Privacy Policy

Every commitment you add — its name, amount, dates, cycle, category, payment method and notes — is stored in the app's private storage on your device. So are your settings. Reminders are scheduled by your phone's own notification system; no server is involved and no internet connection is needed.

If you turn on the app lock, your fingerprint or face data stays inside your phone's secure hardware — the app only learns whether verification passed. The backup PIN is stored as a salted hash and never leaves the device.

If you use Scan to fill in a bill or document, only the one photo you pick is read — by Google ML Kit text recognition running on your phone. The photo is never uploaded, and the app doesn't keep it after reading.

If you add the home-screen widget, it shows your upcoming items on your home screen, where anyone who can see your phone can see them. Add to calendar creates a calendar file on your phone; you choose where it goes.

You sign in with Google:

• We receive your Google account's name, email address, profile photo and account ID through Firebase Authentication.
• A copy of your commitments is backed up to Google Cloud Firestore, on Google Cloud servers in India, readable only by your signed-in account.
• Changes sync quietly in the background. A deleted commitment is marked deleted in the backup, so it doesn't come back on another phone, and is fully erased within 90 days.
• Signing out makes a final backup, then removes your items from this phone and stops all syncing. Sign in again to get them back.

If you turn on Profile → Calendar sync, the app builds a calendar file of your due dates and saves it in Google Cloud Firestore, and this website serves it at a private link (nabikaran.app/api/calendar/…). The Google, Apple or Outlook calendar you add it to fetches that link from time to time.

• The file holds item names, who each is for, due dates, notes and reminder days. Amounts only if you turn them on.
• The link contains a long random code and is the only key: anyone who has it can see that calendar, so don't share it.
• Make a new link stops the old one at once. Turning calendar sync off deletes the file.

We use Google Firebase Analytics to understand how many people use Nabikaran. It records coarse events — the app being opened, a commitment being added, or one being marked renewed — together with device model, Android version, app version, country and a random app-instance ID.

These events never include commitment names, amounts, notes, or your Google identity.

Against your account we keep only: when the app was last used, how often each feature is opened, how many commitments you track of each type (e.g. "Electricity: 2"), your app language and version, and a push-notification token so we can occasionally send everyone — or a group of users — a message. That record also holds your name, email and profile photo. Commitment names, amounts, dates and notes never leave your phone this way.

If the app crashes or hits an error, a crash report is sent to Google Firebase Crashlytics so we can find and fix the problem. It contains the technical error details (stack trace), device model, Android and app version, and a random install ID.

Crash reports never include your name, email, commitment names, amounts or notes, and aren't linked to your Google account.

To keep the app free, Nabikaran may show ads served by Google AdMob. When ads are shown, Google may collect your device's advertising ID, approximate location derived from your IP address, and device information to serve and measure them, as described in Google's advertising policy.

We never share your commitments or amounts with advertisers. You can reset your advertising ID or opt out of personalised ads in your phone's Settings → Google → Ads.

• When you share a reminder with family, its name, amount and due date are placed inside the link itself, and you choose who to send it to. The part of the link that carries them (after the #) is never sent to our website's server, and we don't store shared reminders.
• Pay now simply opens the eSewa or Khalti app (or the ConnectIPS website). Nabikaran sends them nothing and never sees your payment.

• Notifications — to show renewal reminders.
• Alarms & reminders (exact alarms) — so reminders arrive on time, even in battery-saver mode.
• Run at startup — to restore scheduled reminders after your phone restarts.
• Biometrics — only if you turn on the app lock.
• Camera or photos — only when you choose Scan, through your phone's own camera or photo picker. The app has no ongoing access to your photos.
• Internet — for backup, analytics and ads. Tracking and reminders work fully offline.

• Sell or rent your personal data.
• Access your bank accounts, eSewa, Khalti, cards or make payments.
• Read your SMS, contacts, files or precise location — or any photo other than one you choose to scan.

If you join the waitlist on this website, we store the email address you enter, the page language, where you signed up from (for example, a guide page) and the time. We use it only to invite you to test the app and to tell you when it launches — no newsletters, and we never share or sell it.

It's kept in Google Cloud Firestore, where only authorised Pahadi Labs staff can read it. To be removed at any time, email us from that address and we'll delete it within 30 days.

• To provide the app: reminders, your backup, and restoring your list on a new phone.
• To keep it working: finding and fixing crashes and errors.
• To improve it: seeing which features are used, in aggregate.
• To keep it free: showing ads through Google AdMob.
• To tell you about the app: occasional service messages, such as an important deadline or a new feature.
• We don't use your commitments for advertising, and we don't make automated decisions about you.

• Google, as our service provider for sign-in, backup, analytics, crash reports, notifications and ads. Google processes this data under its own terms and privacy policy.
• Our team: only authorised Pahadi Labs staff can see account and usage records, and only to run, support and improve the app. Nobody at Pahadi Labs reads the contents of your backup, except to carry out a request from you.
• When the law requires it: we may disclose information if required by a valid legal request in Nepal.
• We do not sell, rent or trade your personal information.

• Deleting a commitment removes it from your phone straight away; if you're signed in, the backup copy is marked deleted and fully erased within 90 days.
• If you export a backup file (Profile → Your data → Back up to a file), it contains your commitments. Where you keep it — Drive, Files, email — is up to you; we never receive it.
• Uninstalling the app erases everything stored on the phone.
• To delete your Google backup and account entirely, follow the steps on Delete your data. We complete requests within 30 days.
• Analytics data isn't linked to your identity and is deleted automatically under Firebase's data-retention settings.
• Your account's usage record (above) is deleted on request along with your account — see Delete your data.

• See and take your data: everything you track is in the app, and you can export it any time (Profile → Your data → Back up to a file).
• Correct it: edit or delete any item in the app.
• Delete it: delete items one by one, or your whole account and backup — see Delete your data.
• Notifications: turn the app's notifications off in your phone's settings.
• Ads: reset your advertising ID or opt out of personalised ads in Settings → Google → Ads.
• For anything else about your data, email us — we reply within 30 days.

Data sent to Google services is encrypted in transit (HTTPS/TLS). Backups are protected by Firestore security rules so only your signed-in account can read or write them. No method of storage is perfectly secure, but we use industry-standard protections and keep what we collect to a minimum.

This website, including the blog, uses one small cookie, nb_lang, holding only "en" or "ne": it remembers the language you last used, so the homepage opens in it next time (a first visit from Nepal opens in Nepali, using the country our host detects from your connection; we don't store it). There are no analytics or ad trackers. Like any website, our hosting provider keeps standard server logs (such as IP address, browser and pages requested) for security and to keep the site running.

Nabikaran is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child has signed in, contact us and we'll delete it.

If this policy changes, we'll update this page and the date at the top.