Privacy policy

Ekatra is a personal-finance app that brings your accounts, cards, investments, loans and insurance onto one screen. This policy explains what it collects, why, who it goes to, how long it stays, and what you can do about it. It covers the website at ekatralabs.com, the app at app.ekatralabs.com, and the Android app.

Ekatra is early-stage software built by a very small team. Where a practice is not yet as mature as we would like, this policy says so rather than papering over it — see Where we fall short.

1. What we collect

There are three sources, and you control all three. Nothing arrives automatically from a bank — Ekatra has no connection to your bank.

a. Account and identity data

When you sign in with Google, we receive and store a Google account identifier, your email address, your name and your profile picture URL, plus the date you signed up. During onboarding you may optionally add a phone number; it is optional and the product works fully without it.

We do not receive or store your Google password, and Ekatra never asks for netbanking credentials, card PINs, CVVs or OTPs. There is no field for them anywhere in the product and no code path that would use one.

b. Financial data you add

This is the substance of the product, and every row of it originates from you — a document you upload, an email attachment you approve, or a form you fill in:

• Accounts and balances; transactions (date, merchant, amount, category, method, reference numbers)
• Credit and debit cards — issuer, product name, last four digits, limit, dues, statement and due dates
• Investment holdings, loans and their outstanding amounts, and insurance policies
• Things you create inside the app: budgets, savings goals, split groups and expenses, recurring-payment rules, and your chat messages with the assistant

We store the last four digits of a card, not the full number. Full account numbers may appear in the rows a statement yields, because they are printed on the statement you supplied.

c. Documents you upload or import

Bank and card statements, loan documents, insurance policies and investment statements — as PDF, CSV or Excel. Section 3 covers exactly what happens to the file.

d. Technical and usage data

We use Google Analytics 4 in cookieless mode. It runs with analytics_storage denied (Google's Consent Mode), so it sets no analytics cookies and stores nothing in your browser. That is why you have not been asked to accept cookies. It still collects standard web-analytics data (pages viewed, approximate location from IP, device and browser, referrer), and because no identifier is stored, each visit is counted separately rather than linked to your previous ones. Our servers keep short-lived operational logs of requests, which can include IP addresses, for debugging and abuse prevention. We do not run advertising trackers, session recording or heatmaps, and we do not sell audience data.

2. Why we use it, and on what basis

We do not use your financial data to build advertising profiles, we do not sell it, and we do not share it with data brokers. Your financial rows are never fed into analytics.

3. What happens to a document you upload

A file goes through a short pipeline: text extraction, an AI pass that identifies the document type and pulls out structured rows, then a mapping step that files those rows into your accounts.

The raw file is never written to disk or object storage. It exists in server memory for the duration of the job and is then discarded. If the document is password-protected, the password you type is used once to open it and is not stored.

4. Gmail access, precisely

Connecting Gmail is optional — the product works fully without it. If you connect it, Ekatra requests the read-only gmail.readonly scope, and the search is deliberately narrow:

• Only listed senders, by default the whole catalogue. The search covers a published list of roughly ninety banks, card issuers, insurers and investment platforms — nothing outside it. You can narrow that list to only the institutions you bank with at any time; an institution you leave out is never queried, not merely filtered out of the results afterwards.
• No keyword matching. The search matches on sender domain only. There is no subject-line or body-keyword search, so a personal email cannot enter the result set.
• Last six months, incoming mail only — sent mail and drafts are excluded.
• Matching statements import themselves. Connecting Gmail is the approval — there is no separate review step. Only an attachment the filter matched is ever downloaded, and only as part of that automatic import.
• Bytes are read once, at import, then discarded — exactly as with an upload. Every import is logged in your statement history and can be undone from there.
• The refresh token is encrypted at rest with AES-256-GCM. Disconnecting revokes it with Google and stops the import immediately; deleting your account revokes it too.

Ekatra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Gmail data is used only to find and import the statement documents you approve, it is not transferred to anyone except as needed to provide that feature, it is not used for advertising, and no human at Ekatra reads it. The in-app "How email import works" sheet states these same guarantees, with every line mapped to the code that enforces it.

