Privacy Policy

1. Introduction & Scope

Craftylane Studios ("we", "our", or "us") operates Kestro, a collaborative household expense management application. This Privacy Policy details our practices regarding data collection, processing, storage, and rights for users of the Kestro mobile application and website (getkestro.in), in accordance with India's Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Information We Collect

We believe in data minimization. We only collect information strictly required to provide household budgeting services:

• Account Identification: Your name and email address when creating an account or signing in via Google Sign-In.
• Household Data: Household name, currency preference, and family member role assignments (Admin, Earner, Member).
• User-Logged Transactions: Expense amounts, category labels, timestamps, notes, and payment attribution voluntarily recorded by members.
• Technical Metadata: Device model, operating system version, and anonymous application crash logs necessary to maintain system stability.

3. Information We NEVER Collect or Request

To eliminate financial risk for families, Kestro intentionally refrains from collecting sensitive banking secrets:

• We never request or store your netbanking passwords, ATM PINs, or UPI security codes.
• We never request Android SMS reading permissions or scrape your text messages.
• We never request or store your payment card numbers or CVVs. All subscription payments are processed exclusively through Google Play Store billing.
• We do not connect to your bank accounts with third-party screen scrapers.

4. Purpose of Data Processing

We process your personal and transaction data solely to:

• Synchronize shared balances and category allocations across authorized family members.
• Compute household settle-up calculations and generate monthly summaries.
• Authenticate your access and enforce role-based access permissions.
• Deliver essential service updates and security notifications.

5. Third-Party Sharing & Commercialization

We do not monetize your personal information. We do not sell your personal or household spending records to data brokers, commercial advertisers, or telemarketers. The Kestro application contains zero third-party behavioral advertising SDKs.

Data is only processed by essential infrastructure providers acting as data processors under binding confidentiality agreements: Supabase / PostgreSQL (cloud database hosting in compliance with Indian data transfer norms) and Google Play Services (authentication and subscription fulfillment).

6. Security Architecture

We implement technical safeguards to protect your records:

• In Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 with modern cryptographic cipher suites.
• At Rest: Database storage volumes and encrypted backups utilize AES-256 encryption.
• Tenant Isolation: PostgreSQL Row Level Security (RLS) ensures that members can only query ledgers belonging to their invited household.
• Local Access: Users can enable Android biometric authentication (fingerprint or face unlock) to protect the app locally.

7. Data Retention & Self-Serve Deletion

Your household records are retained only for as long as your account remains active. You possess the absolute right to permanent erasure under DPDPA 2023. You can execute complete account and ledger deletion at any time from inside the app (Settings → Account → Delete Account) or by emailing [email protected]. Upon deletion, all personal profiles, credentials, and ledger entries are permanently erased.

8. Grievance Officer Contact

In accordance with the Information Technology Act, 2000 and DPDPA 2023, you may address inquiries, access requests, or privacy grievances to our appointed officer: