Privacy policy
This policy explains what information the Mohar app and its server collect, why, where it is kept, and how you can delete it. The data controller is iisiichaa. Questions: contact@iisiichaa.com.
What we collect
- Your profile, from Google Sign-In through Firebase Authentication: your email address, your name and a Firebase user ID. We do not receive your Google password.
- What you enter in the app: your accounts (for example cash, bank or wallet names and balances), transactions (amounts, dates, notes, merchants, categories), categories, reminders, and your settings and preferences.
- Bill photos, only if you choose to add them: photos of bills you take or pick in the app. See AI features below.
- Device information: an identifier for each device you sign in on, its push-notification token (Firebase Cloud Messaging), the app version and platform. Firebase App Check confirms requests come from the genuine app.
- Crash and error reports: when the app crashes, Firebase Crashlytics receives the crash details, device model and operating system version. When the server hits an error, Sentry receives the technical details of the error. Server error reports exclude IP addresses, sign-in tokens and the contents of your requests.
- Server logs: the IP address, time, address requested and app version of each request, used to keep the service secure and working.
We do not collect your contacts, location or SMS messages, or any photos other than the bills you choose to add.
How we use it
- To provide the service: store your records and sync them between your devices.
- To keep it secure: sign-in, preventing abuse and fraud, rate limiting.
- To read bill details from your bill photos, only if you have consented (see AI features).
- To fix problems: crash and error reports.
- To contact you about your account or important changes to the service.
We do not sell your data, share it with advertisers, show ads, or use your financial records for marketing.
AI features
Adding bill photos is optional. When you photograph or pick a bill in the app, the photo is uploaded and stored on our own server.
Only if you have given separate consent in the app for cloud AI reading, we send the photo to a cloud AI provider to read the bill details: merchant, PAN, bill number, VAT, totals and items. The provider acts as our processor and does not use the content to train its models. A bill may also contain details of other people or businesses, such as the seller’s PAN. You can withdraw your consent in the app.
Without that consent, no photo is sent to a cloud AI provider.
Where your data is kept
- Your records are stored on our own server in Nepal.
- Bill photos are stored on the same server, in our own self-hosted storage, and are included in the encrypted backups.
- Encrypted backups of the database are kept off-site in Cloudflare R2 object storage. They are encrypted on our server before upload, so Cloudflare cannot read them.
Service providers
We share data only with these providers, only as far as needed to run the service, and never for their own purposes:
- Google (Firebase): sign-in, App Check, push notifications and app crash reports.
- A cloud AI provider: reads bill details from your bill photos, only if you have consented to cloud AI reading.
- Cloudflare: carries all traffic between the app and our server (it encrypts the connection), and stores our encrypted backups.
- Sentry: server error reports, without personal data.
We may disclose information if Nepali law requires it, and we will tell you unless the law forbids it.
How long we keep it
- Your profile and records: until you delete them or your account.
- Items you delete in the app can be restored for 30 days and are removed permanently within 90 days.
- When you delete your account, your data is removed from our database immediately. Copies in encrypted backups expire within 35 days.
- Bill photos: until you delete your account. Deleting your account deletes your bill photos from our server, and copies in encrypted backups expire within 35 days.
- Server logs: up to 30 days, then deleted.
- Crash and error reports: up to 90 days.
Security
Connections to our server are encrypted (HTTPS). The server is reachable only through an encrypted tunnel, backups are encrypted, and access to the server is limited to the people who run it. Each user can only ever read their own records.
Your choices and rights
- See and correct your records at any time in the app.
- Withdraw your consent to cloud AI reading of your bill photos in the app.
- Get a copy of your data, or ask us anything about it, by emailing contact@iisiichaa.com.
- Delete your account in the app under Settings → Delete account. See how to delete your account for other ways and what is deleted.
Children
Mohar is not intended for children under 16, and we do not knowingly collect their data.
Changes to this policy
If we change this policy, we will update the date above and tell you in the app before a significant change takes effect.
Contact
iisiichaa · contact@iisiichaa.com