Privacy policy

Last updated 7 November 2026. This version takes effect on the same date.

This policy explains how personal data is handled when you use the Account Runway apps for Android and iPhone, the web app at app.accountrunway.com, and the website accountrunway.com (together, "Account Runway" or "the service"). Account Runway is run by Kishan Jaiswal, Coimbatore - 641014, Tamil Nadu, India ("we", "us"), who decides why and how your personal data is used. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") we are the data fiduciary. Questions or requests: jaiswalkishan0010@gmail.com.

In short

• We collect only what the service needs: your email address and name to sign you in, and what you choose to record in your books.
• No advertising, no analytics or tracking tools, no advertising ID. We never sell or rent personal data.
• Your data is stored in India, on Amazon Web Services in Mumbai, with encrypted backups in Mumbai and Hyderabad.
• You can export everything at any time and delete your account, with the books you own, from the app.

1. What we collect

Your account

• Email address: to send your one-time sign-in codes and to identify your account. Sign-in codes are stored only as a one-way hash and stop working after 10 minutes.
• Name you choose (people in books you share can see it), your language, and, if you give it, your country (for prices and formats).
• The devices you sign in on: a random device ID created by the app, the device's name and type (Android, iPhone or web), the app version, when you signed in and when the device was last used, so you can see and sign out your devices. Sign-in tokens are kept on your device; our servers keep only one-way hashes of them.

What you record in your books

• Each book's name, currency, calendar and financial year.
• People you record (customers, suppliers, staff, friends or family): their name and, if you add them, their phone number, email address and notes.
• Entries: amounts, dates, due dates, notes, categories, the cash, bank or wallet used, and repeating entries.
• Files you attach: photos or PDFs of bills, receipts and agreements (up to 20 MB each), and your payment QR image, UPI ID and payment note if you add them.
• The email addresses and roles of the people you invite to a book.
• A history of changes in each book (who added, changed or cancelled which entry, and when), which keeps the book trustworthy for everyone in it.

When you share

• Statement links: a one-way hash of the link's secret, its expiry date, how many times it was opened and when it was last opened.
• Issued PDF statements: the period, the opening and closing balance, the number of entries and a fingerprint of the figures, so that anyone holding the statement can check it is genuine.

Plans and purchases

• If you buy a plan, Google Play or the App Store tells us which plan it is, its start and end dates, whether it renews, and the store's order reference. The store handles the payment: we never receive your card, bank or UPI payment details.

Support

• The messages you send us (in Help & ideas or by email), your device type and app version so we can understand a problem, and the ideas you vote for.

Reminders

• If you turn on reminders on a phone, a push token for that phone, so we can send the morning reminder of payments due.

Technical information

• Error logs needed to keep the service working, for example which request failed and why. They are used only to fix problems and are deleted after 30 days.
• Your network (IP) address is used for a moment to stop abuse, such as too many sign-in attempts. We do not keep access logs of IP addresses.

What we do not collect

We do not collect your location, your contacts list, your SMS or call logs, your advertising ID, or any biometric data. The optional app lock uses your phone's own fingerprint, face or screen-lock check; we never receive it. The website and web app use no tracking cookies; the web app keeps your sign-in in your browser's storage on your device.

2. App permissions

• Camera, photos and files: only when you choose to photograph or attach a bill, receipt or agreement.
• Notifications: only if you turn on reminders.
• Fingerprint or face: only if you turn on the app lock. The check happens on your phone.
• Internet: to keep your books in sync. Entries you save while offline stay on your phone until they can be sent.

3. Why we use your data, and on what basis

• To provide the service you asked for: create your account, sign you in, keep and sync your books across your devices, make reports, PDFs and exports, send the reminders you turn on, and show statements to the people you share them with. Basis: your consent, given when you create an account and use these features, and our agreement with you (the terms of use).
• To keep the service and your data secure, and to prevent misuse, fraud and unauthorised access. Basis: your consent, and our need to protect everyone who uses the service.
• To give you the plan you bought. Basis: our agreement with you.
• To answer you when you contact us. Basis: your consent.
• To meet legal duties, such as keeping tax and accounting records and answering lawful requests from authorities. Basis: legal obligation, a legitimate use under the DPDP Act.

We do not use your data for advertising or profiling, we make no automated decisions that affect you, and we do not send marketing emails. We send only sign-in codes and important notices about the service or your account.

