Privacy Policy

1. Who we are

Muktify (muktify.in) is a personal finance education tool operated in India. We help individuals understand their financial health through calculators and projections. We are not a bank, broker, or SEBI-registered investment adviser. As a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are responsible for the personal data you entrust to us. Muktify is intended for individuals aged 18 and above; we do not knowingly collect data from children.

2. What data we collect

• Email address — for authentication only.
• Your name, if your sign-in provider gives us one, or a guess made from your email address if it does not. You can change or clear it at any time in Account.
• Financial data you enter manually: income, expenses, assets, debts, savings, goals and the assumptions you set.
• Usage data: page views, feature interactions (via PostHog, anonymised).
• A search inside the app that found nothing: we keep the words you typed, so we can see what the app is missing. It is shortened, lower-cased, and kept only if it contains a word — so an amount typed into the search box is never recorded. It is not attached to your name or your account, and a search that found something is never recorded this way.
• A record of your consent: the date, the version of these documents and the screen on which you accepted them. This record is append-only — we are required to be able to show that consent was given.
• Notification permissions: if you turn on notifications, we store the subscription your own browser issues for each device, so that we can send to it. Turning notifications off deletes it.
• Referral data: if you use or share a referral code, we store which account referred which (the code and timestamps) solely to credit rewards.
• If you give us your email address on a public page — the calculator on the home page, or the foot of a guide — without creating an account, we store that address, which page you gave it on, the exact wording you agreed to, and when. We store no financial figure against it. If you asked us to email you a figure you had just worked out, that figure is put in the email and never kept.
• Some things stay on your device and never reach us: setup answers you have not saved yet, which prompts you have told us do not apply to you, and a count of which screens you open most (used only to choose the shortcuts on your own home screen). Signing out or deleting your account clears all of them.
• We do NOT access your bank accounts.
• We do NOT pull transaction data from any source.
• We do NOT collect automatic financial data — everything is manual entry.

3. How we use your data (purpose limitation)

• To provide the Muktify service and show your projections — this is the only purpose your financial data is used for.
• To send you email about your own account: a welcome message, a monthly progress email, and reminders tied to your own figures or to India’s tax calendar. Every one of them is about you; none is marketing for anything else.
• To send notifications to the devices you have turned them on for. Turning them off stops all of it.
• If you gave us your address on a public page without an account, we use it for one thing: to email you when a new guide goes up, at most once a month — plus, if that is what you asked for, the one figure you had just worked out. Nothing else, and nothing about anybody else. Every one of those emails carries a link that takes you off the list in one tap, with no sign-in.
• We never sell your data to any third party, and never use it for advertising or profiling beyond the service itself.
• We share data only with our Data Processors: Supabase (database and authentication), Resend (email), Razorpay (payments, if you ever make one), PostHog (anonymised product analytics), Sentry (error reports) and Vercel (hosting). If you turn notifications on, your browser’s own push service — Google, Mozilla or Apple, depending on your browser — delivers the notification; it receives the words of the message, never your figures. Each processor is bound by a data processing agreement.
• Analytics events never include your financial values — only anonymised feature usage.

4. Data storage and security

• Stored on Supabase (AWS, Singapore region).
• Row-level security (RLS) — only you can read your own rows.
• All data encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Passwords are never stored — we use Google sign-in and email magic links.

5. Your rights under DPDP Act 2023

• Right to access: request a summary of your personal data and how it has been processed, via email.
• Right to correction & completion: update your data at any time in the app — what you earn and spend, what you own, what you owe, what you are saving for, the assumptions behind your projections, and your name and notification settings in Account.
• Right to erasure: Account → "Delete all my data" removes all your data permanently, in-app, no email needed. If you have no account and only gave us an email address on a public page, the unsubscribe link in any of our emails leads to a page that deletes that address permanently — no sign-in, and you do not need to write to us.
• Right to withdraw consent: withdrawing is as easy as giving it — delete your account in-app at any time; we stop all processing. For an address given without an account, the unsubscribe link in every email stops the sending immediately.
• Right to grievance redressal: see section 9 below.
• Right to nominate: you may nominate another individual to exercise these rights on your behalf in the event of death or incapacity — email us to record a nominee.

6. Data retention

• Your data is retained only while your account exists.
• When you delete your account, all personal and financial data is erased from our systems permanently. Payment records may be retained by Razorpay as required by Indian financial regulations.
• After a refund, account data is retained for 30 days (so you can return), then eligible for deletion on request.
• An email address given on a public page is kept until you ask us to delete it. If you unsubscribe, we stop sending and keep only the record that you gave permission and then withdrew it — we are required to be able to show both. Deleting removes even that.

7. Data breaches

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act, including what happened, what data was involved, and what we are doing about it.

8. Cookies and on-device storage

• Session cookies for authentication (required for the service to work).
• Analytics cookies from PostHog (anonymised, no cross-site tracking).
• Your browser’s own storage, for the small set of things listed at the end of section 2. Those stay on the device and are cleared when you sign out or delete your account.
• No advertising cookies. No third-party tracking pixels.

9. Grievance redressal & contact

For privacy questions, data requests, or grievances, email our Grievance Officer at compliance@muktify.in. We acknowledge within 48 hours on business days and aim to resolve grievances within 30 days. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India.