5. AI processing

Two features send data to a large-language-model provider:

• Document parsing. The extracted text of the document you uploaded is sent so the model can identify it and return structured rows.
• AI chat. A JSON summary of your accounts, cards, loans, insurance, goals, holdings, recurring payments and the last six monthly totals is sent along with your question, so the answer reflects your actual numbers instead of guesses.

The provider is configurable and is one of AWS Bedrock, Anthropic, Google (Gemini) or OpenRouter. These are commercial API endpoints used as processors on our behalf. We do not send your name, email or phone number as part of a parsing or chat request, but note that a statement's text can itself contain identifying details, because it is your statement.

6. Who your data goes to

We share data with the service providers needed to run Ekatra, and with no one else. We do not sell personal data. The list, honestly and completely:

We may also disclose data if we are legally required to, or where it is necessary to protect the safety or rights of a person or of Ekatra. We would push back on an over-broad request rather than treat one as routine.

These providers operate infrastructure outside India, so your data may be processed outside the country you are in.

7. How long we keep it

• Your financial rows and account: for as long as your account exists. There is no timed purge — the data is the product, and it is yours to delete.
• Uploaded files: not kept at all (Section 3). Only the upload-history entry survives.
• Chat messages: until you delete the thread or your account.
• After you delete your account: every financial row across every collection is erased. What remains is a minimal tombstone — your email and name, flagged deleted — so the address cannot be silently re-registered and so we can honour a later query about the deletion. Identity fields are stripped, and a fresh sign-up starts clean.
• Operational logs: short-lived, retained by our hosting and database providers under their own retention windows.
• Analytics: retained per Google Analytics' configured retention period.

Backups held by our database provider may retain a copy for a short period after a deletion, until those backups roll over.

8. Your controls

These are buttons in the product, not a support queue. India's Digital Personal Data Protection Act gives you rights of access, correction, erasure and grievance redressal; the equivalent controls are built in:

If a control does not work or you want something we have not built a button for, write to sohan.28sarma@gmail.com and a human — the one who wrote the code — will handle it.

9. Security

Data is transmitted over HTTPS and stored in a managed database with access restricted to the application. Sessions use signed tokens. Gmail refresh tokens are encrypted at rest with AES-256-GCM. Uploaded files are never persisted, so a breach of stored data cannot expose your original statements.

No system is perfectly secure, and Ekatra has not had an independent third-party security audit — see Section 12. Our security page goes into the mechanics in detail. To report a vulnerability, mail sohan.28sarma@gmail.com.

10. Children

Ekatra is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

11. Cookies and local storage

Ekatra sets no cookies at all — not on the marketing site, not in the app. Analytics runs in cookieless mode (see above), which is why there is no cookie banner to dismiss. The app does use your browser's local storage — a different mechanism, never sent to us automatically — to keep you signed in and to remember preferences like theme and whether you are viewing sample data. Clearing site data signs you out and resets those preferences; it does not delete anything on the server.

12. Where we fall short

A privacy policy that only lists strengths is marketing. Ekatra is early, and it is worth being plain about the limits:

• There has been no independent third-party security audit or penetration test. That is a real gap and we would rather name it than let a reassuring page imply otherwise.
• Ekatra is not an RBI-regulated entity and holds no financial licence. It reads documents you give it; it cannot touch or move money. It is not an Account Aggregator.
• Statement parsing relies on an AI model reading a document correctly, and it can misread. Every imported row is editable, and you should sanity-check figures that matter.
• We rely on third-party providers (Section 6) whose own practices we do not control beyond choosing them and their contractual terms.

13. Changes to this policy

If this policy changes materially, we will update the date at the top and, for changes that affect how your data is used, tell you in the app before they take effect. The history of this page is visible in the project's public commit log.

14. Contact and grievances

For any privacy question, request or complaint — including a grievance under the Digital Personal Data Protection Act — write to sohan.28sarma@gmail.com. We aim to respond within 30 days. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India.