DRAFT – to be reviewed. This page is a draft for an India-only product. A lawyer still needs to review it before anyone relies on it. It names no company or other legal entity, and it states no price, because those details are not final.
Privacy Policy
Last updated: 21 October 2026. Policy version 2026-10-21.
CardDesk is a private tracker for card bills, expenses and statements, for people in India who are 18 or older. This draft says what the product stores and why. It is written for the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
What CardDesk stores
- Account. Your email address, display name, and a salted hash of your password. The password itself is not stored. When you create an account, CardDesk also stores the time you confirmed that you are 18 or older and agreed to this policy and the Terms, together with the policy version. Accounts created before that confirmation existed do not have this record, and they keep working.
- Cards. The issuer, card name, nickname and last four digits. An invited workspace stores only those last four digits: it refuses a full card number, an expiry date and a CVV. The original private deployment can also keep an encrypted full card number, expiry and CVV for its own cards. A one-time password is never stored.
- Expenses and bills. Amounts, dates, categories, shop or merchant names, notes, who paid, and the people named on a shared expense. Amounts are stored in paise and shown in rupees.
- Statements and mail used as evidence. Statement PDFs, and the message text CardDesk uses to record a bill, payment or expense. On a new statement PDF the full card number is blacked out, leaving the last four digits.
- Mailbox connection. An encrypted Google refresh token, or an encrypted Yahoo or iCloud app password, only so CardDesk can keep the read-only connection you asked for.
Encryption at rest
On the hosted service, cards, expenses, bills and the settings kept with them are stored in a ledger that is encrypted at rest. Statement files and other saved evidence are encrypted at rest too. While CardDesk is running, it decrypts that ledger into memory so it can show and update the records, then writes the encrypted file again. On the original private deployment, a full card number, an expiry date and a CVV are encrypted inside that ledger. An invited workspace does not store those three. A one-time password is never stored. A Google refresh token, or a Yahoo or iCloud app password, is encrypted. The account password itself is not stored; only a salted hash is kept.
The account registry (email address, display name, password hash, and the time and policy version of the 18-or-older confirmation) and the sign-in records are separate files. Those files are not encrypted at rest. A remembered session is stored as a hash of the sign-in token, not the token itself. The person who administers the server can read the stored files, and can read the ledger while it is decrypted in memory.
Gmail, read-only
If you connect Gmail, CardDesk asks Google only for the gmail.readonly scope (https://www.googleapis.com/auth/gmail.readonly). That permission lets CardDesk read mail. It does not let CardDesk send, delete or change mail. CardDesk refuses the connection if Google grants any other scope.
What is read: mail in the mailbox and folder you connect, from the date you choose, so CardDesk can record card statements, bills, payments, refunds and expenses. On an invited workspace, CardDesk searches Gmail for subjects such as statement, invoice, receipt, payment, transaction, refund, subscription, renewal, booking, itinerary, ticket and bill, then reads the matching messages and statement attachments. A search can miss a relevant message or include one that is not. The Google permission is still read-only access to the mailbox; the narrower search is CardDesk’s own filter. The owner’s own connection can scan the selected folder from the chosen date for the same kinds of messages.
Why: to fill in the card bills, expenses and statements you asked CardDesk to keep.
CardDesk does not sell Gmail data and does not use it for advertising. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the user-facing card, bill and expense features. People do not read that Gmail except where you ask, where it is needed for security, where the law requires it, or where it is aggregated and cannot identify you. CardDesk does not transfer Gmail data except to provide the service you asked for, with your consent, or where the law requires it.
You can revoke CardDesk’s Google access at any time at myaccount.google.com/permissions, and by disconnecting the inbox in CardDesk. Revoking access stops later reads. Mail already saved in your workspace stays until you delete it or ask Dhyey Jatania at jataniadhyey@gmail.com (Grievances and suggestions) to delete the account.
Yahoo Mail and iCloud Mail
You can connect Yahoo Mail or iCloud Mail with an app-specific password that you create in your Yahoo or Apple account. CardDesk does not ask for your normal mailbox password. It signs in over IMAP and opens the folder you choose as read-only. It reads messages from the date you choose for the same bills, payments and expenses. If you choose to remember the inbox, the app password is stored encrypted, and it is removed when you disconnect and forget that inbox. CardDesk does not use that connection to send mail.
Sign-in records
When someone signs in, CardDesk records the name or email they supply, the device name, the IP address, and the browser details the device sends. It also records failed attempts and sign-outs. This is for security: to recognise a remembered device, to slow repeated failed attempts, and to show login activity. These events are kept for up to 90 days, and at most the latest 10,000 events are kept.
How long other records are kept
Account, card, expense and statement records are kept while the account is in use, until you delete them or ask for the account to be deleted. An invitation link works once and expires within a day. A password-reset link works once and expires after 15 minutes.
Your choices, including deletion
You can ask to see your personal data, correct it, or delete it. A deletion request covers the account, the workspace records (cards, expenses, statements and mail already saved) and the sign-in history CardDesk still holds. You can also withdraw the agreement you gave when the account was created, and you can nominate another person to exercise these rights. Withdrawing that agreement, or asking for deletion, can mean CardDesk has to close the account, because the tracker cannot be provided without these records.
Send a request to see, correct or delete personal data, or to withdraw the agreement you gave when the account was created, to Dhyey Jatania at jataniadhyey@gmail.com (Grievances and suggestions). CardDesk will acknowledge it within 24 hours and complete a valid request within 15 days. If the law requires something to be kept, CardDesk will say so. The same address is on the Contact page.
If personal data is breached
If CardDesk becomes aware of a personal data breach, it will tell the people affected and the Data Protection Board of India, in the way and time the Digital Personal Data Protection Act, 2023 and the rules under it require. Where a cyber incident must be reported to CERT-In, CardDesk will report it within the time the CERT-In directions require, including the six-hour report where those directions require it. The notice will say, in plain language, what happened, which data was involved, and what you can do.
Age
CardDesk is only for people who are 18 or older. Creating an account requires that confirmation. CardDesk does not knowingly keep an account for a child.
Changes
The date at the top is the last update. A new account stores the policy version in effect when you agree. If this draft changes in a way that needs a fresh agreement, CardDesk will ask again before relying on the new wording.