1. Who we are
Kanalyst is a personal and family finance app built and run in India. It helps you track investments, goals, retirement, loans, insurance, documents and important dates for the people in your household. Kanalyst is an information tool. It is not a bank, broker or registered investment adviser, and nothing in it is financial advice.
2. What we collect
| What | Where it comes from |
|---|---|
| Account details: name, email, and a password hash or Google sign-in | You, when you sign up |
| Optional profile details: PAN, date of birth, mobile number, broker client code | You, in Profile. Used only to open password-protected statements (see section 5). |
| Holdings and statements: stocks, mutual funds, NPS, dividends | Consolidated Account Statements (CAS) and NPS statements you upload or that we read from Gmail with your permission |
| FDs, RDs, PPF, EPF, SSY, loans, balances | You enter them |
| Bank transactions: amount, merchant, date, bank, category | Bank SMS read on your Android phone (section 4) |
| Goals, Blueprint boards, retirement plan, comments | You create them |
| Family information: names, relations, dates of birth, insurance policies, document types and due dates | You enter them. We keep only the last 4 characters of policy and document numbers, never the full number. |
| Technical logs: sync results and errors | Our servers, to fix problems |
We do not collect your bank, broker or demat passwords, and we never ask for OTPs.
3. How we use it
- To show your net worth, holdings, spending, goals, retirement plan, family cover and calendar.
- To remind you about renewals, premiums, fees and maturities.
- To keep the web app and Android app in sync for your account.
- To fix errors and keep the service secure.
We do not use your data for advertising, and we do not use it to train AI models.
4. Bank SMS (Android)
With your permission, the Android app reads SMS from known bank and card sender IDs to record transactions. It does not read personal messages, OTPs or messages from your contacts. Transaction details (amount, merchant, date, bank) are stored on your phone and synced to your Kanalyst account. You can turn off SMS access at any time in your phone’s settings. Transactions you added by hand are not affected.
5. Gmail integration: Limited Use disclosure
The web app can optionally connect to your Gmail account, with the read-only gmail.readonly permission, to import your investment statements automatically.
- What we look for: statements from the depositories (NSDL, CDSL, CVL), NPS statements from Protean, and income or dividend emails matching rules you set up.
- What we keep: only the figures extracted from those statements, such as holdings, values and dates. We don’t keep the emails themselves.
- Password-protected PDFs: to open a statement, we may use the PAN, date of birth or mobile number you saved in Profile. When a password can’t be worked out by simple rules, the email’s sender, subject and body text and those profile details may be sent to Google’s Gemini API to suggest the password. Some PDFs may also be read using Google’s text-recognition services. This processing happens under Google’s API terms.
- What we never do: send, delete, label or change your email; read unrelated personal email; or let a human read your email, except with your explicit consent for a specific support request, or where the law requires it.
- Token storage: your Gmail access tokens are encrypted with AES-256-GCM before they are stored.
- Turning it off: use Settings → Privacy → Disconnect Gmail, or remove Kanalyst at myaccount.google.com/permissions. Disconnecting revokes our access at Google and deletes the stored tokens.
Kanalyst’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Google Sheets
If you connect Google Sheets, we ask permission to write to the spreadsheet you choose, to export your data. We don’t read other files in your Google Drive. You can revoke this at any time from your Google Account.
7. Family sharing
You can invite your partner or other adults into a family group. People in the same family group can see each other’s shared information, such as combined holdings, goals, insurance, documents and calendar dates. Only the person who added an item can change or delete it. You can leave a family group, or remove someone from it, at any time.
When you add family members who don’t have their own account, such as children or parents, you are responsible for having their permission, or the authority to share their details on their behalf.
8. Storage and security
Your data is stored in a Supabase (PostgreSQL) database, and the service runs on Railway, Vercel and Netlify. All traffic uses TLS (HTTPS). Data is encrypted at rest by our database provider, and Gmail tokens get an extra layer of AES-256-GCM encryption. Access to your data requires your signed-in session. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects you.
9. Who we share with
We don’t sell or rent your data. We share it only:
- with the service providers that run Kanalyst (Supabase, Railway, Vercel, Netlify, Google), only to provide the service;
- with people in your family group, as described above;
- when the law requires it.
10. Your rights
You can see, correct, export or delete your data. You can withdraw any permission (SMS, Gmail, Sheets) at any time. To ask for a copy of your data, write to us at the address below. We follow India’s Digital Personal Data Protection Act, 2023.
11. Deleting your data
In the web app, go to Settings → Privacy → Delete Account & All Data and type DELETE to confirm. This revokes Gmail access and permanently removes your account and everything linked to it: holdings, transactions, goals, Blueprint boards, retirement plan, family members, policies, documents and calendar entries. On Android, use Settings → Privacy & Permissions → Delete All My Data. Deletion can’t be undone.
12. Children
Kanalyst accounts are for adults (18 or older). Parents may record details about their children, such as name, birthday, school fees, savings and insurance, inside their own account. Children do not get their own accounts.
13. Changes to this policy
If we change this policy, we will update the date at the top. If the changes are significant, we will tell you in the app before they apply.
14. Contact
Questions, data requests or concerns: hello@kanalyst.in