Privacy policy

Your statements are read, not kept

Last updated 5 November 2026. This policy explains what happens to the information you give RethinkFin, which is run by Ajit Shukla.

What we process

• The statements you upload (CSV or PDF): transaction dates, descriptions, amounts and balances. Descriptions can include your name, account numbers, UPI IDs and the names of people or businesses you paid.
• Your name, if you type it, to recognise transfers between your own accounts.
• Your PDF password, if you type it, only to open a protected statement in memory. It isn't saved or logged.
• Your options, such as whether to hide account numbers in the results.
• Anonymous counts: how many times each day the home page and sample report are opened, results are shown or a check fails (and the general reason, such as a wrong PDF password), and the options picked in the optional two-question survey. If you arrived from one of our ads, the ad's campaign name from the link is counted with them. These are totals only: nothing in them identifies you, your device or your statement, and we don't use cookies for them.
• Technical data: your IP address, which we hold in memory for up to 24 hours to limit how many statements one person can check, so the service stays available for everyone.

How we use it

Only to produce your results: categorising transactions, finding recurring payments, fees and spending patterns, and showing them back to you. Statements are processed in the server's memory. They aren't written to disk or a database, and they're discarded as soon as your results are ready. Your results exist only in the page we send back to you; if you close it, we can't show it to you again.

What we don't do

• We don't store statements, transactions or results.
• We don't put your statement's contents in our logs. Errors are logged by type only.
• We don't use advertising trackers, tracking cookies or third-party analytics on this site.
• We don't sell, rent or share your information with anyone for their own purposes.

Who else is involved

The service runs on servers provided by our hosting provider, Railway, whose servers may be outside India. Your statement passes through their infrastructure while it's being processed. Like most hosting providers, they may keep standard request logs (such as IP address and time of request) for security and operations under their own policies; these never include the contents of your statement.

Your consent and your rights

By uploading a statement you consent to it being processed as described here, for the sole purpose of producing your results. Upload only statements for accounts you own or are authorised to use.

Under India's Digital Personal Data Protection Act, 2023, you have the right to ask what personal data we process about you, to have it corrected or erased, to have your grievances addressed, and to nominate someone to exercise these rights on your behalf. Because we don't keep your statements or results, there is usually nothing stored to access or erase, but you can always ask us.

Children

This service is for people aged 18 and over.

Security

All traffic is encrypted with HTTPS. The site sends strict security headers, limits upload size and rate, and keeps uploads in memory only. No system is perfectly secure, so if you're unsure, use the "Hide account numbers…" option and check the results before sharing them.

Grievance officer and contact

For any question, request or complaint about your data, contact our grievance officer, Ajit Shukla, at [email protected]. General contact: [email protected]. Postal address: Pratik Harmony, Kalamboli, Navi Mumbai.

We'll respond as soon as we can. If you're not satisfied with our response, you may complain to the Data Protection Board of India.

Changes

If we change how we handle data, for example to let you save results to an account, we'll update this page before the change takes effect and change the date at the top.