This app is in private beta. This policy reflects what the app actually does today, but has not yet had formal legal review, and one real gap is called out below (Section 8, children's data). Text marked like this is a placeholder that will be completed before any public launch.
1. Who we are
Famarth ("we", "us") is currently an independent, unregistered beta project operated by Siddharth Chandak. This policy explains what personal data we collect, why, how it's protected, and the rights you have over it, under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, for users outside India, in a manner consistent with the EU/UK General Data Protection Regulation ("GDPR").
2. What we collect
- Account data: name, email address, securely hashed password, household name, and role (admin/member/restricted/view-only).
- Financial data you enter: income sources, expense transactions and categories, budgets, net worth entries, loans, investments, goals and contributions, and linked bank account labels/balances.
- Usage data: login timestamps, device/browser type, IP address, and any feedback you submit in-app.
Linked bank accounts and investment holdings are currently manual/mock data — Famarth does not yet connect to real banks, brokers, or CAMS. We do not collect biometric data, government ID numbers, or precise location.
3. Why we process it
Only to operate your account and household: to calculate the figures Famarth displays (net worth, budgets, EMI schedules, reports), to send transactional email (signup confirmation, password reset, feedback receipts), and to improve the product from aggregated, de-identified usage patterns. We do not sell your data or use it for advertising.
4. Legal basis / consent
For Indian users, processing relies on your explicit consent given at signup (DPDP Act, Section 6), for the specific purposes above. You may withdraw consent at any time, which will result in account deactivation. For users in the EU/UK, we rely on consent (Art. 6(1)(a) GDPR) for the same purposes, and legitimate interest for basic security logging.
5. Where your data lives
Your data is stored with these processors, each acting only on our instructions:
- Supabase (database, authentication) — hosted in the Mumbai (ap-south-1) region.
- Vercel (application hosting).
- SendGrid (account emails).
- Resend (in-app feedback emails).
If you are outside India, your data will be transferred to and processed in India by Supabase. As a beta project, we have not yet completed formal cross-border transfer agreements with these processors — see Limitations.
6. Security
Passwords are hashed, never stored in plain text. Access to your household's data is enforced at the database level, tied to your account and role — not just hidden in the interface. No independent third-party security audit has been completed yet. Do not enter real bank credentials anywhere in the app — Famarth never asks for them.
7. Your rights
Under the DPDP Act, and consistent with GDPR for non-Indian users, you can:
- Access a copy of the personal data we hold about you.
- Correct inaccurate data (most fields are directly editable in-app).
- Erase your account and associated data.
- Raise a grievance about how your data is handled.
- Withdraw consent at any time.
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
To exercise any of these, email the Grievance Officer below. We aim to respond within 30 days.
8. Children's data
Family households may include members under 18. Under the DPDP Act, processing a child's personal data requires
verifiable parental or guardian consent, and we are prohibited from tracking or targeting advertisements at children.
Current gap: Famarth does not yet have a verifiable parental-consent flow — a household admin can add a member without the app confirming guardian consent. Until this is built, the admin adding a minor is responsible for ensuring they have the legal authority and consent to do so.
10. Data retention
We retain your data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within retention period pending, except where retention is required by law.
11. Limitations
This is an early-stage product in private beta, under active development. This policy will be updated as the product and our practices mature, including formal cross-border transfer agreements, a verifiable parental-consent flow, and a formal security review before wider release.
12. Changes to this policy
We'll update the "Last updated" date below and notify active users of material changes. Continued use after a change means you accept the updated policy.