The short version
Who we are
Sweyam is an independent technology company based in India. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the EU's GDPR, we are the Data Fiduciary for any personal data processed through our services.
This policy covers sweyam.com, the Kasho personal finance app, Sweyam Auth, and any other Sweyam service you use. The ReelStash Android app is a self-hosted client with its own policy: sweyam.com/products/reelstash/privacy.
What we collect and why
We only collect what we need to make the product work. Nothing more.
| What | Why |
|---|---|
| Email address | Creating and securing your account. Sending you notices you asked for. |
| Passkey credentials | Letting you sign in securely. The biometric itself never leaves your device. |
| Kasho ledger data | Showing you your own money. You entered it, it's for you, full stop. |
| Error logs | Fixing bugs. These are aggregated and contain no personal identifiers. |
| Messages you send us | Replying to you. We don't feed these into any automated system. |
How we protect it
We take the security of your financial and personal data seriously. In practice, that means:
- Encryption at rest. Your data is encrypted using AES-256-GCM with per-user key isolation. Nobody can read a dump of the database without the keys.
- Encryption in transit. All connections to Sweyam enforce TLS 1.3. We use HSTS to prevent downgrades.
- Stored in India. Primary databases and backups live in Indian data centres (Mumbai / Bengaluru). They don't cross borders.
- Passkey-first auth. We've designed Sweyam Auth to eliminate passwords — the biggest source of account compromise — entirely.
What we never do
To be absolutely clear:
- We don't sell your data to anyone — not data brokers, banks, insurance companies, or ad networks.
- We don't use your financial records to train machine learning models.
- We don't show you ads, period. There are no ad scripts on any Sweyam page.
- We don't track what you do on other websites.
- We won't hand data to law enforcement without a valid court order, and we'll notify you unless we're legally prohibited from doing so.
Your rights
Whether you're in India, the EU, or anywhere else — you have full control over your data.
Access and export
Download everything you've ever put into Kasho — accounts, transactions, budgets — in JSON or CSV at any time.
Correction
Update any inaccurate personal information through your account settings, or ask us to do it for you.
Deletion
Delete your account and all associated data. We'll wipe it within 30 days, including from backups.
Withdraw consent
Revoke active sessions, passkeys, and any API tokens instantly from your account settings.
To exercise any of these rights, email us at [email protected]. We respond within 72 hours.
Deleting your account
You can delete your Sweyam account at any time from the settings page. When you do:
- Your data is immediately marked for deletion and disconnected from your identity.
- All active sessions are invalidated across every device.
- Encrypted backups containing your data cycle out within 30 days.
After that, nothing of yours remains on our infrastructure.
Questions
If you have any question about this policy — or about anything we do with your data — we want to hear from you. Email [email protected] and you'll get a real reply from a real person.
For formal data requests or grievances under DPDP Act 2023: [email protected].