Privacy Policy
Last updated: August 2026
1. Introduction & Regulatory Framework (DPDP Act, 2023)
Welcome to MyFinanceSheet. We respect your privacy and are committed to protecting the personal and financial data you record in your trading journal. This Privacy Policy describes how we collect, process, secure, and manage your data when you use the MyFinanceSheet application dashboard operated by RAVINDRA KUMAR SAHOO (Trade Name: MY FINANCE SHEET) (“us”, “we”, or “our”).
This policy is formulated in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000 (Section 43A), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Under these laws, MyFinanceSheet operates as a Data Fiduciary, and you as the registered user are the Data Principal.
2. Information Collection
We collect the following classes of data to operate and personalize your trading journal dashboard:
- Profile Metadata: Your name, email address, username, optional mobile number, optional profile avatar, and authentication details supplied via email login.
- Journal Records: Tickers/symbols, entry/exit prices, position quantities, stop-losses, targets, strategy setups, notes, psychological tags, and attached chart images.
- Imported Broker Data: CSV spreadsheets uploaded to sync trade history.
- Device Metadata: Generated device session identifiers, browser client strings, and IP configurations to manage active sessions and prevent unauthorized access.
3. Data Security, Cryptographic Encryption & Local Storage
All trade journals and configuration metadata are securely stored in encrypted relational databases managed by Supabase, utilising SSL/TLS 1.3 cryptographic transport protocols.
AES-256 Broker Token Encryption: Stockbroker API keys, developer secrets, client IDs, and daily session access tokens entered for broker auto-sync (such as Dhan, Fyers, Upstox, Angel One) are client-side or server-side encrypted using military-grade AES-256-GCM encryption before being committed to database storage. Plaintext API secrets are NEVER stored, NEVER logged in access records, and NEVER accessible to platform personnel. Users can permanently purge their broker credentials with a single click at any time.
To enable offline support and zero-latency performance, your recent transactions are cached locally inside your browser's IndexedDB environment. This local cache is protected by your personal 4-digit App PIN Lock to prevent unauthorized local viewing if you share device screens.
4. APIs & Customer Service
API: Our platform syncs transactions via third-party broker APIs (e.g. Zerodha Kite, Dhan, Groww, Upstox). We do not store your account passwords or trading credentials on our servers. All API integrations use secure, direct OAuth handshakes or token validation.
Customer Service & Support Media Retention: When you reach out to our support team via our contact form, support tickets, or [email protected], we collect your name, email address, selected topic, and message logs to troubleshoot issues, guide dashboard configurations, and resolve help tickets. Video screen recordings and audio voice notes attached to support tickets are processed solely for issue diagnosis. To safeguard user media privacy and optimize cloud storage, all video screen recordings and audio voice notes attached to resolved or closed support tickets are automatically and permanently purged 7 days post-closure. Text ticket descriptions and static screenshots remain saved in your account support history.
7. Public Profiles & Data Principal Rights (DPDP Act, 2023)
Public Profile: By default, your trade logs and profile statistics are strictly private. If you explicitly choose to make a playbook setup or trading scorecard public (e.g., sharing a public link of your trades), other users will be able to see those details.
Your Rights as a Data Principal: In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), you enjoy the following legal rights regarding your personal data:
- Right to Access: You can view and export all your trade logs, analytics metrics, and account profile information at any time via the Backup & Export utility.
- Right to Correction & Updating: You have the right to modify, edit, or update incorrect or outdated trade logs, tags, and account settings directly through your dashboard.
- Right to Erasure (Account Deletion): You can permanently delete your entire profile and database records directly from your Account settings. Account deletion triggers an immediate purge of your trade logs, portfolios, custom tags, trading systems, and AI conversation history from our active databases.
- Right to Withdraw Consent: You may withdraw your consent for automated broker data syncing or marketing communications at any time by toggling off broker sync in your settings or writing to our Grievance Officer.
Financial & Tax Data Retention (Statutory Mandate): In compliance with Section 36 of the Indian CGST Act, 2017 and the Income Tax Act, 1961, all financial records, subscription sales invoices, payment transactions, and tax receipts (including customer email, billing address, business names, and GSTINs used during checkout) must be legally retained for a minimum period of 72 months (6 years). Upon account deletion, these billing invoices are decoupled from your active profile (user_id = NULL) but are preserved in our historical accounting ledger to comply with statutory government tax audits.
Anonymized Usage & Infrastructure Audit Logs: To reconcile operational vendor billing (such as Google Cloud LLM API Studio and WhatsApp infrastructure fees), aggregate daily resource usage logs (token counts, query numbers, and message totals) are decoupled from your personal profile upon account deletion (user_id = NULL). These logs contain zero personal data, trade records, or identifiable information and are retained strictly as anonymized platform cost metrics.
Inactivity & Data Retention: In order to maintain system hygiene and optimize storage resources, we enforce an automated inactivity data retention cleanup policy. If an account has no recorded sign-in activity for a consecutive period of 365 days (12 months) for Free Plan accounts, or 1,095 days (36 months) for Paid Plan/Expired-Paid accounts, all journal records, portfolios, trade logs, strategy tags, and associated checklists will be permanently purged from our active databases. Prior to this deletion, we will send warning notifications to the registered account email at 30 days, 15 days, and 7 days before the scheduled deletion. Logging back into your account resets this inactivity timer.
Support Ticket Media Retention Lifecycle (7 Days): To safeguard user media privacy and manage cloud storage efficiently, video screen recordings (.webm, .mp4) and audio voice notes (.webm, .wav) attached to support tickets are subject to an automated 7-day retention policy. Once a support ticket is marked as resolved or closed, all attached screen recording and voice note files are automatically and permanently deleted after 7 days. Text ticket descriptions and static screenshots remain stored in your ticket history for reference.
Data Backups & Custody: When you generate and download a JSON backup using our Backup & Restore utility, the exported file is stored locally on your device. We do not store duplicates of your downloaded backup files on our servers. You are solely responsible for securing your backup files. Deleting your profile will permanently erase all journal data on our servers, and it can only be restored using your own locally saved JSON backup files.
8. Children and Sensitive Personal Data
Children: Our platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we discover a profile belongs to a minor, we will terminate it immediately.
Sensitive Personal Data: We do not collect sensitive personal data such as biometric identifiers, medical information, religious beliefs, or political associations.
9. Updates, Statutory Grievance Redressal & Data Protection Officer
Updates: We may update this privacy policy at our discretion from time to time by posting a new version on our website. You should check our website occasionally to ensure any changes are suitable for you.
The current version of this privacy policy was modified on November 2026.
Statutory Grievance Redressal Officer (IT Rules & DPDP Act): In accordance with the Information Technology Act, 2000 and the Rules made thereunder, as well as the Digital Personal Data Protection Act, 2023, the details of the designated Grievance Officer and Data Protection Officer are as follows:
- Name of Officer: RAVINDRA KUMAR SAHOO
- Designation: Data Protection & Grievance Redressal Officer
- Entity: MY FINANCE SHEET
- Grievance & Legal Email: [email protected]
- Postal Address: Kalipoi Bus Stop, HOUSE NO.139, AT-GOPINATHPUR, PO-KALAPATHAR, Karadapalli, Cuttack, Odisha, 754009
- Redressal Timelines: Grievance communications are formally acknowledged within 48 hours of receipt and resolved within 30 days from the date of formal notification in accordance with statutory guidelines.