Privacy policy

Who we are

Okanora is a personal finance tracking app, developed and operated by Gaurav Bhalerao, based in Pune, India. In this policy, "we", "us" and "Okanora" refer to the person and systems operating the app. "You" refers to anyone using Okanora.

What we collect

What you give us

• Your email address, if you sign in with an email code.
• Nothing at all, if you use Guest mode — you can try Okanora without giving us your name, email, or phone number.
• The checklist, budget and savings-goal information you type into the app: bill names, amounts, due dates, categories, notes, savings goals, and whether a bill has been paid.

What we get from Google

If you choose "Sign in with Google", Google shares your email address, your name, and your Google account ID with us. We don't receive your profile photo or any other Google data.

What's collected automatically

• A device ID, stored on your device, used to recognize your device across sessions.
• Your device name and platform (e.g. Android), and a device-level session identifier, used to keep you logged in securely and to let you see and log out of your other sessions.
• Your IP address and browser/app information, recorded only when you give consent to this policy, as proof that consent was given.
• A push notification token, if you allow notifications, used to send you reminders.
• A one-time login code, stored only as a scrambled (hashed) value, never in plain text.

Why we use your data

We use your data to run the features you're using: creating your account, saving your checklists, sending the reminders and confirmations the app is built to send, and keeping your account secure. This is the basis of providing you the service you signed up for.

Where a feature is optional — like signing in with Google, or (once available) WhatsApp logging — we only use the related data because you chose to turn that feature on. You can turn it back off, or stop using it, at any time.

How you sign in

• Email code (OTP). We send a 6-digit code to your email. We never store the code itself — only a scrambled version of it, which we check your entry against. The code expires after a short time and can only be used once. We also limit how many codes can be requested or guessed in a short period, to stop anyone from trying to break in.
• Google sign-in. We verify your Google sign-in token directly with Google, and read only your email, name and Google account ID from it.
• Guest mode. You can use Okanora without signing in at all. Your checklists and data are still saved, tied to a temporary guest account on your device. If you later add an email or sign in with Google, that same guest account becomes your permanent account — your data isn't lost or recreated, it just gets linked to your login.
• Staying signed in. When you log in, we issue a login session tied to your device. We store only a scrambled version of that session token, never the real one. Sessions expire automatically after a period of inactivity, and you can view and log out of other devices at any time from Settings > Security > Manage sessions.

WhatsApp logging and AI-assisted parsing (coming soon)

Okanora is planning a feature that lets you log an expense by sending a WhatsApp message, with the message automatically turned into a checklist entry. In the app, this currently appears as "Coming soon" and cannot be turned on yet. Here's how it's designed to work once it's available, so you know what to expect:

• You'd need to opt in and link a phone number to your account. This is off by default.
• When you send a WhatsApp message, we'd store the message text, a record of the WhatsApp exchange, and the reply we send back.
• To turn your message into a checklist entry, we send the text of your message (not your name, email, or account ID) to OpenAI, an AI provider, which identifies the amount, description and category. We then check that category against our own list before saving anything.
• We'd store the AI's response alongside the message, so we can show you what was logged and troubleshoot if something looks wrong.
• You'd be able to turn this feature off at any time, and deleting your account deletes everything stored this way.

We don't have confirmation from OpenAI on whether it retains or trains on this text beyond processing your request, so if that matters to you, please avoid sending anything in a WhatsApp message you wouldn't want processed by a third-party AI provider, once this feature launches.

Who we share data with

We share data only with the outside services that help us run Okanora, and only the data each one needs to do its job:

• Google — to verify your sign-in, if you use "Sign in with Google".
• Resend — to send your one-time login codes by email.
• Firebase (Google) — to deliver push notifications to your device, if you've enabled them.
• Gupshup and OpenAI — once WhatsApp logging is available, to send/receive WhatsApp messages and to parse their text into checklist entries.
• MongoDB — our database provider, which stores your account data.

We do not sell your data. We do not show you ads or use advertising networks — Okanora has no advertising or analytics SDKs built in. Okanora does not connect to your bank account, does not move money, and does not read your SMS messages — the app doesn't request any of those permissions.

