Privacy Policy

Who this policy covers

This policy applies to Kedil in every form you can use it — the website at kedil.money, the web app at app.kedil.money, and the Kedil Money apps for iOS and Android.

Kedil is operated by Manikandan as an individual, not through a registered company. "We" and "Kedil" below mean the same person.

You bring your money data to us — we never reach into your bank. Kedil has no Account Aggregator licence, no RBI registration, and no direct connection to any bank or financial institution. Nothing in this app can move money.

What data we collect

Everything below either comes from you, or is generated as you use the app.

• Account details— your name, username, email address, password (stored hashed), and profile photo if you add one
• Google account details— your name, email and profile picture, if you choose to sign in with Google
• Bank statements— the PDF statements you upload, and the transactions inside them
• Financial records— transactions, account and card balances, budgets, debts, EMIs, categories, payees and tags
• Diagnostics— crash reports, error traces and performance timings, generated automatically when something breaks
• Usage— which features are opened and how often, with no personal identifiers attached

We do not collect your location, your contacts, your camera roll beyond the single photo you pick as an avatar, your device advertising identifier, or your bank login credentials. We never ask for a net banking password, a card number, a CVV, or an OTP. If anything claiming to be Kedil asks you for those, it is not us.

How we use your data

• To run the app— show your transactions, budgets, balances and debts, and keep them in sync across your devices
• To read your statements— turn an uploaded PDF into categorised transactions — the next section explains exactly how
• To sign you in— and keep your session secure
• To fix what breaks— crash and error reports tell us a screen failed, and on which kind of device
• To decide what to build— aggregate feature usage, never tied to you individually

We do not sell your data — ever. We do not share it with advertisers or data brokers. We do not build a profile of you for anyone else, and we do not use your financial data to target ads. There is no advertising SDK in the app.

How your bank statements are read

When you upload a bank statement, Kedil has to read a PDF that every bank formats differently. To do that we send the statement's contents to Google's Gemini API, which extracts the transactions and returns them as structured rows. The same service cleans up messy merchant names, so "UPI/ATTN/SWIGGY BANGA" becomes "Swiggy".

Three things worth knowing about that:

• No training— Google processes the content as our service provider, and under its terms for paid API use that content is not used to train Google's models
• No identity— your name, email and Kedil account ID are not sent with it — Gemini receives statement text, not you
• No stored PDF— the uploaded file is discarded after processing; the transactions extracted from it are what we keep in your account

If you would rather no third party ever saw your statement text, do not use statement import. You can add transactions manually and the rest of Kedil works exactly the same.

Third-party services

A short and complete list. Each of these works for us under contract as a service provider — none of them is a party we sell to.

• Google Gemini— reads uploaded statements; receives statement contents without your identity
• Google Sign-In— signs you in; confirms your Google identity to us
• Sentry— crash and performance reporting; receives error traces, device model and OS version, with no account identity attached
• DigitalOcean— hosts the app and database in Bangalore; holds everything, encrypted at rest
• Sanity CMS— powers the Kedil blog; receives no personal or financial data from your account
• Apple and Google Play— distribute the mobile apps; receive install and crash statistics from the stores themselves

Beyond these, we disclose data only where the law compels it — a valid order from a court or authorised authority. If that ever happens and we are permitted to tell you, we will.

How long we keep it, and deleting your account

We keep your financial records for as long as your account exists, because they are the app. Uploaded statement PDFs are the exception — those are discarded once the transactions have been extracted.

You can delete your account yourself, from Settings inside the mobile app, or on the web from our Delete Account page. Deleting removes your profile, transactions, accounts, budgets and debts from our live systems immediately.

Encrypted backups roll over on a 30-day cycle, so a copy may persist in backup storage for up to 30 days before it is overwritten. Nobody reads those backups except to restore a system failure.

Three things survive deletion: anonymous aggregated usage counts that cannot be traced back to you, records we are legally required to retain for as long as the law requires, and support emails you sent us, which we keep for 12 months.

How we store and protect it

• In transit— everything between your device and our servers travels over TLS
• At rest— data is encrypted on our hosting provider's infrastructure in Bangalore
• Passwords— stored as one-way hashes — we cannot read yours, and neither can anyone who takes a copy of the database
• On your phone— session tokens live in the device's own secure keystore, the iOS Keychain or the Android Keystore, never in ordinary app storage
• Access— production systems are restricted to the people who operate them

No system is perfectly secure, and we will not pretend otherwise. If we ever discover a breach affecting your data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us to do any of the following, and we will respond within 30 days.

• Access— ask us what personal data we hold about you, and who we have shared it with
• Correction— ask us to fix anything inaccurate, incomplete or out of date
• Deletion— ask us to delete your account and all data associated with it
• Withdraw consent— as easily as you gave it — withdrawing consent for core processing means closing your account, because there is no Kedil without your data
• Nominate— name someone to exercise these rights on your behalf if you die or become incapacitated
• Complain— to our Grievance Officer below, and to the Data Protection Board of India if we do not resolve it

Email us at kedil.money@gmail.com. We will respond within 7 business days.

Cookies and analytics

The website and web app use cookies that keep you signed in and remember your preferences. Without them you would be logged out on every page. No advertising cookies. No cross-site tracking. No data shared with ad networks.

We use basic analytics to count feature usage. It collects no personal identifiers and builds no profile of you. The mobile apps set no cookies and contain no advertising or cross-app tracking SDK — which is why Kedil never shows you the iOS "Allow tracking?" prompt. We have nothing to track you with.

Children

Kedil is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it and everything in it.

Changes to this policy

If we make material changes, we will update the effective date at the top of this page and notify you by email or in the app before they take effect.

Grievance Officer

As required by the Digital Personal Data Protection Act, 2023, you can raise any privacy complaint with:

• Name— Manikandan
• Email— manikandan@kedil.money

We acknowledge complaints within 7 days and aim to resolve them within 30. If you are not satisfied with the outcome, you can escalate to the Data Protection Board of India.

Contact

Questions about your data? Write to us at kedil.money@gmail.com. We will reply within 7 business days.