Privacy policy

Ekatra is a personal-finance app that brings your accounts, cards, investments, loans and insurance onto one screen. This policy explains what it collects, why, who it goes to, how long it stays, and what you can do about it. It covers the website at ekatralabs.com, the app at app.ekatralabs.com, and the Android app.

Ekatra is early-stage software built by a very small team. Where a practice is not yet as mature as we would like, this policy says so rather than papering over it — see Where we fall short.

1. What we collect

There are three sources, and you control all three. Nothing arrives automatically from a bank — Ekatra has no connection to your bank.

a. Account and identity data

When you sign in with Google, we receive and store a Google account identifier, your email address, your name and your profile picture URL, plus the date you signed up. During onboarding you may optionally add a phone number; it is optional and the product works fully without it.

We do not receive or store your Google password, and Ekatra never asks for netbanking credentials, card PINs, CVVs or OTPs. There is no field for them anywhere in the product and no code path that would use one.

b. Financial data you add

This is the substance of the product, and every row of it originates from you — a document you upload, an email attachment you approve, or a form you fill in:

• Accounts and balances; transactions (date, merchant, amount, category, method, reference numbers)
• Credit and debit cards — issuer, product name, last four digits, limit, dues, statement and due dates
• Investment holdings, loans and their outstanding amounts, and insurance policies
• Things you create inside the app: budgets, savings goals, split groups and expenses, recurring-payment rules, and your chat messages with the assistant

We store the last four digits of a card, not the full number. Full account numbers may appear in the rows a statement yields, because they are printed on the statement you supplied.

c. Documents you upload or import

Bank and card statements, loan documents, insurance policies and investment statements — as PDF, CSV or Excel. Section 3 covers exactly what happens to the file.

d. Technical and usage data

The website and marketing pages use Google Analytics 4, which sets cookies and collects standard web-analytics data (pages viewed, approximate location from IP, device and browser, referrer). Our servers keep short-lived operational logs of requests, which can include IP addresses, for debugging and abuse prevention. We do not run advertising trackers or sell audience data.

2. Why we use it, and on what basis

We do not use your financial data to build advertising profiles, we do not sell it, and we do not share it with data brokers. Your financial rows are never fed into analytics.

3. What happens to a document you upload

A file goes through a short pipeline: text extraction, an AI pass that identifies the document type and pulls out structured rows, then a mapping step that files those rows into your accounts.

The raw file is never written to disk or object storage. It exists in server memory for the duration of the job and is then discarded. If the document is password-protected, the password you type is used once to open it and is not stored.

4. Gmail access, precisely

Connecting Gmail is optional — the product works fully without it. If you connect it, Ekatra requests the read-only gmail.readonly scope, and the search is deliberately narrow:

• Only senders you choose. Before the first scan you pick which institutions may be searched, from a published catalogue of roughly ninety banks, card issuers, insurers and investment platforms. An institution you did not pick is never queried — not merely filtered out of the results afterwards.
• No keyword matching. The search matches on sender domain only. There is no subject-line or body-keyword search, so a personal email cannot enter the result set.
• Last six months, incoming mail only — sent mail and drafts are excluded.
• A scan opens nothing. It reads message metadata and attachment descriptors. No attachment is downloaded until you approve the import.
• Bytes are read once, at import, then discarded — exactly as with an upload.
• The refresh token is encrypted at rest with AES-256-GCM. Disconnecting revokes it with Google, and deleting your account revokes it too.

Ekatra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Gmail data is used only to find and import the statement documents you approve, it is not transferred to anyone except as needed to provide that feature, it is not used for advertising, and no human at Ekatra reads it. The in-app "How email import works" sheet states these same guarantees, with every line mapped to the code that enforces it.

5. AI processing

Two features send data to a large-language-model provider:

• Document parsing. The extracted text of the document you uploaded is sent so the model can identify it and return structured rows.
• AI chat. A JSON summary of your accounts, cards, loans, insurance, goals, holdings, recurring payments and the last six monthly totals is sent along with your question, so the answer reflects your actual numbers instead of guesses.

The provider is configurable and is one of AWS Bedrock, Anthropic, Google (Gemini) or OpenRouter. These are commercial API endpoints used as processors on our behalf. We do not send your name, email or phone number as part of a parsing or chat request, but note that a statement's text can itself contain identifying details, because it is your statement.

6. Who your data goes to

We share data with the service providers needed to run Ekatra, and with no one else. We do not sell personal data. The list, honestly and completely:

We may also disclose data if we are legally required to, or where it is necessary to protect the safety or rights of a person or of Ekatra. We would push back on an over-broad request rather than treat one as routine.

These providers operate infrastructure outside India, so your data may be processed outside the country you are in.

7. How long we keep it

• Your financial rows and account: for as long as your account exists. There is no timed purge — the data is the product, and it is yours to delete.
• Uploaded files: not kept at all (Section 3). Only the upload-history entry survives.
• Chat messages: until you delete the thread or your account.
• After you delete your account: every financial row across every collection is erased. What remains is a minimal tombstone — your email and name, flagged deleted — so the address cannot be silently re-registered and so we can honour a later query about the deletion. Identity fields are stripped, and a fresh sign-up starts clean.
• Operational logs: short-lived, retained by our hosting and database providers under their own retention windows.
• Analytics: retained per Google Analytics' configured retention period.

Backups held by our database provider may retain a copy for a short period after a deletion, until those backups roll over.

8. Your controls

These are buttons in the product, not a support queue. India's Digital Personal Data Protection Act gives you rights of access, correction, erasure and grievance redressal; the equivalent controls are built in:

If a control does not work or you want something we have not built a button for, write to sohan.28sarma@gmail.com and a human — the one who wrote the code — will handle it.

9. Security

Data is transmitted over HTTPS and stored in a managed database with access restricted to the application. Sessions use signed tokens. Gmail refresh tokens are encrypted at rest with AES-256-GCM. Uploaded files are never persisted, so a breach of stored data cannot expose your original statements.

No system is perfectly secure, and Ekatra has not had an independent third-party security audit — see Section 12. Our security page goes into the mechanics in detail. To report a vulnerability, mail sohan.28sarma@gmail.com.

10. Children

Ekatra is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

11. Cookies and local storage

The marketing site sets Google Analytics cookies. The app itself uses your browser's local storage — not cookies — to keep you signed in and to remember preferences like theme and whether you are viewing sample data. Clearing site data signs you out and resets those preferences; it does not delete anything on the server.

12. Where we fall short

A privacy policy that only lists strengths is marketing. Ekatra is early, and it is worth being plain about the limits:

• There has been no independent third-party security audit or penetration test. That is a real gap and we would rather name it than let a reassuring page imply otherwise.
• Ekatra is not an RBI-regulated entity and holds no financial licence. It reads documents you give it; it cannot touch or move money. It is not an Account Aggregator.
• Statement parsing relies on an AI model reading a document correctly, and it can misread. Every imported row is editable, and you should sanity-check figures that matter.
• We rely on third-party providers (Section 6) whose own practices we do not control beyond choosing them and their contractual terms.

13. Changes to this policy

If this policy changes materially, we will update the date at the top and, for changes that affect how your data is used, tell you in the app before they take effect. The history of this page is visible in the project's public commit log.

14. Contact and grievances

For any privacy question, request or complaint — including a grievance under the Digital Personal Data Protection Act — write to sohan.28sarma@gmail.com. We aim to respond within 30 days. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India.