Cazhoo Privacy

This policy explains what personal data Cazhoo collects, why, who else handles it, how long we keep it and what you can do about it. It covers the Cazhoo website (https://cazhoo.duodev.in), the Cazhoo app for Android and the Cazhoo API that apps you authorize use. We wrote it to match how Cazhoo actually works; if something here is unclear, write to us (section 17).

In short: we collect what Cazhoo needs to keep your money records, sync them between your devices and keep your account secure. We never sell your data, never show ads and never use your financial records for advertising, credit scoring or profiling. You can export your data and delete your account at any time.


Cazhoo is a product of Duo Dev Technologies, India ("Duo Dev", "we", "us"). We decide how and why your personal data is processed for Cazhoo (under India's Digital Personal Data Protection Act, 2023, we are the data fiduciary).

- Email: support@duodev.in
- Grievance officer: Hariharan K, grievance@duodev.in, +91 94876 90260 (section 17)

You sign in to Cazhoo with a Duo Dev account, which you can also use for other Duo Dev products. Your account is kept by Duo Dev Accounts (https://accounts.duodev.in), not by Cazhoo. You sign in there with your email address and password, with a passkey, or with Google (or another linked account, where the sign-in page offers it), and you can turn on two-step verification there. Cazhoo never sees your password, your passkey or your Google password, and it gets nothing from your Google account other than through your Duo Dev account. How Duo Dev Accounts handles your sign-in data is explained in its own privacy policy at https://legal.duodev.in/products/dd-auth/privacy-policy.

When you sign in, Duo Dev Accounts gives Cazhoo your Duo Dev account ID, name, email address, whether the email is verified, and your profile picture link. Cazhoo keeps these in your Cazhoo profile and updates them each time you sign in. In the Android app, you sign in in your phone's browser; the app keeps its sign-in tokens in your phone's secure storage.

If you used Cazhoo before Duo Dev accounts: when you move your old Cazhoo account to a Duo Dev account, we send your name and email address, and the password you type on the transfer page if you choose to keep it, to Duo Dev Accounts over an encrypted connection to create your Duo Dev account. We do not store or log that password.

We do not collect your location, contacts, calendar, SMS, call logs, browsing history, or any advertising ID. The Android app never reads your address book: friends are found by Cazhoo username or an email you type.

Legal basis. We process your data with your consent, which you give when you create your account and accept this policy, and for the purposes you would reasonably expect when you use Cazhoo (providing the service, security, fixing errors), as the DPDP Act allows. You can withdraw your consent by deleting your account (section 12); we then stop processing your data, except as described in section 11.

- To provide Cazhoo: store your records, calculate balances, budgets, schedules and reports, sync your devices.
- To send the notifications and emails you asked for: reminders, budget alerts, EMI due dates, friend and split updates, support replies. You can change these in your Cazhoo settings and in your phone's settings.
- To keep Cazhoo and your account secure and to prevent misuse.
- To fix errors and improve the website and the app.
- To answer your questions.
- To meet legal obligations.

We do not use your financial records for advertising, marketing to third parties, credit scoring, lending decisions or selling insights.

Cazhoo shows other users only what you choose to share with them:

- Finding you: other Cazhoo users can find you by your username and see your name, username and profile picture, so that they can send you a friend request.
- Friends: when you are friends, they see your name, username and profile picture.
- Splits and borrow sync: when you split a bill with friends or sync a borrow with a friend, they see the details of that shared record (amount, date, description, who paid and owes) and the UPI IDs you added for being paid back.
- Invitations: when you invite someone by email, we send that address an invitation that names you.

Nothing else of yours is shown to other users. If you delete your Cazhoo account, the records you shared are removed from other users' devices, but they keep their own history, such as their notifications and activity entries that mention you, and their own transactions.

We never sell, rent or trade your personal or financial information to anyone, including advertisers and data brokers. We use these service providers, who handle data only on our behalf:Our emails are sent from our own mail server. Some providers above process data outside India (for example in the United States or the European Union); we use them only with protections that the law requires.

We may also disclose data when the law requires it (for example a valid court order), to protect the rights, safety and property of our users or of Duo Dev, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.

Apps made by other developers can use the Cazhoo API only if you authorize them on the Duo Dev Accounts consent screen. An app gets only the parts of your Cazhoo data covered by the permissions you approved there (for example, reading your transactions), and it may also receive notifications of changes to that data (webhooks), signed and sent over an encrypted connection. Those apps are not run by us and have their own privacy policies.

You can see and withdraw these permissions at any time in Duo Dev Accounts under Authorized apps (https://accounts.duodev.in/authorized-apps). Once you withdraw them, the app can no longer read your data and stops receiving changes within about a minute. The first-party Cazhoo app and website are not "third-party apps".

