Legal
Privacy policy
What Pathayam collects, why, how long it is kept, and how to get it back or have it deleted.
The short version.
- This website counts visits with Cloudflare Web Analytics, which sets no cookies and does not follow you anywhere. The app itself has none.
- A request for an instance stores an email address and nothing that identifies a device.
- The demo holds invented data. Do not put anything real into it.
- If you self-host, none of this applies: no data reaches us at all.
- On a hosted plan your data sits in its own database, not a shared table, and one endpoint returns all of it at any time.
- Five days after a plan ends, everything is deleted — backups included, and not recoverable.
Who is responsible
Pathayam is operated by Flaxvin Technologies (flaxvin.tech) (“we”, “us”). For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below.
Questions, requests and complaints: privacy@pathayam.app.
If you run Pathayam yourself
This policy does not apply to a self-hosted installation. The software makes no outbound request to us, sends no telemetry and reports no errors. Your database is a file on your own machine. Where that installation connects to your own identity provider, to Google, or to a price provider, it does so with credentials you supply, under those parties' terms, and we are not involved. You are the controller of that data.
The website
pathayam.app is static. It sets no cookies, embeds no social widgets, and serves its fonts and images from this origin rather than a CDN.
It does count visits, with Cloudflare Web Analytics. That records the page you looked at, where you arrived from, your browser and operating system, your country, and how quickly the page loaded. It uses no cookies and no local storage, does not fingerprint your device, and cannot follow you to any other site — there is no identifier that persists between visits, so we can see that a page was read and never that you read it.
We look at it to know which pages are worth writing and which are not read at all. It is the only measurement on this site.
Our hosting provider, Fly.io, records ordinary server logs — IP address, timestamp, page requested, user agent — which are used for security and to keep the site up, and are retained for 30 days. We do not combine those logs with anything else or use them to build a profile.
Requesting an instance
When you ask us for an instance we store:
| What | Why |
|---|---|
| Your email address | So a person can reply to you about setting it up. |
| Which plan you were looking at | So the reply is about the right one. |
| The page you submitted from | Same. |
| A timestamp | To keep the list in order. |
Nothing else: no IP address, no device identifier, no cookie. The list lives in a Google Sheet in our own Google account, and is processed by Google as described in their terms. We send one email when hosting opens. There is no newsletter, and the list is never sold, shared or used for anything else.
Your address is kept until hosting opens and we have written to you, or until you ask us to remove it, whichever comes first. To be removed, write to privacy@pathayam.app — no account or verification is needed, since the address itself is the whole record.
The demo
demo.pathayam.app is a shared, public instance filled with invented data. It resets periodically, and anything you type into it is visible to anyone else using it and is discarded at the next reset.
Do not enter real account numbers, real balances, a real PAN, or any other real personal or financial information into the demo.
Entering the demo sets one session cookie so the app knows which invented member you are viewing as. It is strictly necessary for the demo to function, expires with the session, and is not used for analytics. The demo's request log records method, path, status and duration — never query strings, form contents or amounts.
The hosted service
This section governs a hosted instance. Instances are set up by hand after you ask for one and we have agreed the plan and the region with you, so nothing here applies until that has happened and nothing is charged before it.
What we hold
| Category | Detail | Why |
|---|---|---|
| Account identity | Your email address and name, and a profile picture where your sign-in method supplies one. How you sign in is your choice: a password, which we hold only as a scrypt hash and never in a form that can be read back; your own identity provider over OpenID Connect; or Google. | To sign you in and to attribute each change to a person. |
| Household financial data | Everything you enter or import: accounts, balances, transactions, payees, envelopes, loans, holdings, a deposit's terms (rate, dates, principal), insurance policies, attachments such as receipts. Of a policy number, only the last four characters are kept. | It is the product. We process it to show it back to you. |
| Statement identity | Optional. Name, date of birth, PAN, mobile or card last-four, and where your banks need them an Axis or HDFC customer ID and the last six digits of an HSBC card, used to derive the password a bank sets on a statement PDF. Customer IDs are shown back to you masked. | So a statement opens without you typing a password every month. |
| Tax figures | Optional, and entered by you on the tax screen: gross income for a financial year, the deductions you claim — 80C, 80D, rent paid, HRA received, basic salary — tax deducted at source, the advance and self-assessment tax payments you record, and your own home-loan interest figure under 24(b) where you give one. A loan can also record what its house is used for (lived in or let out). Capital gains are read from sales already recorded in your portfolio, and home-loan interest from the loan's own schedule; nothing is fetched from anywhere. | To estimate tax under each regime and show which is lower. Held per person and per financial year, because income tax in India is assessed on an individual — one member's figures never enter another's estimate. |
| Billing | Plan, billing cycle, invoices, and a payment token. We never receive or store your full card number, CVV or UPI credentials. | To take payment and issue invoices. |
| Operational logs | Method, path, status, duration, and errors. Never query strings, form bodies, amounts or financial values. | To keep the service working and to investigate faults. |
Where it lives
Each customer gets their own SQLite database and their own container. Your data is not a row in a shared table alongside other customers'.
Hosted instances run on Fly.io, by default in its Singapore region — the closest one to India that Fly operates, since it retired its Mumbai region. Your data is therefore stored outside India unless you ask for another region, which we will agree with you before anything is deployed. We will name any change here, and write to affected customers, before anyone's data is stored anywhere.
