# Privacy policy

## About this notice

Published policy. Contact the operator with questions about this service. Contact Salman Javed at salman.se95@gmail.com. This notice describes PaisaTrace, a manual personal finance tracker with optional income forecasts, spending budgets, named savings goals and budget cycle preferences. It should be reviewed when deployment providers or data practices change.

## Information you provide

When connected to its backend, PaisaTrace uses your email address and a password for verified sign-in. Supabase manages password verification; passwords are not stored in your financial ledger. The app stores the income, expenses, savings, investment contributions, dates, currencies, categories, expense payment-type labels, notes, targets and preferences you choose to enter. It does not request bank credentials or connect to bank accounts. Avoid adding sensitive information about other people in notes.

## How information is used

Account information supports sign-in and account protection. Signup, verification and sign-in dates, plus a last-active timestamp when the signed-in app is opened, help the operator understand account usage and protect the service. The admin panel shows account emails and these timestamps, not financial records. Financial entries and settings support your private ledger, calculations, reports and Excel exports. Support messages are used to respond to your request. These uses do not involve automated lending decisions or investment recommendations.

## Service providers

Supabase provides authentication and database storage when configured. Vercel serves the website and may process technical request logs, including IP addresses and browser details. Brevo receives your email address and authentication messages to deliver signup verification and password-recovery emails. Returning password sign-in does not send an email. The Supabase database is hosted in Sydney, Australia. Google Fonts serves the current typefaces and receives browser requests. These services may process information in locations outside your country; review their privacy notices and the operator’s selected hosting region.

## Browser storage and demo data

Demo mode uses synthetic data stored in your browser’s local storage. It does not upload demo records to Supabase or sync them across devices. Connected sign-in uses browser storage for the authentication session. Reset demo removes local sample changes; signing out does not delete account records. Necessary storage supports these features. No advertising or analytics SDK is included in the current application.

## Access, corrections and deletion

You can edit or delete entries, change settings and export the selected records to Excel. Categories with history are archived to preserve those records. Account-wide deletion currently requires a request to the operator; it is not an in-app button. The operator must verify account ownership before handling such a request. A restricted admin tool can permanently remove the account and its app records; deletion actions are logged with operator ID, deleted account ID and time, without financial content. Rights and required response periods depend on applicable law.

## Retention and security

Account records are retained while the account is used, until you delete individual records or request account deletion, subject to any applicable legal obligations. Provider logs and any independently retained backups follow the relevant provider or operator retention practices; deleted information may remain there temporarily. Ask the operator about provider log retention and any backups before storing information that depends on a specific deletion deadline. Server-side ownership controls restrict account records to their owner, but no service can promise absolute security. Keep your email account and exported files secure.

## Changes and questions

Contact Salman Javed at salman.se95@gmail.com. Material changes to data practices should be reflected here before they take effect. If you have rights under applicable privacy law, you may also contact the appropriate regulator.