Privacy Policy
Effective date: 12 June 2025
This Privacy Policy explains how Chelavu("we", "our", "us") collects, uses, stores, and protects your personal information when you use our application at https://chelavu.in. By using Chelavu, you agree to the practices described in this policy.
1. Overview
Chelavu is a personal finance web application that helps you track daily UPI spending, manage budget pots, and monitor money you have lent or borrowed. We are committed to keeping your data private, minimal, and secure.
- ✓We never connect to your bank account directly or scrape your financial data from any external source.
- ✓The optional SMS Auto-Sync plugin reads bank transaction SMS on your device only — message content is never uploaded to our servers.
- ✓We do not sell your personal data to advertisers or any third party.
- ✓You can request deletion of your account and all associated data at any time.
2. Data We Collect
We collect only the data necessary to provide the service.
Account data
Your name, email address, and hashed password when you sign up with email. If you sign in with Google, we receive your name, email, and Google profile picture from Google OAuth.
App content you create
Expenses (amount, category, date, optional note), budget pots (category, amount, period), and lend/borrow records (friend name, amount, dates, notes) that you manually enter into the app. This data is stored in your account and is private to you.
Payment data
When you subscribe to a paid plan, your mobile number is passed to our payment processor Cashfree. We do not store your card number, UPI ID, or any payment credentials on our servers. Cashfree processes and stores payment data under their own privacy policy.
Technical & usage data
Anonymised page views and interaction events collected by Vercel Analytics and Vercel Speed Insights. Error reports and stack traces collected by Sentry when the app crashes or encounters an error. These may include your browser type, operating system, and the page you were on when an error occurred. IP addresses are not stored by us directly.
Session data
An authentication session token is stored in a secure HTTP-only cookie to keep you logged in. This token expires automatically after a period of inactivity.
3. SMS Permission (Android)
The SMS Auto-Sync plugin is an optional paid add-on for the Android app. When you install and enable it, the app requests the READ_SMS and RECEIVE_SMS permissions. Here is exactly what we do — and do not — do with that access.
What we read
Only SMS messages that contain a transaction amount (₹ / Rs / INR) anda debit or credit keyword (e.g. "debited", "credited", "spent"). OTP messages and all personal or non-financial SMS are discarded immediately without being stored.
Where processing happens
All SMS parsing happens entirely on your device. The raw SMS body, sender address, and account hint are stored only in the app's local on-device database — they are never transmitted to our servers or any third party.
What reaches our servers
When you accept a draft transaction, only the numeric amount and the pot you assigned it to are saved to your account. No SMS text, sender name, or bank account hint ever leaves your device.
Your control
You can revoke the SMS permission at any time in Android Settings → Apps → Chelavu → Permissions. The rest of the app continues to work normally without it. The SMS Auto-Sync plugin is Android-only and does nothing on iOS or web.
This SMS use is declared to Google Play under the "SMS-based money management" exception and complies with Google Play's SMS & Call Log Permissions Policy.
4. How We Use Your Data
- →To create and manage your account and authenticate you securely.
- →To store and display the expense, budget, and lend/borrow data you enter, including transactions you accept from the SMS Auto-Sync plugin.
- →To send transactional emails such as welcome messages and password reset links via Resend.
- →To process subscription payments and verify your plan entitlements via Cashfree.
- →To detect and fix bugs and crashes using Sentry error reports.
- →To understand how the product is used at an aggregate level using Vercel Analytics, so we can improve it.
- →To enforce our Terms of Service and prevent abuse.
We do not use your data for advertising, profiling, or selling to any third party.
5. Third-Party Services
We use the following third-party services to operateChelavu. Each has their own privacy policy governing the data they handle.
| Service | Purpose | Data shared |
|---|---|---|
| MongoDB Atlas | Database — stores all app data | All account and app content data |
| Vercel | Hosting and deployment | Server logs, request metadata |
| Vercel Analytics & Speed Insights | Anonymised usage analytics | Page views, interaction events (no PII) |
| Sentry | Error tracking and crash reporting | Error messages, stack traces, browser/OS info |
| Resend | Transactional email delivery | Your email address and name |
| Cashfree Payments | Subscription and one-time payment processing | Your mobile number, plan selected, payment status |
| Google OAuth | Optional Google Sign-In | Name, email, and profile picture from your Google account (only if you choose Google sign-in) |
6. Payments
All payments are processed by Cashfree Payments (a certified PCI-DSS compliant Indian payment gateway). When you initiate a subscription or one-time payment:
- →Your mobile number is sent to Cashfree to create a payment session.
- →Card numbers, UPI IDs, net banking credentials, and OTPs are entered directly on Cashfree's secure payment page — we never see or store them.
- →After successful payment, Cashfree notifies us of the payment status so we can activate your plan. We store only the plan ID and activation status against your user account — no payment instrument details.
- →For refund or billing queries, contact us at support@chelavu.in.
8. Data Retention
- →Your account data and app content (expenses, budgets, lend/borrow records) are retained for as long as your account is active.
- →When you request account deletion, we permanently delete your profile and all associated app content within 30 days.
- →Aggregated and anonymised analytics data (which cannot identify you) may be retained for longer for product improvement purposes.
- →Payment records maintained by Cashfree are subject to Cashfree's own retention and regulatory obligations.
9. Security
We take the following measures to protect your data:
- ✓All data is transmitted over HTTPS/TLS encryption.
- ✓Passwords are never stored in plain text — they are hashed using a strong cryptographic algorithm.
- ✓Authentication sessions are managed with secure, HTTP-only cookies to prevent client-side script access.
- ✓Access to the production database is restricted to authorised services only — no public exposure.
- ✓Rate limiting is enforced on all API endpoints to prevent abuse and brute-force attacks.
- ✓Error monitoring via Sentry allows us to detect and respond to security anomalies quickly.
No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@chelavu.in.
10. Children's Privacy
Chelavu is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@chelavu.in and we will delete it promptly.
11. Your Rights
You have the following rights over your personal data:
Access
Request a copy of the personal data we hold about you.
Correction
Update your name or email from your profile settings.
Deletion
Request permanent deletion of your account and all your data.
Portability
Request an export of your expense data in a structured format.
Objection
Object to how we process your data in specific circumstances.
Withdraw consent
Withdraw consent for optional features such as marketing emails at any time.
To exercise any of these rights, email us at support@chelavu.in. We will respond within 30 days.
12. Indian Law Compliance
Chelavu operates from India and complies with the following Indian data protection laws:
- →Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — we implement reasonable security practices and a written privacy policy for sensitive personal data.
- →Digital Personal Data Protection Act, 2023 (DPDPA) — as a Data Fiduciary, we collect and process personal data only for lawful purposes, provide notice at the time of collection, and honour your right to erasure and grievance redressal.
Our data is stored on MongoDB Atlas servers. Data may reside on infrastructure in regions including India and the United States. We apply appropriate contractual safeguards for any cross-border transfers.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and — where appropriate — notify you by email. Your continued use of Chelavu after any change constitutes your acceptance of the updated policy.
We encourage you to review this page periodically to stay informed about how we protect your information.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
Chelavu
Email: support@chelavu.in
Website: https://chelavu.in
We aim to respond to all privacy-related inquiries within 30 calendar days.