How long we keep your data

We keep your checklists, settings and account information for as long as your account exists. Specific items have their own limits:

• One-time login codes expire after a short time (10 minutes) and are cleared out automatically.
• Login sessions expire automatically (access sessions after 20 minutes of no refresh, and the underlying session after 60 days); we also run a daily cleanup of expired sessions and codes.
• WhatsApp message logs and AI responses, once that feature is live, don't currently have a separate expiry — they're kept until you turn the feature off and delete your account (deleting your account removes them).

When you delete your account, we delete your checklists, settings, savings goals, notifications, push tokens, login sessions, and (once live) your WhatsApp logs, right away. Two narrow exceptions: we keep a record that you gave consent to this policy (with your identifying details removed) as proof of compliance, and we keep an anonymized internal log of a few account actions (like account creation or deletion) that cannot be traced back to you, since it never stores your actual account ID — only a one-way scrambled version of it.

International data transfers

Some of the services we rely on — including Google, Resend, Firebase, and (once live) Gupshup and OpenAI — may process data outside India, including in the United States. We only share the minimum data those services need to do their job, and we choose providers that are widely used for this purpose. If international transfers matter to you, you can avoid using the optional features (like Google sign-in or WhatsApp logging) and stick to email-code sign-in instead.

Security

• We use secure, encrypted (HTTPS) connections between the app and our servers.
• Okanora has no password to steal — login is only by one-time code or Google sign-in.
• Login codes and session tokens are stored as scrambled (hashed) values, never in plain readable form.
• We limit how many login attempts can happen in a short period, to protect against automated guessing.
• You can see and log out of other devices signed in to your account at any time.

No system is perfectly secure, and we can't guarantee that data will never be exposed, but these are the protections currently built into Okanora.

Your rights

Wherever you're located, you can ask us to:

• Access the personal data we hold about you.
• Correct inaccurate data — most of this you can also edit directly in the app.
• Delete your account and data — you can do this yourself from Settings, see our Delete account page.
• Withdraw consent for optional features, like Google sign-in or WhatsApp logging, by turning them off or by not using them.
• Object to how we use your data, or ask questions about it.

To ask for a copy of your data or to exercise any of these rights, email us at contact.okanora.app@gmail.com. We don't currently have an automatic "export my data" button in the app, so we'll handle these requests manually.

India (Digital Personal Data Protection Act, 2023)

If you're in India, the DPDP Act applies. We process your personal data for the purposes described in this policy, with your consent where consent is the basis for a feature (such as Google sign-in or WhatsApp logging). You can withdraw consent at any time by not using those features, or by deleting your account.

If you have a grievance about how we handle your personal data, you can contact our Grievance Officer, Gaurav Bhalerao, at contact.okanora.app@gmail.com.

EU / UK (GDPR)

If you're in the EU or UK, we process your data on these legal bases: to perform the service you've asked for (your account and checklists), with your consent for optional features, and to comply with legal obligations where they apply. You have the rights described above, plus the right to lodge a complaint with your local data protection regulator (in the UK, the Information Commissioner's Office) if you believe we haven't handled your data properly.

California (CCPA/CPRA)

If you're a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of the sale or sharing of your personal information. We do not sell or share your personal information, and we have no advertising network to opt out of. You can exercise your rights by contacting us at contact.okanora.app@gmail.com.

Children

Okanora is intended for people aged 18 and older. We don't knowingly collect data from anyone under 18. If you believe a child has created an account or given us data, please contact us and we'll remove it.

Local storage on your device

Okanora stores a few things directly on your device, not just on our servers: a device identifier, your theme preference, whether you've seen the welcome screens, and (if enabled) your push notification token. Your login session is stored in your device's secure storage. Most of these are cleared when you log out; your device identifier and app preferences stay on your device since they're not personal data, and are only removed if you clear the app's storage or uninstall it.

Changes to this policy

If we make a material change to this policy, we'll update the "Last updated" date above and let you know through an in-app notice or by email, where reasonably possible. We recommend checking this page from time to time.

Contact

Questions about this policy, or about your data? Email us at contact.okanora.app@gmail.com.