Statement identity is never exported or logged
Statement identity — customer IDs and card digits included — and any connected-mailbox tokens are excluded from every export and from every log, by a test that asserts it. Statement passwords are derived, used to open the file, and discarded; only a description of which candidate worked is retained.
On your device
Apart from its sign-in cookie, the app keeps nothing on your device, with one exception. If you press Save on the Add form with no connection at all, that entry is kept in the app's browser storage until the connection is back and it has been sent. Until then it is stored unencrypted, so anyone holding the unlocked device could read it. Signing out clears it, and if another member signs in on the same browser, entries left by someone else are discarded unsent. This is the app's storage on your device; the website at pathayam.app still uses none.
Backups
While your plan is active, backups are taken on a schedule and a restore is verified. They are retained for 30 days on Solo, 90 days on Household and one year on Power, so a point in the past can be restored.
When a plan ends — you cancel, it expires, or payment fails — everything is deleted five days later: the live database, every backup, and the attachments. Nothing is archived, nothing is held back, and after those five days we cannot recover it for you even if you ask. Export before the five days are up.
Gmail
The hosted plans do not read your mailbox and never ask for access to it. Gmail ingestion exists only in the self-hosted version, where you supply your own Google project and consent to your own application. The scopes that version requests, and what is done with what they return, are set out under Google account data below.
The mail-forwarding add-on
If you take the forwarding add-on, you get an address like
u-7f3a@in.pathayam.app and set a filter in your own mail
client. What arrives at that address is parsed into a review row and the
original message is then deleted — within 90 days at the outside,
whatever else happens. Only messages you forward reach us; we hold no
access to your mailbox and cannot fetch anything ourselves.
Google account data
Where Pathayam is connected to a Google account it requests these scopes and no others. Sign-in is optional; Gmail access is separately optional and off until you turn it on.
| Scope | What it grants | Why it is asked for |
|---|---|---|
openid, email, profile |
Your Google account's email address, name and profile picture. | To sign you in, and to attribute each change to a person. Nothing else reads it. |
gmail.readonly |
Read-only access to your Gmail messages. | To find bank transaction alerts and statement PDFs, so they need not be downloaded and uploaded by hand. The search is built only from the bank senders you configure — no other message is ever requested. |
How Gmail data is used, stored and shared
- Used. Only messages from the bank senders you have configured are searched, and only to extract transaction details and open statement PDFs.
- Stored. Message bodies are not retained. Each message is parsed into the fields that matter — date, amount, merchant, account — and then discarded. Only those extracted records are kept, in the same review queue as a statement uploaded by hand.
- Shared. Never, with anyone, for any purpose. Gmail data is not sold, not used for advertising, and not used to train any model, human or automated.
- Retained. Extracted records stay until you delete them. The Google refresh token is kept only so the connection survives a restart; it is excluded from every export and from the audit log, and is never displayed on any screen.
Limited Use
Pathayam's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Withdrawing access
- Disconnect Gmail from Settings inside the app. The stored refresh token is deleted immediately.
- Revoke the application entirely at your Google account permissions page.
- Neither removes records already extracted into your own ledger; those are yours, and you delete them as you would any other row.
Who else processes your data
| Processor | What for | What they see |
|---|---|---|
| Fly.io (Singapore by default) | Running the service | Everything stored, as our infrastructure provider. Another region on request. |
| Razorpay | Taking payment | Your name, email, and the payment instrument. They hold the card details; we do not. |
| Cloudflare | Serving the website, and counting visits to it | The request itself as the network in front of us, and — on pathayam.app only — the page, referrer, browser, country and load time. No cookie, no identifier that outlives the visit. |
| Google (only if you choose it) | Sign-in | That you signed in to Pathayam. Not used at all if you sign in with a password or your own identity provider. |
| The sheet that holds instance requests | The email address you sent, and the plan and page it came from |
We do not sell personal data, do not share it for advertising, and do not use it to train models. Where a processor is outside India, the transfer is made under the terms permitted by the DPDP Act.
Your rights
Under the Digital Personal Data Protection Act, 2023, you may:
- Get a copy. Every plan has an export endpoint returning everything in an open format, at any time, without asking us.
- Correct it. Every figure in the app is editable by you directly.
- Erase it. Ask, and it goes immediately. Otherwise ending a plan erases everything five days later, backups included.
- Nominate someone to exercise these rights if you die or become incapacitated.
- Complain to us first, and then to the Data Protection Board of India if we have not resolved it.
Security
Traffic is served over HTTPS. Sign-in is a password held only as a scrypt hash, or your own identity provider or Google, both over OAuth with PKCE. Session tokens are held as hashes. Writes require a same-origin check. API tokens are scoped, revocable, stored hashed, and cannot reach token management, member administration, passwords, sessions or the Gmail connection.
The database is not encrypted at rest beyond the disk encryption our hosting provider applies. Anyone with the database file has its contents; we restrict that access to what running the service requires.
If a personal data breach occurs, we will notify the Data Protection Board and every affected user, as the Act requires.
Children
The hosted service is not offered to anyone under 18. We do not knowingly collect a child's personal data. If you believe a child's data has reached us, write and we will delete it.
Changes
If this policy changes, the date at the top changes with it. A change that materially affects what we hold or who processes it will be sent to the email address on your account before it takes effect.
Contact and grievances
Write to privacy@pathayam.app. Grievances reach the same address and are answered within 30 days.
See also the terms of service.