Your privacy at Sholoo Ana.

1. Scope and who we are

This Privacy Policy applies to the Sholoo Ana website, mobile applications, APIs, emails, and related personal finance services. Sholoo Ana is responsible for the personal information described in this policy. You can contact us at [email protected].

This policy does not govern a third-party service that you access separately, even when Sholoo Ana provides a link to or connects with that service.

2. Information we collect

The information we handle depends on the features you use and may include:

• Account and profile information, such as your name, email address, phone number, date of birth, gender, tax category, registration platform, and email-verification status;
• Authentication information, including password hashes, session records, verification or reset records, and a Google account identifier when you choose Google sign-in;
• Financial and tax-planning records you enter, including income, expenses, accounts, budgets, categories, assets, liabilities, savings, stocks, loans, repayments, notes, reminders, and related reporting details;
• Subscription and payment-review records, including plan, amount, currency, transaction reference, the last four digits of the sender number, status, and review history;
• Google Sheets integration details, including the connected Google email address, spreadsheet identifier, encrypted authorization credentials, sync status, and last-sync time;
• Messages you send to support and information needed to investigate and respond to your request; and
• Technical and security information, such as session activity, timestamps, request and error information, administrative audit events, and information used to detect misuse or protect accounts.

Please do not enter passwords, one-time codes, complete payment account numbers, or other secrets into free-text fields or support messages.

3. How we receive information

We receive information directly from you when you create or update an account, record finances, submit a manual payment for review, connect Google Sheets, export information, or contact support. We also receive limited information from Google when you choose Google sign-in or authorize the optional Google Sheets integration.

Some technical, session, security, and audit information is generated automatically when the service is accessed or when an administrator performs a protected action such as reviewing a payment.

4. How we use information

We use information to:

• Create, verify, secure, and support your account;
• Store and organize your records and provide calculations, reports, exports, reminders, and supported tax-planning tools;
• Process manual payment submissions, review transaction references, and activate or manage paid access;
• Send service emails such as verification, password-reset, security, payment-review, and account messages;
• Operate Google sign-in and, when authorized, synchronize supported records with Google Sheets;
• Prevent abuse, investigate errors, maintain audit records, protect users, and improve service reliability; and
• Meet applicable legal obligations and establish, exercise, or defend legal claims.

We do not sell personal information or use it for third-party advertising.

5. Google services

Google sign-in requests basic identity scopes so that we can receive your Google account identifier, email address, and profile name. We use this information only to create, link, authenticate, and secure your Sholoo Ana account. Google does not give us your Google password.

The optional Google Sheets feature separately requests permission to create and manage a Sholoo Ana spreadsheet and synchronize supported financial records with it. We store the connected email address, spreadsheet identifier, and an encrypted refresh token needed to perform authorized synchronization. You can disconnect the integration from settings and can also revoke access through your Google Account.

Sholoo Ana's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. Manual payments

When you use manual bKash payment review, money is sent outside Sholoo Ana using bKash's Send Money service. Sholoo Ana receives the transaction ID, exact amount, sender number's last four digits, plan details, and submission time so an authorized administrator can check the payment and approve or reject access. Do not submit the full sender number, PIN, password, or one-time code.

7. Service providers and sharing

We disclose information only as reasonably necessary to operate and protect the service. Providers currently used for those purposes include Google for authentication and optional Sheets integration, Resend for transactional email delivery, and Hostinger for production infrastructure. Each provider processes information under its own terms and privacy obligations.

Information may also be disclosed when required by applicable law, a valid legal process, or a necessary response to fraud, abuse, security threats, or risks to a person's safety or rights. If the service or its assets are reorganized or transferred, relevant information may be transferred subject to appropriate safeguards and notice where required.

8. Cookies and device storage

The website uses an essential, secure HTTP-only refresh cookie to maintain your signed-in session. It also uses local device storage for limited account-display information and preferences such as theme. The mobile application stores information needed to maintain your session and preferences on your device.

These technologies are used to provide requested functionality and protect accounts. Sholoo Ana does not currently use advertising or third-party analytics cookies. Blocking essential storage may prevent sign-in or other parts of the service from working correctly.

9. Retention and deletion

We keep account and service information while your account is active and for as long as reasonably needed to provide the service, protect users, resolve disputes, reconcile payments, and meet applicable obligations. Verification codes and active session credentials have shorter operational lifetimes.

Account-deletion requests are subject to a configured grace period, currently seven days. When a request becomes due, account sessions and Google integration access are revoked, the account and associated financial records are deleted, and retained payment or security-audit records are separated from the account or pseudonymized where they remain reasonably necessary for reconciliation, fraud prevention, dispute handling, or legal compliance. Backup copies may remain until they are replaced through the normal backup cycle.

10. Your choices and controls

Depending on the feature and applicable requirements, you can review or correct profile information, download an export of supported account data, disconnect Google Sheets, revoke Sholoo Ana through your Google Account, or request account deletion. To request assistance, correction, or deletion, email [email protected] from the address linked to your account. We may need to verify your identity before acting on a request.

You can stop non-essential use of a connected provider by disconnecting it. Transactional messages needed for account security, payment review, or requested service operations are not marketing subscriptions.

11. Security

We use technical and organizational safeguards intended to protect information, including access controls, password hashing, encrypted storage for Google refresh tokens, protected production secrets, secure session cookies, transport encryption, audit records, and restricted administrative actions. No internet service or storage system can guarantee absolute security.

Protect your devices and credentials, use a unique password, and contact us promptly if you believe your account or information has been compromised. Never email us your password, payment PIN, one-time code, or secret access credentials.

12. International processing

Sholoo Ana is intended primarily for users in Bangladesh, but service providers and infrastructure may process or store information in other countries. Those locations may have privacy rules that differ from the rules where you live. We use providers and safeguards appropriate to the service and information involved.

13. Children

Sholoo Ana is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from a child. If you believe a child has provided information to the service, contact us so we can investigate and take appropriate action.

14. Changes to this policy

We may update this policy when the service, providers, or applicable requirements change. The date at the top identifies the latest version. Where required, we will provide additional notice or request consent before a material change takes effect.

15. Contact

Questions or requests about this policy or your information may be sent to Sholoo Ana at [email protected]. Include enough information for us to understand your request, but do not include passwords, one-time codes, or secret credentials.