Privacy policy

In short

• TakaFlow keeps your money records so it can show you your spending, budgets and goals. It does not sell your data, show ads or use trackers.
• Bank and wallet SMS are read on your phone. For each transaction, TakaFlow uploads the details it found and a short masked excerpt — not the message, unless you switch on “Keep original text”.
• Gmail receipts are optional and read only emails from the banks and wallets TakaFlow supports.
• Ask TakaFlow's AI is optional. When you use it, your question and the figures needed to answer it go to Anthropic.
• Your data lives in one database, and there are no backups. Deleting your account deletes everything at once. Download a copy from the app whenever you want one.

1. Who we are

TakaFlow is a personal finance app for Bangladesh, made and run by Saidul Badhon (“TakaFlow”, “we”, “us”). We decide how your data is used. You can reach us at saidulbadhon@gmail.com.

This policy covers the TakaFlow Android app, its server, and this website (takaflow.saidulbadhon.com).

2. Your account

• Signing up with email: your name, email address and password. The password is stored only as a one-way hash, never in a form anyone can read. The sign-in codes we email you are stored hashed too, and stop working after 10 minutes.
• Signing in with Google: Google shares your name, email address and profile picture with us, and we keep the sign-in tokens Google issues. They give access to your basic profile only.
• Sessions: for each device you sign in on, the session's IP address, the app or browser it came from, and when it expires. A session lasts 30 days and is renewed while you use the app.
• Settings: your preferences, such as language, appearance, week start, notification choices and whether “Keep original text” is on.

3. Your ledger

What you put into TakaFlow, or let it import for you:

• Your accounts (name, bank or wallet, the last digits if you add them) and their balances.
• Transactions: amount, date, type, merchant or counterparty, category, account, any note you write, and where each one came from.
• Budgets, goals, categories, rules, recurring payments and your review decisions.
• Imports: transactions from CSV files and pasted messages, your import history, and each CSV file's column layout so the next file from the same bank fills itself in.
• Which sources you connected (SMS, Gmail), when, and how their last sync went; and the notifications TakaFlow shows you in the app.

4. Bank and wallet SMS (Android, optional)

What is read

Only after you connect it and allow SMS access, TakaFlow reads, on your phone, messages from the bank and wallet senders built into the app (such as bKash, Nagad, Rocket and supported banks) and from any senders you add yourself. When you first connect, it reads the last 30 days; after that, new messages. Messages from any other sender are not read.

Each message is checked on the phone. Messages that are not transactions (offers, one-time passwords and the like) are skipped there: only a count of them is sent, nothing of their content.

What is uploaded and kept, per transaction message

• the sender (for example “bKash”) and the time the message was received;
• a keyed hash of the message, so the same message is never imported twice (it can't be turned back into the message);
• a masked excerpt: the first 160 characters of the message, with phone and account numbers masked;
• the details TakaFlow found in it: amount, type, date and time, fee, balance, the merchant or counterparty (masked), the last digits of the account or card, and the transaction reference.

We also keep the name of the phone you connected and how far the scan has read.

The full text — only with “Keep original text”

The full message is uploaded and kept only if you switch on Keep original text (Profile → Privacy & data use). It is stored encrypted, so you can see exactly what was read. Turning the setting off deletes every text kept so far.

5. Gmail receipts (optional)

Not offered yet. Gmail import is switched off at launch. This section describes how it works once it is turned on.

What is read

When you connect Gmail, you give TakaFlow read-only access (gmail.readonly): it can't send, change or delete mail. TakaFlow's server then asks Gmail only for messages from the email domains of the banks and wallets it supports — from the last 30 days the first time, then new ones. For each of those it checks the sender first, and only then reads the email to find a transaction. Other mail is never opened.

What is kept

• For an email that is a transaction or a balance: the same as for an SMS — the bank or wallet it came from, the time it was received, a keyed hash of the email's ID, a masked excerpt (the first 160 characters, numbers masked) and the details found in it.
• For any other email: nothing, only a count.
• The full email text only with Keep original text on, encrypted, as for SMS.
• The address of the Gmail account you connected, Google's access tokens (encrypted), and how far the sync has read.

Gmail-imported transactions become part of your ledger like any other, which means Ask TakaFlow can use them too (section 6). See also Google user data.

6. Ask TakaFlow (optional)

Quick questions are worked out on our server and send nothing to anyone. AI questions are answered by Claude, an AI model run by Anthropic. Before your first AI question the app asks for your OK.

When you ask the AI, TakaFlow sends Anthropic:

• your question, exactly as you typed it;
• today's date and your time zone;
• the ledger figures the AI looks up to answer — amounts, merchants, dates and categories, and the names of your budgets and goals — including transactions imported from Gmail.

It never sends your name or email address, account or card numbers, notes, references, or the text of your messages.

