Cashflow24x7 — Privacy Policy

This policy covers the Cashflow24x7 mobile app (“the app”), built and designed by Yogtra Systems Private Limited. It is separate from the yogtra.com website privacy policy, which covers this website only.

Information you provide

• Account information. You can create an account with an email address and password, or by signing in with Google. With email sign-up, your password is handled by our authentication provider (Supabase) and stored only as a secure hash — we never see or store your plaintext password. With Google Sign-In, Google verifies your identity and shares your verified email address with us via a secure token exchange; we do not receive your Google password.
• Financial information you enter or import. Transactions (amount, date, type, note), accounts and balances, categories, transfers, tags, recurring transactions, budgets, and savings goals.
• Shared-expense information. If you use the group/split or household features, we store the group details, member names and email addresses you add, split shares, and settlements so the shared ledger stays consistent across members.
• Receipt images. If you attach a photo of a receipt, that image is uploaded to our secure storage so it can sync across your devices and, where applicable, to household members.
• Goals content. Any goals, notes, or affirmations you create in the app’s goals features.

Information created by using the app

• Usage and diagnostic data. We use Sentry to collect crash reports and error diagnostics (error type, stack trace, device model, OS version, app version). This is configured to avoid capturing the contents of your financial data.
• Subscription status. If you purchase a subscription, our payments provider (RevenueCat, on top of Google Play Billing) records your purchase and entitlement status. Payment card details are handled entirely by Google Play — we never receive or store them.

SMS messages (read and processed on your device only)

If you grant the optional SMS permission, the app reads transaction alert messages from your bank so it can suggest transactions for you to review. This processing happens entirely on your device:

• SMS content is parsed locally, in the background, on your phone.
• The raw text of your messages is stored only in a local database on your device and is never transmitted to our servers, our payments provider, our crash-reporting provider, or any third party.
• Only the resulting transaction that you choose to confirm (amount, date, category, etc.) is saved and synced — the same as if you had typed it in yourself. The original message text is not part of that synced record.
• You can decline or revoke the SMS permission at any time in your device settings; the rest of the app continues to work normally.

We do not sell, rent, or share your SMS data, and we do not use it for advertising.

How we use your information

• To create and secure your account and authenticate you.
• To store your financial records and sync them across your devices.
• To power shared/household expense splitting between the people you invite.
• To display your receipts.
• To suggest transactions from bank SMS alerts (on-device, as described above).
• To provide, restore, and manage your subscription.
• To diagnose crashes and fix bugs.

We do not use your financial data for advertising, and we do not sell your personal information.

How your information is shared

We share information only with the service providers that make the app work, and only to the extent needed:

• Supabase (backend & storage) — account authentication, database sync, and receipt image storage. Receives your account email, the financial data you enter, and receipt images.
• Sentry (crash reporting) — stability and bug fixing. Receives diagnostic/crash data and technical device info.
• RevenueCat and Google Play Billing — subscription management and payments. Receive your purchase/entitlement status; payment details are handled by Google, not us.
• Google Sign-In — optional, only if you choose to sign in with Google. Google authenticates you and shares your verified email address with us; your use of Google Sign-In is also subject to Google’s own privacy policy.

These providers act as our processors and are contractually bound to protect your data. We do not share your data with advertisers or data brokers. We may disclose information if required by law, or to protect the rights, safety, and security of our users or the public.

Where your data is stored

Your synced data (account, financial records, receipt images) is stored on secure servers operated by Supabase in the Mumbai (ap-south-1), India region. Diagnostic data is processed by Sentry. Data stored locally on your device, including any SMS-derived review items, stays on your device.

Data retention and deletion

• Your data is retained for as long as your account is active.
• You can delete your account at any time from within the app (Settings → account management). Deleting your account removes your synced financial data and receipts from our systems. Local data is removed when you delete the app or clear its storage.
• Some limited records may be retained where required for legal, tax, or fraud-prevention purposes, or in routine backups, for a limited period before being overwritten.
• If you would like us to delete your data and cannot do so in-app, email admin@yogtra.com and we will action your request.

Security

• Encryption in transit (HTTPS/TLS) between the app and our servers.
• Row-level access controls so you can only access your own data and, for shared groups, only data for groups you belong to.
• Authentication managed by Supabase; we never store your plaintext password.
• Crash logs configured to avoid capturing your financial content.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to promptly address any issues.

Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can:

• Access and edit your data directly in the app.
• Export your data using the in-app CSV/PDF export features.
• Delete your account and data in-app.
• Control permissions (SMS, notifications, camera/photos for receipts) in your device settings.

To exercise any right that isn’t available in-app, contact admin@yogtra.com. You can also use our Cashflow24x7 data deletion page.

Children

The app is not directed to children, and we do not knowingly collect personal information from children under the age of 13 (or the minimum age of digital consent in your country). If you believe a child has provided us personal information, contact us and we will delete it.

Permissions we request

• SMS (READ_SMS) — optional; used only to detect bank transaction alerts on-device, as described above. The app does not run a background SMS receiver and does not read message history beyond what is needed to suggest transactions.
• Notifications — to send reminders and streak/affirmation notifications you opt into.
• Camera / Photos — only when you choose to attach a receipt image.
• Internet — to sync your data and manage your subscription.

Declining any permission only disables the related feature; the rest of the app continues to work.

Changes to this policy

If this policy changes, the updated version will be posted at this page with a new “last updated” date.

Governing law

This policy is governed by the laws of India, and any disputes are subject to the exclusive jurisdiction of the courts at Bhubaneswar, Odisha.

Contact

Questions about the app or this policy? Email admin@yogtra.com. For data or deletion requests, use our Cashflow24x7 data deletion page.

Related pages

See our Terms of Service for the app’s terms, and our Data Deletion Request page for how to delete your account and data.