of your groups can see the expenses, balances, settlements and comments in groups you share, along with your name and email. Friends you add can see balances you share with them.

We use these service providers to run HisaabCore. They process data only on our behalf:

• Vercel: hosts the website.
• Railway: our database and background jobs (hosted in Singapore).
• Cloudflare R2: stores receipt photos privately. They’re only viewable through short-lived links shown to members of the group.
• Resend: sends our emails.
• Stripe: handles payments for paid plans.
• GlitchTip: receives error reports so we can fix bugs.
• Google: only if you choose “Continue with Google”.

Exchange rates come from the European Central Bank via Frankfurter; no personal data is sent for that. We may also disclose data if the law requires it.

We use a cookie to keep you signed in, plus the security cookies the sign-in system needs. Your browser’s local storage remembers display choices such as light or dark mode and grid or list view, and any expenses you save while offline until they sync. We don’t use analytics or advertising cookies.

We keep your data while your account is open. You can download a copy at any time from Settings → Your data.

You can delete your account from Settings → Delete account once your balances are settled. We then remove your name, email, password, profile picture, push subscriptions and API keys, and remove you from your groups. Expenses and settlements you were part of stay in those groups, attributed to an anonymous deleted account, because the other members still rely on that shared record.

Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to how we use it. Most of this you can do yourself in Settings; for anything else, email info@mycodemagic.com and we’ll respond within 30 days.

Data is encrypted in transit, passwords are hashed, receipt storage is private, and payments are handled entirely by Stripe. No service is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects you.

HisaabCore isn’t intended for children under 13, and we don’t knowingly collect their data.

If we change this policy, we’ll update the date above. For significant changes, we’ll let you know by email or in the app. See also our Terms of Service.