Privacy Policy.

1. Who this policy covers

This policy applies to the Hissaa mobile apps, website and related services operated under the Hissaa name. In this policy, “Hissaa,” “we,” “us” and “our” refer to the operator of those services. Privacy questions and requests can be sent to feneelp@gmail.com.

2. Information you provide

• Account details such as your name, email address, username, password credential, optional verified phone number, profile photo and chosen sign-in provider. Passwords are stored as protected credentials, not readable plain text.
• Shared-expense information including group names, participant names and contact details, expenses, categories, dates, currencies, splits, settlements, comments, invitations and friend connections.
• A UPI payment identifier if you choose to save one. It is encrypted on the server and cached using protected storage on your device.
• Files or records you choose to import and the confirmed expense records created from them. Import processing happens on your device before confirmed records are saved.
• Messages, reports and diagnostic details you choose to send to support.

3. Information created when you use Hissaa

• Account, session and security identifiers used to keep you signed in and protect requests. On the web, these can be stored in cookies or similar browser storage.
• A push-notification token, notification preferences, time zone and delivery status when you enable notifications.
• Basic connection, app and device details such as IP address, operating system, app version and request timestamps when needed to provide the service, prevent abuse or diagnose a failure.
• A random installation identifier, mobile platform and dates when the app opens. We use these to count first opens and active users. If you sign in, an app-open record can be associated with your account.
• Error and performance information when production monitoring is enabled. This may include the action that failed and technical context, but we configure diagnostics to avoid collecting passwords or full payment credentials.

4. Optional device access

Hissaa asks before using device permissions. Contacts access lets you choose someone for a group; Hissaa does not upload your entire address book. A selected name, phone number or email address may be saved with the group. Photo or camera access lets you choose a profile picture or scan a receipt. Receipt recognition runs on your device, and Hissaa does not upload or retain the receipt image or the full recognised receipt text. Device authentication such as Face ID protects access to a saved payment identifier on your device. Notification permission enables expense and settlement updates. Siri or another supported voice assistant processes what you say under that assistant provider’s terms, then passes an expense draft to Hissaa for your review.

You can deny or revoke optional permissions in device settings. Core manual expense entry remains available without contacts, camera, photos, notifications or voice access.

5. Why we use information

We process information with your consent, to provide the service you request, and for other uses permitted by applicable law. Hissaa does not sell personal information, run third-party advertising or track you across other companies’ apps or websites for advertising.

• Create and secure your account, authenticate you and verify an optional phone number.
• Save and synchronise groups, ledgers, preferences and profile information across your devices.
• Calculate balances and settlements, create editable drafts and show a common record to group members.
• Deliver invitations, service messages and the notifications you enable.
• Protect Hissaa and its users, enforce reasonable limits, investigate abuse and comply with law.
• Diagnose problems, improve reliability and respond to support or privacy requests.
• Measure app adoption and usage so we can understand which parts of Hissaa people use and improve the service.

6. When information is shared

Providers receive only the information reasonably needed for their role and process it under their own terms and privacy commitments. Hissaa does not share your information with data brokers or advertisers.

• With members of a group, who can see the people, expenses, splits, settlements, comments and profile details made available in that group.
• With someone you invite or connect with, as needed to deliver the invitation or show the relevant public profile details.
• With service providers used for hosting and databases, authentication, SMS verification, Expo push notifications, profile-photo storage through UploadThing, Apple or Google sign-in when selected, and Sentry error monitoring when enabled.
• When reasonably necessary to comply with law, respond to valid legal process, protect people or the service, or investigate fraud and abuse.
• As part of a merger, financing, acquisition or transfer of the service, subject to appropriate confidentiality and notice where required.

7. Where information is processed

Hissaa and its providers may process information in India and in other countries where they operate. Those countries may have different data-protection rules. Where required, we use contractual, technical or organisational safeguards for these transfers and follow restrictions issued under applicable Indian law.

8. Retention and deletion

We keep information while your account is active and for as long as reasonably needed to provide shared ledgers, secure the service, resolve disputes and meet legal obligations. Retention can differ by record type. Short-lived security logs, sessions and one-time verification records expire or are removed according to operational needs. Residual copies may remain in protected backups until their normal rotation.

When you delete your account, we remove its link to app-open analytics records. Anonymous installation and usage counts may remain for aggregate reporting.

You can permanently delete your account in Hissaa under Account → Delete account or use the public account-deletion page. Personal profile data, authentication records, friend connections, comments, notification data, payment identifiers and expenses you created are deleted. A group with other account members is transferred so their ledger remains usable, and your participation in records that must remain for them is anonymised as “Deleted member.” A group with no other account members is deleted.

9. Security

Hissaa uses encrypted network connections in production, access controls, protected device storage and encryption for saved UPI identifiers. We limit access to systems that need it and review sensitive operations such as account deletion. No system can guarantee absolute security, so use a strong, unique password, keep your device protected and contact us if you suspect unauthorised access.

10. Your choices and rights

You can update profile information, manage notification and group preferences, revoke device permissions, sign out or delete your account. Depending on applicable law, you may also have rights to ask what personal data we process, request correction or erasure, withdraw consent, nominate another person to exercise rights in the event of death or incapacity, and seek grievance redressal. We may need to verify your identity before completing a request. Withdrawing consent does not affect processing already completed and may prevent a feature from working.

Send a request or grievance to feneelp@gmail.com. We will acknowledge it and respond within the period required by applicable law. If a concern remains unresolved, you may have the right to approach the competent data-protection authority after using Hissaa’s grievance process.

11. Children

Hissaa is intended for people aged 18 and over. We do not knowingly allow a child to create an account or intentionally process a child’s personal data. If you believe a child has provided personal information, contact feneelp@gmail.com so we can investigate and take appropriate action.

12. Changes to this policy

We may update this policy as the service or law changes. Material updates will be posted here with a new effective date and, where appropriate, communicated in the app. The current version is always available on this page.