4. Who can see your data

• You, and the people you add to a book, according to the role you give them. Owners and partners add and edit entries and people; owners and partners also manage who is in the book. Accountants see everything and download reports. Staff add entries and people but do not see reports. Viewers only look.
• Anyone with a statement link you share sees that person's balance, their latest entries in that book (up to 200), the book's name and your payment details, until the link expires (after at most 90 days) or you turn it off.
• Anyone holding a PDF statement you issued can check it on our website, which shows the book's name, the person's name, the period and the totals.
• Messages you send from Account Runway through WhatsApp or another app (for example, a reminder) are sent by you, from your own account in that app, under that app's own terms.
• Our service providers, who handle data only on our instructions and only for the purpose shown:
  • Amazon Web Services (India): hosting, database, file storage and backups, in Mumbai and Hyderabad.
  • Resend (United States): delivers sign-in code emails. It receives your email address and the email it delivers.
  • Expo (United States), Google Firebase Cloud Messaging and Apple Push Notification service: deliver reminders to your phone. They receive the phone's push token and the reminder text, which can include the names of people and the amounts due.
  • Google Play and the Apple App Store: handle plan purchases and tell us their status.
• Our support staff can see your account details (email address, name, devices and plan) to help you. They cannot open your books. Please send us details from your books only if you want us to look at them.
• Authorities, only when Indian law (or another law that applies to us) requires it, in answer to a valid legal request. Unless the law forbids it, we tell you first.
• If Account Runway is ever transferred to another operator, your data would move only under protections at least as strong as this policy, and we would tell you beforehand.

We never sell, rent or trade personal data.

5. Where your data is kept

Your account and books are stored in India: on Amazon Web Services in Mumbai, with encrypted backup copies in Mumbai and Hyderabad. The email and push-notification providers listed above are in the United States and receive only what they need to deliver an email or a reminder. These transfers follow the DPDP Act, which allows personal data to be processed outside India except in countries the Government of India restricts.

6. How long we keep it

• Your account and books: for as long as your account exists.
• When you delete your account: your account and every book you own are removed from our live database at once, for everyone in them. Attached files are deleted at once; older copies kept by our file storage's version history are removed within 30 days, and copies in database backups within 35 days. Books that other people own stay with them; entries you added there remain in their history, shown as added by "Deleted user".
• Sign-in codes: 10 minutes.
• Devices: until you sign out, the session ends, or you sign out all devices.
• Statement links: until they expire (after at most 90 days) or you turn them off.
• Support messages and idea votes: while your account exists, and deleted with it. An idea we published keeps only its public title and vote count, with nobody's name.
• Purchase records (plan, dates and the store's order reference): up to 8 years after the purchase, as Indian tax and accounting laws require, even after you delete your account.
• Error logs: 30 days.

7. How we protect it

• Everything travels encrypted (HTTPS/TLS), including between our server and our database.
• The database, the files and the server's disks are encrypted at rest.
• For every request, the database itself checks that you are a member of the book being read. The service runs with the least rights it needs, and our servers accept no remote logins.
• There are no passwords to steal: you sign in with one-time codes, sign-in tokens are rotated, and you can see and sign out every device.
• Staff access is limited and protected by two-step sign-in.
• Backups are taken daily and kept for 35 days.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires, and explain what we are doing about it.

8. Your rights

Wherever you live, you can:

• Access your data: see it in the app, and download everything in a book (Reports → Export) at any time, even without a plan.
• Correct it: edit your name, people and entries in the app. To keep books trustworthy, a corrected entry keeps its earlier version in the book's history.
• Erase it: delete your account in the app (Settings → Delete account), or see the other ways to delete your account.
• Withdraw your consent at any time by deleting your account. This does not affect what was done before.
• Nominate a person who may use these rights for you if you die or become unable to, by writing to us.
• Complain to our Grievance Officer (section 12). If you are not satisfied with our answer, you may complain to the Data Protection Board of India. People in Nepal also have the rights given by Nepal's Individual Privacy Act, 2075 (2018).

Please write from the email address you sign in with, so we can confirm it is you. We reply within 30 days.

9. People whose details you record

When you record other people, for example a customer's name and phone number, you decide what to record and why, and Account Runway keeps it for you. Please record only what you need, keep it accurate, and make sure you have a lawful reason to keep it. If someone asks us about their details in your book, we will pass the request on to you.

10. Children

Account Runway is for people aged 18 and over. It is not meant for children, and we do not knowingly collect children's personal data. If you believe a child has used it, write to us and we will delete the account.

11. Changes to this policy

If we change this policy, we update the date at the top. If a change matters, we tell you in the app or by email before it takes effect.

12. Contact and Grievance Officer

Kishan Jaiswal
Coimbatore - 641014, Tamil Nadu, India
Email: jaiswalkishan0010@gmail.com

The Grievance Officer for Account Runway is Kishan Jaiswal, at the address and email above. We acknowledge complaints within 7 days and resolve them within 30 days.