Privacy Policy

Last updated: 12 October 2026

CashBooklet is a bookkeeping app: cash books, customer and supplier khata, invoices, stock and shared expenses. This policy covers the CashBooklet Android app (com.cashbooklet.app) and the CashBooklet service it connects to, both provided by CashBooklet (“we”, “us”).

1. What we collect

Your account

• Your name and email address, and your phone number if you add one.
• Your password, stored only as a one-way hash — we cannot read it.
• Your language choice.
• If you sign in with Google: sign-in is handled by Google’s Firebase Authentication. We receive your name, your email address and an account identifier from Google. We never see your Google password and we do not store your profile picture.

The records you keep in CashBooklet

Everything you enter is stored so the app can show it to you and to the team members you add:

• businesses (name, logo, address, tax number, currency) and their books;
• entries: amount, date, type, category, payment mode and notes;
• contacts — customers, suppliers and staff: name, phone number and, if you add them, email, address, tax number and credit terms;
• invoices and quotations, items and stock, expense groups and their members, day-close cash counts, quick-entry buttons;
• the people in your team and their roles.

Some of this is about other people, such as your customers. You decide what to enter and are responsible for having a reason to keep it.

Photos and files you attach

Receipt photos or PDFs you attach to an entry, a photo for a book and a logo for a business. You choose each file with your phone’s own file picker; the app has no access to the rest of your gallery and does not ask for camera or storage permission.

Contacts on your phone

Only if you tap the option to choose someone from your phone’s contacts. Android then asks for the Contacts permission. The app reads contacts on your phone so that you can pick, and only the person you choose is saved to your CashBooklet account — their name and phone number, and their email address if the contact has one and you keep it on the form. The rest of your address book is never uploaded. The app never adds, changes or deletes contacts on your phone. You can refuse the permission and type the details instead.

Your device and notifications

If you allow notifications, we store a push notification token for your phone (issued by Firebase Cloud Messaging), the platform (Android), the app version and when the phone last used the app. The token is removed when you sign out and when you delete your account.

Technical records

• Like any web service, our server and network provider record the IP address, time and type of device for each request, to limit abuse (for example repeated sign-in attempts) and to find faults.
• Inside a business, CashBooklet keeps a change history: who created, edited or voided each record and when.
• When you ask to delete your account, the request’s time and IP address are recorded with it.

Error reports

The Android app contains no analytics and no crash-reporting SDK. Errors on our server are written to our own server logs and are not sent to any third-party error-reporting service.

What we do not collect

Your location, an advertising ID, your whole contact list, call or SMS logs, microphone or camera input, or any bank-card or payment-account details. CashBooklet records money; it does not move it.

2. What stays on your phone

• A copy of your books, so the app works without internet, and the tokens that keep you signed in. Signing out removes both from the phone.
• The optional app-lock PIN, kept only on the phone and only as a hash.
• Android’s cloud backup is switched off for the app, so this data is not copied to a Google backup.

3. How we use it

• To run the app: store your records, sync them between your devices and show them to the team members you added.
• To sign you in and protect your account: verification codes, password resets, deletion confirmations.
• To send the notifications you have left switched on (for example an entry waiting for your approval).
• To answer you when you contact support.
• To keep the service secure and working.

We do not use your data for advertising, we do not sell or rent it, and we do not build advertising profiles.

4. Who else sees it

• Your team. People you add to a business see that business’s records according to the role you give them.
• People you send things to. When you share a reminder, statement, invoice or report through WhatsApp, SMS, email or another app, that app handles it under its own policy.
• Service providers that process data for us so the app can work:
  • Google Firebase — Firebase Authentication for Google sign-in, and Firebase Cloud Messaging to deliver push notifications (the token and the notification’s text pass through Google);
  • our hosting provider — the server and database that hold your records;
  • Cloudflare — network security in front of our server; it sees connection details such as your IP address;
  • an email delivery service — to send codes and confirmations to your email address.
  These providers may process data in other countries.
• The law. We may disclose information if a valid legal order requires it.

We do not share your data with advertisers or data brokers.

5. Permissions the Android app asks for

• Contacts (optional) — only to let you pick a person from your phone when adding a contact. Android groups reading and writing contacts under one permission; the app only reads.
• Notifications (optional) — to show alerts on your phone. You can turn each kind off under More → Notification settings.
• Internet — to reach our server.

Android also gives the app a few routine permissions that never show a prompt: checking whether the phone is online, and the ones Google’s push service needs to deliver a notification. The app does not ask for location, camera, microphone, storage, SMS or call-log permissions.

6. Security

• All traffic between the app and our server uses HTTPS; the released app refuses unencrypted connections.
• Passwords are stored only as hashes.
• Every request is checked against your role in the business, and receipt photos, book photos and logos are served only to signed-in members of that business.

No system is perfectly secure. If you think your account has been misused, change your password and write to us.

7. How long we keep it, and deletion

• We keep your account and records for as long as the account exists.
• Entries are voided rather than erased, so a book’s history stays complete; contacts are archived. They remain in the business’s history until the business itself is deleted.
• When you delete your account it is closed immediately, kept for 30 days in case it was a mistake, and then erased for good. The full steps, and what is and is not deleted, are on the deletion page.
• Routine database backups are kept for up to 14 days, so erased data can remain in a backup for up to 14 more days before it ages out.

8. Your choices

• See and correct your profile and records in the app at any time.
• Download a copy: More → Account & privacy → Export data (CSV or JSON).
• Turn notifications off in the app or in Android’s settings, and withdraw the Contacts permission in Android’s settings.
• Delete your account: More → Account & privacy → Request account deletion.
• For anything else — access, correction or a question — write to [email protected].

9. Children

CashBooklet is a tool for adults who run a business or manage their own money. It is not directed to children, and we do not knowingly collect information from anyone under 18.

10. Changes to this policy

If we change this policy we will update this page and the date at the top. If a change is significant we will tell you in the app or by email first.

11. Contact

CashBooklet — [email protected]