Privacy Policy

1. Introduction

This Privacy Policy explains how the Baaki mobile application (the “App”, package com.vsm.bahikhata) handles information. Baaki is a digital udhar–jama ledger for small businesses: you record the customers and suppliers you deal with and the money you gave or received, and the App keeps the running balance.

Baaki was called Bahi Khata until 6 August 2026. Only the name changed — it is the same app, the same package (com.vsm.bahikhata), the same data, and the same policy. Nothing about how your information is handled changed with the rename.

Unlike our other apps, Baaki does store your data outside your phone — that is the whole point of it. A shopkeeper who loses their phone must not lose years of credit records. So your khata is backed up to your own Google account, where only you can read it. This page explains exactly what is stored, where, and how to get rid of it.

2. Signing In

The App uses Sign in with Google (Firebase Authentication). There is no password to create and no separate Baaki account. When you sign in, we receive from Google:

• a user ID that identifies your account to us;
• your email address;
• your display name and profile photo, shown in the App so you can confirm which account your khata is saved under.

We do not receive your Google password, your contacts, your Gmail, or anything else from your Google account. Your name and photo are only displayed — the App does not copy them into its own records.

3. What Is Stored In Your Khata

Everything in this section is information you type into the App:

• Customers and suppliers — the name you give them and, if you choose to add one, a phone number;
• Transactions — the amount, whether you gave or received it, the date, and any note you write;
• Reminders — which transactions you want to be reminded about and whether the reminder repeats daily, weekly or monthly;
• Your settings — the app language and the time of day reminders should arrive.

The App does not read your phone’s contacts, call log, SMS, photos, files, camera, microphone or location. Nothing is imported automatically. If a customer’s phone number is in your khata, it is because you typed it in.

A note on other people’s details

Because a ledger is a record of dealings with other people, what you enter may include their names and phone numbers. Those details are yours to control — we never contact anyone in your khata, never message them, and never use their numbers for anything. You are responsible for entering only what you genuinely need for your business records, and for handling it in line with any law that applies to you.

4. Where Your Data Lives

On your phone. Your khata is stored in a local database that is encrypted with SQLCipher. The key that unlocks it is generated on your device and sealed inside the Android Keystore, backed by hardware on phones that support it. The key never leaves your phone and is never sent to us. Another app on your phone cannot read the file, and neither can anyone who pulls the file off the device.

In your Google account. The same records are synced to Google Cloud Firestore, under a location reserved for your user ID. Server-side security rules allow read and write access only to a request signed in as you — there is no shared area, no admin console for us to browse your ledger from, and no server code of ours sitting in between. Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by Google.

The App deliberately keeps Firestore’s own offline cache in memory only, so sync never leaves a second, unencrypted copy of your khata on the phone’s storage.

5. Reminders & Notifications

Collection reminders are worked out and shown entirely on your phone. The notification text — the customer’s name and the amount outstanding — is assembled on the device at the moment it is shown and is never sent to us or anyone else. Reminders stop by themselves once that customer’s balance is settled.

On Android 13 and later, the App asks for notification permission the first time you set a reminder. If you say no, the App keeps working normally; the reminders simply stay silent, and you can turn them on later in Android’s app settings.

6. What We Do Not Do

• No advertising. The App contains no ads and requests no Advertising ID.
• No analytics or tracking. There are no analytics, attribution, or crash-reporting SDKs. We do not know how often you open the App, what you tap, or how big your ledger is.
• No selling or sharing. We do not sell, rent, or share your information with anybody, for any purpose, including advertising.
• No profiling. Nothing in your khata is used to score, rate, or make automated decisions about you or your customers.
• No credit reporting. Baaki is a private record book. Nothing you enter is reported to any credit bureau, lender, or recovery agency.

7. Permissions

The App declares only these permissions:

• Internet and network state — to sign you in and to sync your khata to your Google account, including holding changes until you are back online;
• Notifications — to show the collection reminders you set. Optional; you may decline it.