Our server does not store your questions or the answers; it only counts how many AI questions you asked today, for the daily limit. Anthropic processes what we send to produce the answer, under its commercial terms: Anthropic does not train its models on what we send, and deletes it within 30 days unless it is flagged for a usage-policy review.

7. Technical data

• Abuse protection: short-lived counters keyed by IP address or email address, so nobody can guess codes or passwords. They expire on their own.
• Server logs: errors and request records that help us keep the service working. Requests to this website are logged too: the IP address, the page and the time. Owner: say how long the server keeps logs.
• App updates: the app checks Expo's update service for fixes, which sees your device's IP address, the app's version and the platform — not your account.
• No analytics, no trackers, no advertising IDs in the app. This website sets no cookies and runs no scripts.

8. How we use your data

Only to run TakaFlow for you:

• import, sort and show your transactions, balances, budgets, goals and insights;
• answer your Ask TakaFlow questions;
• send sign-in codes and messages about your account;
• keep accounts secure and fix problems.

We don't sell your data, use it for advertising, or use it to train AI models. We don't share it with anyone except the services in section 10, and when the law requires it.

9. Google user data

Not offered yet. Sign in with Google and Gmail import are switched off at launch. This section applies once they are turned on.

TakaFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Sign in with Google data (name, email, profile picture) is used only to create your account and sign you in.
• Gmail data is used only to find your bank and wallet transactions, add them to your ledger and show them to you — a feature you turn on yourself — and, when you ask the AI a question, as part of the ledger figures it looks up (section 6).
• Gmail data is not used for advertising, not sold, and not used to train AI or machine-learning models.
• Gmail data is transferred to others only as needed to provide those features: to our server host (where it is stored) and, for transactions the AI looks up, to Anthropic.
• No person reads your Gmail data, unless you ask us to and allow it (for example, for support), it is needed for security (such as investigating abuse), or the law requires it.

You can disconnect Gmail in the app at any time (Profile → Privacy & data use → Data sources → Gmail receipts): TakaFlow asks Google to revoke its access and deletes the tokens. You can also remove TakaFlow from your Google Account's connections.

10. Who else handles your data

These services process data for us, only for the purposes below:

11. Where your data lives and how it is protected

• Everything is stored in one production database on our server. Owner: say the country the server is in.
• There are no backups. Your data is not copied anywhere else. If the server or its database were lost, your data would be lost with it, and we could not restore it. If you want a copy, use Export my data in the app.
• The app talks to the server only over HTTPS. Gmail tokens and kept original texts are encrypted in the database; passwords and sign-in codes are hashed; phone and account numbers are masked before they are saved.
• On your phone, App lock (Profile → Privacy & data use) asks for your fingerprint, face or screen lock when TakaFlow opens.

12. How long we keep it

• Your account and ledger: until you delete them — single items in the app, or everything by deleting your account.
• Kept original texts: until you switch “Keep original text” off or delete your account.
• Gmail access: until you disconnect, Google ends it, or you delete your account. While TakaFlow's Gmail access is in Google's testing stage, Google ends it after 7 days and the app asks you to reconnect. Transactions already imported stay in your ledger until you delete them.
• SMS: disconnecting stops reading; transactions already imported stay until you delete them.
• Sign-in codes: 10 minutes. Sessions: 30 days after you last used them, or until you sign out.
• Ask TakaFlow: questions and answers are not stored on our server; the daily count expires.
• After you delete your account: a record that an account was deleted, with a scrambled value in place of your account ID and nothing else about you; and a short marker with your internal account ID for 7 days, so a late request from an old device can't recreate anything. There are no backups, so no other copy remains with us.

13. Your choices

• See and correct: everything TakaFlow keeps about your money is in the app, and you can edit or delete it there.
• Take a copy: Profile → Export my data gives you one JSON file with everything, including a CSV of your transactions.
• Stop a source: disconnect SMS or Gmail in Profile → Privacy & data use → Data sources.
• Stop keeping text: switch off Keep original text; kept texts are deleted.
• Skip the AI: Ask TakaFlow's AI is used only when you ask it a question.
• Delete your account: in the app or by email — section 14.
• Questions or complaints: email saidulbadhon@gmail.com.

14. Deleting your account

In the app: Profile → Delete account → Delete my account…, type your email address, then confirm with your password or with Google. It happens at once: your data is deleted, Gmail access is revoked and every device is signed out. It can't be undone.

Can't use the app? Email us from your account's address and we'll delete it for you. Both ways are explained step by step on Delete your account.

15. Changes to this policy

When TakaFlow changes how it handles data, we update this page and the date at the top. If a change affects what we collect or who handles it, we'll tell you in the app or by email.

16. Contact

Email saidulbadhon@gmail.com with any question about your data or this policy.