Legal
Privacy Policy
Last updated: 28 October 2026
Hisaab (“the app”, “we”, “us”) is a free web app for splitting shared expenses with friends, flatmates and groups, available at expt.inbuiltcode.com. It is created and operated by pankajsankhla.in. This policy explains what information the app collects, how it is used, who can see it, and the choices you have.
1. Information you give us
- Account details: your name, email address and password. Passwords are stored only as a one-way (bcrypt) hash, so nobody, including us, can read them.
- Group activity: groups you create or join (name, description, icon, members and their roles), expenses you add (description, amount, date, category, notes, who paid and how it is split), and payments you mark as paid (amount, method, an optional UTR/reference number and note, who recorded it and when).
- Payment details: UPI IDs and UPI QR code images you add so that others can pay you. We never ask for or store bank account numbers, card details or UPI PINs.
2. Signing in with Google (optional)
If you choose “Continue with Google”, Google shares the following with us, and nothing else: your Google account ID, your name, your email address and whether it is verified, and your profile picture URL.
We use this only to create your Hisaab account, sign you in, and show your name and photo to members of your groups. We never see your Google password, and we get no access to your Gmail, contacts, Drive or any other Google data. Sign-in is handled by Google Identity Services, under Google’s Privacy Policy.
Hisaab’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. Information collected automatically
- While you are signed in, we keep a session record with your IP address, your browser’s user agent (browser and device type) and the time of your last activity. This keeps you signed in and helps protect your account.
- To stop password guessing, failed sign-in attempts are counted for about one minute against the email address and IP address used.
- Our server keeps error logs for up to 14 days. These can include IP addresses and the pages that were requested.
4. Cookies
We only use cookies that the app needs to work: a session cookie, a security token that protects forms from forgery, and, if you choose “Keep me signed in”, a remember-me cookie that lasts up to 400 days or until you sign out. We do not use advertising, analytics or tracking cookies.
5. How we use information
- To run the app: your groups, expenses, balances and payment records.
- To show group members the information they need to split costs and settle up (see section 6).
- To keep accounts secure and to prevent abuse.
We do not sell, rent or share your personal information with advertisers, and we do not use it for advertising or profiling.
6. Who can see your information
- Members of your groups can see your name, email address and profile photo, along with that group’s expenses, payments and balances, including what you owe and what you are owed.
- Anyone who shares at least one group with you can see your UPI IDs and QR codes so they can pay you. Uploaded QR images are stored privately and are only shown to signed-in users who share a group with you.
- Anyone with a group’s invite link can see that group’s name and icon and its members’ names and photos before joining. Group admins can reset the invite link at any time.
7. Payments
Hisaab does not process, hold or move money. “Pay with UPI app” opens your own UPI app (such as Google Pay, PhonePe or Paytm) with the payee’s details filled in, and the payment happens entirely inside that app, under its own terms. Marking a payment as paid only creates a record in Hisaab. We cannot see or verify actual bank transactions.
8. Service providers
- Hostinger hosts the app, its database and uploaded QR images.
- Google provides “Sign in with Google”, only if you use it.
- WhatsApp opens only if you tap Share or Remind. It opens with a pre-filled message, and you decide whether to send it.
These providers process data only to deliver their services.
9. How long we keep data
- Account and group data: for as long as your account exists.
- Sessions: until you sign out or they expire.
- Error logs: up to 14 days.
- Items you delete (expenses, UPI IDs, QR codes, groups) are removed from the app straight away. Copies may remain in our hosting provider’s backups for a limited time before they are overwritten.
10. Deleting your account and your rights
You can delete your account yourself from Profile → Delete account once your balances in all groups are settled. This removes your name, email address, photo, password, Google link, UPI IDs, QR codes and sessions, and takes you out of all your groups.
Expenses and payments you shared with other people stay in those groups so that the other members’ balances remain correct, but they show as “Deleted user” instead of your name.
You can also ask us to access, correct or delete your data by contacting us through pankajsankhla.in. We act on requests within 30 days. If you signed in with Google, you can remove Hisaab’s access at any time at myaccount.google.com/permissions.
11. Security
The app is served only over HTTPS. Passwords are hashed, Google sign-in tokens are verified on our server using Google’s public keys, sign-in attempts are rate-limited, and QR images are not publicly accessible. No system is perfectly secure, but we take reasonable steps to protect your information.
12. Children
Hisaab is meant for people aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the app changes. The “Last updated” date at the top always shows the latest version. If we make important changes, we will announce them in the app.
14. Contact
For questions or requests about your privacy, contact us through pankajsankhla.in.