Privacy policy

QuickMonk Technologies Private Limited is a private limited company incorporated in India (CIN U62020TS2026PTC215610), registered at Chitrapuri Colony, Rangareddy, Telangana 500089. We are the data fiduciary for the purposes of the Digital Personal Data Protection Act, 2023. You can reach us at hello@quickmonk.in.

Contact form. When you submit a form we receive the name, email address, optional company name and message you typed. The form is delivered to us by EmailJS, a third-party email relay, and lands in our mailbox. We use it only to reply to you. We do not add you to a newsletter.

Cookies and analytics. This website sets no tracking cookies and runs no third-party analytics. Fonts are served from Google Fonts, which may log your IP address as part of serving the file. The site is hosted on Firebase Hosting (Google), whose servers keep standard access logs.

WealthMonk is built so that the most sensitive data never reaches us. The following are processed and stored only on your device:

• SMS message bodies. On Android, with your explicit permission, the app reads messages from registered bank sender IDs to extract transactions. Parsing happens on the phone. The text of a message is never transmitted to our servers, and our database schema has no column that could hold it.
• OTPs and non-bank messages. Ignored. They are not parsed, stored or listed.
• Free-text notes you attach to a transaction are encrypted on the device with AES-256-GCM under a key held in the operating system’s secure keystore. The key never leaves the device, so notes are unreadable to us even when synced.
• Biometric data. App lock uses the operating system’s biometric API. We never receive fingerprint or face data.
• Receipt photos are stored on the device and, if you enable sync, in your private storage bucket.

To sync your data between devices and keep it safe if you lose your phone, the following derived records are stored in your account, isolated from every other user by row-level security and encrypted in transit and at rest:

• Your mobile number (used for OTP sign-in), display name, and optional email and avatar.
• The derived record of each transaction: amount, payee, date, category, account, and direction. Not the message it came from.
• A SHA-256 digest of each processed SMS, so a rescan cannot import the same message twice. A digest cannot be reversed into the message.
• Accounts, cards, balances, budgets, goals, bills, assets and liabilities you have chosen to track.
• Preferences: currency, notification settings, card order.

Parser diagnostics. When a message looks like a transaction but cannot be read, the app records a redacted template of its shape — every digit, amount, account number, name, address and URL replaced before storage. This template stays on your phone. If you choose to send it to help us support your bank, it is transmitted as an anonymous aggregate with no account identifier attached.

• Firebase Authentication (Google) — phone-number OTP sign-in.
• Supabase — managed PostgreSQL and object storage for the derived records above.
• EmailJS — delivery of website form submissions.
• Firebase Hosting (Google) — serving this website.

Each processor acts on our instructions and is bound by its own data-processing terms. We do not sell personal data, and we do not share it with advertisers.

WealthMonk does not currently distribute mutual funds, insurance, loans or any other financial product, and earns no commission on anything it shows you. Your data is not used to target you with offers. If that changes, it will be under our own regulatory authorisation, disclosed in the app, and reflected in this policy first.

• Access and export. Export your ledger as CSV or PDF from the app at any time.
• Correction. Edit any transaction, account or profile field in the app.
• Erasure. Delete your account from Profile. This wipes your profile, every row, every storage object and the local encryption key. It is not reversible.
• Withdraw consent. Revoke SMS or notification permission from your phone’s settings at any time; the app continues to work with manual entry.
• Grievance. Write to hello@quickmonk.in. We respond within the timelines required by the DPDP Act.

Account data is kept while your account exists and deleted when you delete it. Website form submissions are kept in our mailbox for as long as the conversation is live and then removed. Server access logs are retained by the hosting provider for its standard period.

WealthMonk is intended for adults with their own bank accounts. We do not knowingly collect data from anyone under 18.

We will update this page when the software or the law changes, and note the date at the top. Material changes to what the app collects will be announced in the app before they take effect.