Privacy Policy

1. Who we are

Muktify (muktify.in) is a personal finance education tool operated in India. We help individuals understand their financial health through calculators and projections. We are not a bank, broker, or SEBI-registered investment adviser. As a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are responsible for the personal data you entrust to us. Muktify is intended for individuals aged 18 and above; we do not knowingly collect data from children.

2. What data we collect

• Email address — for authentication only.
• Your name, if your sign-in provider gives us one, or a guess made from your email address if it does not. You can change or clear it at any time in Account.
• Financial data you enter manually: income, expenses, assets, debts, savings, goals and the assumptions you set.
• Usage data. Before you choose, we count anonymous page visits and a few button taps (such as starting the money scan or signing in), without cookies and without storing anything in your browser. To tell visits apart, PostHog turns your IP address and browser type into a one-way code that changes every day, so visits on the same day can be counted together, but not linked to you or across days. If you decline or turn analytics off, nothing is sent. Full analytics (page views and feature interactions, via PostHog, anonymised) runs only after you tap "Allow analytics", and you can turn it off at any time below.
• A search inside the app that found nothing: we keep the words you typed, so we can see what the app is missing. It is shortened, lower-cased, and kept only if it contains a word — so an amount typed into the search box is never recorded. It is not attached to your name or your account, and a search that found something is never recorded this way.
• A record of your consent: the date, the version of these documents, the screen on which you accepted them, and your confirmation that you are 18 or older. This record is append-only — we are required to be able to show that consent was given.
• Notification permissions: if you turn on notifications, we store the subscription your own browser issues for each device, so that we can send to it. Turning notifications off deletes it.
• Referral data: if you use or share a referral code, we store which account referred which (the code and timestamps) solely to credit rewards.
• If you give us your email address on a public page — the calculator on the home page, or the foot of a guide — without creating an account, we store that address, which page you gave it on, the exact wording you agreed to, and when. We store no financial figure against it. If you asked us to email you a figure you had just worked out, that figure is put in the email and never kept.
• Some things stay on your device and never reach us: setup answers you have not saved yet, which prompts you have told us do not apply to you, and a count of which screens you open most (used only to choose the shortcuts on your own home screen). Signing out or deleting your account clears all of them.
• We do NOT access your bank accounts.
• We do NOT pull transaction data from any source.
• We do NOT collect automatic financial data — everything is manual entry.

3. How we use your data (purpose limitation)

• To provide the Muktify service and show your projections — this is the only purpose your financial data is used for.
• To send you email about your own account: a welcome message, a monthly progress email, and reminders tied to your own figures or to India’s tax calendar. Every one of them is about you; none is marketing for anything else.
• To send notifications to the devices you have turned them on for. Turning them off stops all of it.
• If you gave us your address on a public page without an account, we use it for one thing: to email you when a new guide goes up, at most once a month — plus, if that is what you asked for, the one figure you had just worked out. Nothing else, and nothing about anybody else. Every one of those emails carries a link that takes you off the list in one tap, with no sign-in.
• We never sell your data to any third party, and never use it for advertising or profiling beyond the service itself.
• We share data only with our Data Processors: Supabase (database and authentication), Resend (email), Razorpay (payments, if you ever make one), PostHog (anonymised product analytics), Sentry (error reports) and Vercel (hosting). If you turn notifications on, your browser’s own push service — Google, Mozilla or Apple, depending on your browser — delivers the notification; it receives the words of the message, never your figures. Each processor is bound by a data processing agreement.
• Analytics events never include your financial values — only anonymised feature usage.

4. Data storage and security

• Stored on Supabase (AWS, Singapore region).
• Row-level security (RLS) — only you can read your own rows.
• All data encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Passwords are never stored — we use Google sign-in and email magic links.

5. Your rights under DPDP Act 2023

• Right to access: request a summary of your personal data and how it has been processed, via email.
• Right to correction & completion: update your data at any time in the app — what you earn and spend, what you own, what you owe, what you are saving for, the assumptions behind your projections, and your name and notification settings in Account.
• Right to erasure: Account → "Delete all my data" removes all your data permanently, in-app, no email needed. If you have no account and only gave us an email address on a public page, the unsubscribe link in any of our emails leads to a page that deletes that address permanently — no sign-in, and you do not need to write to us.
• Right to withdraw consent: withdrawing is as easy as giving it — delete your account in-app at any time; we stop all processing. For an address given without an account, the unsubscribe link in every email stops the sending immediately.
• Right to grievance redressal: see section 9 below.
• Right to nominate: you may name another person to exercise these rights for you if you die or become unable to. Email compliance@muktify.in with their name and contact and we will record your nominee.

6. Data retention

• Your data is retained only while your account exists.
• If you do not use your account for 36 months (no sign-in and no activity), we email you 48 hours before deleting it. Signing in within those 48 hours keeps it; otherwise the account and all its data are erased, exactly as if you had used "Delete all my data".
• When you delete your account, all personal and financial data is erased from our systems permanently. Payment records may be retained by Razorpay as required by Indian financial regulations.
• After a refund, account data is retained for 30 days (so you can return), then eligible for deletion on request.
• An email address given on a public page is kept until you ask us to delete it. If you unsubscribe, we stop sending and keep only the record that you gave permission and then withdrew it — we are required to be able to show both. Deleting removes even that.

7. Data breaches

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act, including what happened, what data was involved, and what we are doing about it.

8. Cookies and on-device storage

• Session cookies for authentication (required for the service to work).
• Analytics storage from PostHog, only after you tap "Allow analytics" (anonymised, no cross-site tracking). Until then PostHog stores nothing in your browser: it only counts anonymous page visits and a few button taps without cookies. If you decline or turn analytics off, nothing is sent. If your browser sends Global Privacy Control or Do Not Track, analytics stays off. Your choice is kept on this device.
• Where you first came from: the first page of ours you opened, the name of the website that sent you (never the address of the page on it), any campaign tags on that link, and the day. It is kept in your browser only after you allow analytics, and sent to PostHog only once you sign in, and only if you have allowed analytics — so we can see which channels lead to accounts. It is cleared when you sign out or delete your account.
• Your browser’s own storage, for the small set of things listed at the end of section 2. Those stay on the device and are cleared when you sign out or delete your account.
• No advertising cookies. No third-party tracking pixels.

9. Grievance Officer & complaints

• Grievance Officer: Vijay Singh Sinhmar, Muktify. Email: compliance@muktify.in.
• For privacy questions, data requests, nominee requests or complaints, email the Grievance Officer. We acknowledge within 48 hours on business days.
• We answer every complaint within 90 days at most, as the DPDP Rules require, and aim to do so within 30 days.
• If you are not satisfied with our answer, you can complain to the Data Protection Board of India.