Privacy Policy

The short version

Khata stores what you type or speak into it — transactions, notes, account names — so it can answer your questions later. Data is tied to your account and is not shown to other users.

But this is a free, hobby-run service. There is no security team, no audit, no guarantee of confidentiality or availability, and no promise the service exists tomorrow. If you would be upset to lose it or leak it, do not put it in Khata.

What we collect

Account data: your Gmail address, a bcrypt-hashed password, hashed MPINs, your display name, and your UI preferences (wallpaper, voice language).

Content data: every transaction, note, account, contact, and chat message you (or the assistant, on your behalf) create; uploaded statements and receipts; reminders you schedule.

Technical data: session records, web-push subscription tokens for devices you enable notifications on, and standard server logs (IP addresses, timestamps, error logs) kept for troubleshooting.

Where the data goes

Primary storage: a hosted SQLite-compatible database (Turso) chosen by the operator. Email delivery: a third-party email provider (Resend) is used to send verification and password-reset codes — the code and your address are shared with that provider, nothing more.

AI processing: when you chat, your recent conversation context and a compact summary of your accounts are sent to whichever large-language-model provider is configured (by the operator, or by YOU with your own API key and endpoint from the dashboard settings). Those providers process your prompts under their own privacy terms — read them if you care.

Push notifications: reminder content you create is delivered through browser push infrastructure and Upstash QStash schedules.

Data security — honestly

We do not promise data security. Passwords and MPINs are hashed, and accounts are isolated from each other in the database, but the service has not been security-audited, and free infrastructure can fail, leak, or disappear.

YOU are responsible for the secrecy of your credentials and for keeping your own backups. Export your data regularly. Assume that anything you store here could be lost or exposed at any time.

Your own AI keys

If you set your own API keys or custom endpoints in the dashboard, they are stored on the server and used to call YOUR chosen providers on your behalf. Protect them; treat them like passwords. You accept full responsibility for their use and any resulting costs.

No selling, but no guarantees either

We do not sell your data and there are no third-party analytics or ad trackers in Khata. The operator has no commercial interest in your data.

However, because the service may be discontinued or handed over at any time, you should treat long-term confidentiality as YOUR responsibility, not ours.

Deleting your data

You can request deletion of your account and data by contacting the operator via the GitHub account listed on the landing page. Deletion removes your account, transactions, chats, and reminders from the primary database. We cannot claw back messages already sent to AI providers, email providers, or your own devices.

Children

Khata is not directed at children under 13, and financial data of children should not be entered.

Changes

This policy may change at any time; the current version always lives at this page. Using Khata after a change means you accept it.