🧭 Overview
HisabNova is an offline-first billing and business-management app. When you install it, it creates a database on your own device and writes every bill, product, customer and ledger entry there. It does not need an account, a server or an internet connection to do its job.
Because of that, the honest answer to "what do you collect?" is: by default, nothing about your business. The sections below describe the optional features that do involve a network, exactly what each one sends, and how to turn them off.
📦 What stays on your device
Unless you deliberately enable a cloud feature, all of the following exists only on the device you are using and on any device you have paired over your own Wi-Fi:
- Your business profile, GSTIN, logo and branding
- Products, prices, purchase costs, stock movements, batches and barcodes
- Customers, suppliers, phone numbers, khata balances and credit limits
- Every invoice, quotation, challan, return and credit note
- Payments, expenses, cash and bank balances
- Reports, charts, the health score and anything derived from the above
- Your app-lock PIN and owner PIN, stored only as a salted, stretched hash
We have no ability to read any of this. There is no administrative console anywhere that can open your books.
🔌 The optional features that use a network
Each of these is off until you turn it on, and each can be turned off again.
| Feature | What leaves the device | Who handles it |
|---|---|---|
| Account sign-in | Your email address, or the Google account identifier you choose to sign in with. A "guest" sign-in creates an anonymous identifier with no email at all. | Google Firebase Authentication |
| Cloud backup & sync | Your business records — the same rows listed above — copied to a private area tied to your account, so a second device or a replacement phone can restore them. | Google Cloud Firestore |
| Push notifications | A device registration token, so a message can reach this install. No business data. | Firebase Cloud Messaging |
| AI assistant & business doctor | Only when you open the screen: your typed question, plus a short summary of your figures (sales, dues, health score, top items). Not your database, not your customer list, not individual bills. | Google Gemini via Firebase AI Logic |
| Subscription payment | The plan tier you chose and the payment details you enter on the payment page. We never see or store card, UPI or bank credentials. | Razorpay |
| Dashboard offers | Nothing. The app reads a public list of announcements. Nothing about you is sent to fetch it. | Google Cloud Firestore |
| App updates | Whatever your app store normally exchanges to check for a new version. | Google Play |
📷 Camera, microphone and photos
Barcode scanning
The camera is used to read a barcode and nothing else. No image is saved, and none is uploaded.
Bill scanning (OCR)
Text recognition runs on the device. The photograph of a supplier's bill is processed locally and is not uploaded to be read. What the app recognised is shown to you for confirmation before anything is saved.
Voice input
Dictation uses your device's own speech-recognition service. HisabNova does not record, store or upload audio. However, on some devices the operating system's speech service processes audio on its vendor's servers under that vendor's privacy policy — if this matters to you, use typing or scanning instead of the microphone.
Logo and stamp images
Pictures you choose for your shop logo or signature are cropped and compressed on the device and stored with your business profile. They leave the device only if you have cloud sync switched on, or if you share a document that contains them.
🚫 What we do not do
- No advertising SDK inside the app, and no ad-targeting profile built from your data.
- No analytics or crash-reporting SDK that reports your usage or your trading figures to us.
- No selling or renting of personal data to anybody, for any purpose.
- No reading of your books. Cloud-synced records sit in an area tied to your account; we do not mine them, and the app has no feature that would let us.
- No location tracking. HisabNova does not ask for or use your location.
- No contact-list access. Customers are people you type in, not people we read off your phone.
👶 Children
HisabNova is a business tool intended for adults running a business. It is not directed at children, and we do not knowingly collect information from anyone under 18.
🗄️ How long anything is kept
- On your device: for as long as you keep the app installed. Uninstalling removes the local database.
- In cloud backup: for as long as your account exists. Delete the account and the synced copy is removed — see the deletion page.
- Payment records: Razorpay keeps transaction records for the period their own policy and Indian financial regulation require.
- Support emails: kept while we are helping you and for a reasonable period afterwards, then deleted.
🔐 Security
- The app can be locked with a PIN or your device's biometrics, and a second owner PIN gates the actions that can rewrite money.
- PINs are never stored as text. They are hashed with PBKDF2-HMAC-SHA256 at 100,000 iterations with a random salt, and wrong guesses hit an escalating lockout that survives force-quitting the app.
- Privileged (owner and admin) PIN hashes are stripped before the team table replicates, so they never land on a staff tablet.
- Wi-Fi sync requests carry a per-device token issued at pairing and a signature verified in constant time, so nothing on your network can forge or alter a record.
- Cloud traffic uses the transport encryption provided by Google's SDKs.
⚖️ Your rights
Most of these you can exercise yourself, without asking us, because the data is on your device:
- Access & portability — export everything to CSV or Excel from More → Import & export, or take a full backup file. This is never gated behind a plan.
- Correction — edit any record in the app, subject to your role's permissions.
- Erasure — uninstall for local data; see the deletion page for cloud data and the account itself.
- Withdraw consent — turn off cloud sync, sign out, or revoke notification permission at any time in your device settings.
If you are in a jurisdiction with additional statutory rights (for example India's DPDP Act, or the GDPR if you are in the EU), write to us and we will honour them.
🔄 Changes to this policy
If we change how data is handled we will update this page and change the date at the top. Material changes — anything that would send data that previously stayed on your device — will also be announced in the app before they take effect.