- Data on your phone. The app keeps a copy of your Cazhoo data on your phone so that it works without an internet connection, and syncs it with your account. It is stored in a database encrypted with a key kept in your phone's secure storage; each signed-in account has its own database. When you sign out, the app deletes that account's database and its downloaded files from your phone. The app's data is excluded from your phone's backups.
- Receipts, the camera and your photos. When you attach a receipt, you can take a photo with your phone's camera app, choose a photo with the system photo picker, or choose a PDF file. The app receives only the photo or file you pick; it does not access your photo library or files otherwise, and it does not ask for camera or storage permissions for this. Photos are reduced in size before upload. Receipts are uploaded with the transaction they belong to, are visible only to you, and are deleted when you delete the receipt, the transaction or your account.
- Push notifications. See sections 3 and 6. You can turn notifications off in your phone's settings; the app removes its registration when you sign out.
- No ads, no tracking. The app contains no ads and no advertising, analytics or tracking SDKs, and it does not use your phone's advertising ID.

The website uses cookies that it needs to work: your signed-in session, protection against cross-site request forgery, and a cookie that remembers that you are signed in to Duo Dev so you can be signed in without an extra click. If Google Analytics is turned on, Google sets its analytics cookies too. You can block or delete cookies in your browser; the website needs its own cookies to sign you in.

All data travels over encrypted connections (HTTPS). On our servers, access to your data is limited to the systems and staff that need it; receipts are stored privately and are served only to you after sign-in; webhook messages kept for delivery are encrypted. On your phone, your data is encrypted (section 8). No system is perfectly secure; if a personal data breach affects you, we will inform you and the authorities as the law requires.

We may keep data longer when the law requires it or to resolve a dispute, and only for that purpose.

- Single records: delete any transaction, receipt, wallet, budget, loan and so on in the app or on the website.
- Your Cazhoo account: in the app open Profile → Delete account, or sign in at https://cazhoo.duodev.in/account-settings and choose Delete Account. This deletes all your Cazhoo data from our servers straight away, including your receipts, report files, notifications, sign-in and change records, push registrations and sessions. Copies in our backups are deleted when those backups expire (section 11). Your Duo Dev account is not deleted by this.
- Your Duo Dev account: use Delete account in your Duo Dev account settings at https://accounts.duodev.in/settings. Your Duo Dev account is deactivated at once and deleted when the waiting period you choose (7 to 90 days) ends; at that moment Cazhoo also deletes all your Cazhoo data, as above. If you sign in again during the waiting period, the deletion is cancelled and your Cazhoo data stays.
- Data on your phone: sign out of the app or uninstall it.

Step-by-step instructions: https://legal.duodev.in/products/cazhoo/delete-account.

You can:

- access your data: everything is visible in the app and on the website, and you can ask us for a summary of the personal data we process and who we shared it with;
- export your data: the website's reports and transaction export download your data (PDF, Excel, CSV or HTML);
- correct your data: edit it in the app or on the website (your name and email in Duo Dev Accounts);
- delete your data (section 12) and withdraw consent (by deleting your account);
- nominate someone to exercise these rights for you in case of death or incapacity;
- complain to our grievance officer (section 17), and if you are not satisfied, to the Data Protection Board of India.

Write to support@duodev.in from the email address of your account; we may need to confirm it is you. We answer within the time the law sets.

Cazhoo is meant for adults. You must be 18 or older to use it, and we do not knowingly collect data of anyone under
18. If you believe a child has given us data, write to us and we will delete it.

When we change this policy we publish the new version with its effective date at https://legal.duodev.in/products/cazhoo/privacy-policy. If a change is important (for example new kinds of data or a new purpose), we ask you to accept the new version the next time you sign in, and you can't use Cazhoo with the new terms until you do. Version 2.0 is such a change.

Sign-in through Duo Dev accounts instead of Google only; the Android app (data on your phone, receipts, push notifications, crash reports); sharing with other users; apps you connect through the Cazhoo API; sign-in and security records; website analytics and cookies; service providers; how long we keep data; deleting your account; your rights under the DPDP Act; and our grievance officer.

Questions, requests and complaints about privacy: support@duodev.in.

Grievance officer: Hariharan K, Grievance Officer, Duo Dev Technologies, 2/45, JJ Colony, Near Common Service Centre, Mettupattithathanur, Salem, Tamil Nadu - 636103, India. Email: grievance@duodev.in. Phone: +91 94876 90260. We acknowledge complaints and resolve them within the time the law requires.