It requests no contacts, camera, microphone, location, SMS, call log, or storage permission — and it does not ask for the “exact alarm” permission, because reminders are delivered by Android’s standard background scheduler instead.

8. Third-Party Services

The App relies on these Google services and no others:

• Google Sign-In / Credential Manager — to sign you in;
• Firebase Authentication — to hold your sign-in identity;
• Google Cloud Firestore — to store the backup of your khata.

Google processes this data as our service provider and under Google’s Privacy Policy. In the normal course of using the App, your data is not sent to any other company.

9. Retention

Your khata is kept for as long as you keep using the App, because a ledger is only useful if it goes back years. We do not expire or auto-delete it.

When you delete a customer or a transaction in the App, it disappears from the App on all your devices. A small marker is kept in the sync record so that the deletion is not undone by an older copy on another phone; it holds no amount, note, or phone number. These markers are removed along with everything else when you delete your data (section 10).

Signing out leaves your khata on the phone, encrypted, so signing back in picks up where you left off. Nothing in the App is readable while signed out, and if a different Google account signs in on that phone, the previous khata is erased before the new one loads — two people's records never meet. Uninstalling is what removes the App's copy from the phone; the backup in your Google account stays, waiting for the next install.

How often the backup runs is your choice — every 15 minutes, hourly, every 6 hours, once a day, or only when you tap "Back up now" in your profile. Between those runs your entries are saved on the phone and nowhere else, and the App tells you how many are still waiting.

10. Deleting Your Data

You have three levels of deletion, and you choose which one you want:

• Remove individual records — delete any customer or transaction from inside the App at any time.
• Remove the App’s copy from a phone — sign out in the App, or uninstall it. The backup is not affected.
• Delete everything, permanently — open My Profile in the App and tap Delete account. You will be asked to confirm your Google account, and then your entire khata is erased from your Google account and from the phone, and your sign-in record is deleted. It happens immediately and cannot be undone, so please note down anything you still need first.

If you can no longer open the App — the phone is lost, or it will not sign in — email meenaashav1996@gmail.com from the Google address you signed in with and we will do the same thing for you, normally within 7 days and no later than 30, and confirm by reply.

You may also ask us for a copy of what is stored, or for a correction, at the same address.

11. Your Acceptance Of These Terms

The first time you sign in, the App shows a required screen with our Terms & Conditions and this Privacy Policy. You must scroll through it and tick a box before you can use the App; declining signs you out.

We keep a record that you accepted, containing your user ID, the version number of the Terms you accepted, the time your device recorded the acceptance and the time our server received it, and basic device details (device model, Android version, App version) — so we can show, if it is ever needed, that a given account agreed to a given version of the Terms at a given time.

This record is stored the same way your khata is: encrypted on your device, and backed up to a consent area of your Google account under Firestore. Unlike the rest of your khata, it cannot be edited or deleted through the App — not even by “Delete account.” An acceptance record that the same account could edit or erase would not prove anything, so it is kept permanently, for as long as your Google account exists in our systems, as evidence of what was agreed and when.

If we publish a Terms update that changes anything meaningful, you will be asked to accept the new version before you can keep using the App, and a new record is added for that acceptance.

12. Security

Your khata is encrypted on the device, encrypted in transit, encrypted at rest on Google’s servers, and fenced off server-side so that only a request signed in as you can reach it. Practical advice that matters more than any of that: keep a screen lock on your phone, and sign out before handing the phone to someone else. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

13. Children’s Privacy

Baaki is a business tool intended for adults running a shop or trade. It is not directed at children and we do not knowingly collect information from children. If you believe a child has signed in and stored data, contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. Material changes to how your data is handled will be described here before they take effect.

15. Contact Us

For any question about this policy, your data, or a deletion request:

📧 meenaashav1996@gmail.com