Legal
Privacy Policy
Last updated: October 30, 2026
Your financial data stays on your phone.
Individual expenses, amounts, titles, and budgets are stored locally on your device only — they are never uploaded to our servers. The only exception is device-to-device sync, which is AES-256 encrypted, temporary (15 minutes), and self-deleting.
1. Who we are
Needs & Wants is operated by Khushal Panchariya, an individual based in India, trading under the name "Needs and Wants." We are not a registered company. References to "we," "our," or "us" in this policy refer to Khushal Panchariya.
Contact us at: hello@needsandwants.in
2. What data we collect
We collect the minimum data necessary to provide the service.
Account data (stored on our servers)
- Email address — used for authentication and account recovery
- Display name — shown on your profile and the friends leaderboard
- Date of birth — used to personalise your experience (optional; locked after first entry)
- Subscription plan status — free, pro monthly, or lifetime
- Friends list — user IDs of people you follow on the leaderboard
- Custom expense categories you have created
- Referral codes and any bonus trial days earned
Data that never leaves your device
- Individual expenses (title, amount, category, date)
- Budgets and spending limits
- Full expense history
- App settings and preferences
Device sync (temporary)
When you explicitly use the "Sync to Other Device" feature, your full expense data is AES-256 encrypted on your device, uploaded to our servers for a maximum of 15 minutes, and then permanently deleted the moment the receiving device downloads it. The decryption key exists only in the QR code — we cannot read this data.
Bill images (AI scanning)
When you use the bill scan feature, the image is sent directly to Groq for processing. We do not store bill images on our servers. Groq's own privacy policy governs how they handle this data.
Voice recordings (voice add)
When you tap the microphone to add an expense by voice, the app records only while you are speaking and sends that short recording directly to Groq to turn it into text. The text is then sent to Groq to identify the expense details. The recording is deleted from your device after processing, and we do not store recordings or transcripts on our servers. The app only uses the microphone after you tap the mic button. Groq's own privacy policy governs how they handle this data.
3. Website cookies and local storage
The Needs & Wants website (needsandwants.in) uses browser local storage — not tracking cookies — for the following purposes only:
- Storing your referral code from a referral link so it can be applied when you sign up
- Remembering your display theme preference (dark/light mode)
We do not use advertising cookies, third-party tracking cookies, or analytics cookies on the website. No personal data is stored in browser local storage.
4. Legal basis for processing (GDPR)
If you are in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:
- Contract performance — email address, name, and plan status are necessary to provide your account and the Service you signed up for
- Legitimate interests — crash reports and anonymous usage analytics help us improve the Service; these interests are not overridden by your rights given the data is minimal and anonymised
- Legal obligation — we may retain minimal records if required by applicable law
You may object to processing based on legitimate interests at any time by contacting us at hello@needsandwants.in.
5. Third-party services
We use the following third-party services. We share only what is necessary for each service to function.
| Service | Data shared | Purpose | Stored? |
|---|---|---|---|
| Supabase | Email, name, DOB, plan, friends list, categories, referrals | Authentication & account storage | Yes — permanent (until deletion) |
| RevenueCat | User ID, purchase history | In-app purchase management & entitlement verification | Yes — retained per their policy |
| Groq | Bill images and voice recordings you choose to submit | AI-powered bill scanning and voice add | No — Needs & Wants does not store them |
| Firebase Analytics | Anonymous event names only (e.g. expense_added, plan_upgraded) | App usage analytics — Android only | Yes — anonymised, no personal data |
| Firebase Crashlytics | User ID, crash logs | Crash reporting — Android only | Yes — retained per Google policy |
Firebase (Analytics and Crashlytics) is enabled on Android only. It is currently disabled on iOS. We do not use any advertising networks, data brokers, or behavioural tracking.
6. How we use your data
- To create and manage your account
- To verify in-app purchases and unlock paid features
- To display leaderboard rankings among friends you choose to follow
- To attribute referral bonuses
- To investigate crashes and bugs (crash reports only)
- To understand general feature usage patterns in aggregate (analytics only)
- To respond to your support requests
We never sell your data. We never use your data for advertising.
7. Data retention
- Account data is retained until you delete your account.
- Transient device-sync data is deleted within 15 minutes or immediately upon download, whichever is sooner.
- When you delete your account, we delete your profile, friends list, referral data, custom categories, and authentication record from our servers. Purchase history is retained by RevenueCat per their own policy.
8. Your rights
Regardless of where you are located, you may:
- Access or correct your account data at any time via the app profile screen or the website profile page
- Delete your account and all associated data at any time via Settings → Delete Account in the app
- Request a copy of the data we hold about you by emailing us
- Withdraw consent and stop using the service at any time
EU/UK residents have additional rights under GDPR (including data portability and the right to restrict processing). Indian residents have rights under the Digital Personal Data Protection Act, 2023. To exercise any right, email us at hello@needsandwants.in.
9. Children
Needs & Wants is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.
10. Security
Account data is stored in Supabase with encryption at rest and in transit (TLS). Device-sync data is AES-256 encrypted before leaving your device. No system is 100% secure; if you have a security concern, please email us immediately.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top always reflects the most recent version. For minor changes (wording clarifications, corrections), updating the date is sufficient notice. For material changes — such as collecting new types of data or adding new third-party services — we will notify you by email before the change takes effect.
Continued use of the Service after changes are posted constitutes acceptance. Previous versions are available upon request at hello@needsandwants.in.
12. Contact
For any privacy questions, data requests, or concerns: