Privacy Policy

Gramafin (“we”, “us”) provides a personal finance tracking tool for expenses, budgets, net worth, investments, and mutual funds in Pakistani Rupees. This policy explains what information we collect when you use Gramafin, how it's stored, and how it's used.

Account information: your name, email address, and a bcrypt-hashed password. We never store your password in plain text.

Financial data you enter: expenses, income, budgets, assets and liabilities, investments, mutual fund holdings, and bank account labels and balances that you type in yourself. Gramafin does not connect to your bank, does not ask for online banking credentials, and does not use any account-aggregation service — every number in the app is one you entered manually.

Receipts: if you attach a receipt image to an expense, that image is uploaded to private object storage accessible only to your account.

Technical data: standard request metadata (IP address, user agent) is processed transiently for security purposes such as rate-limiting abusive requests, and is not retained in your account data.

Account records and financial data are stored in Upstash Redis; receipt images are stored in Vercel Blob under a private, per-user path that only your authenticated session can read. All traffic to Gramafin is encrypted in transit (HTTPS). Passwords are hashed with bcrypt and are never recoverable by us in plain text.

Your data is used solely to provide the Gramafin service to you: rendering your dashboard, charts, and reports, and sending account-related email (verification, password reset, and security notices). We do not sell your data, and we do not share your financial data with third parties for advertising or marketing purposes.

We rely on a small number of infrastructure providers (“subprocessors”) to run Gramafin:

• Vercel — application hosting
• Upstash — database (Redis) for account and financial records
• Vercel Blob — private storage for receipt images
• Resend — delivery of transactional email (verification, password reset)
• Sanity — content for the public Help Centre only; it does not receive your account or financial data

None of these providers receive your data for advertising, analytics, or resale — each processes data only as needed to deliver their specific part of the service (hosting, storage, or email delivery).

If you track PSX-listed stocks or Pakistani mutual funds, Gramafin fetches public price and NAV data from the Pakistan Stock Exchange's data portal and MUFAP (Mutual Funds Association of Pakistan) to display alongside your holdings. This is a one-way, read-only lookup — your portfolio details (what you hold, at what price) are never sent to PSX or MUFAP; we only ask them for the current price of a symbol or fund name.

Gramafin does not use Google Analytics, Meta/Facebook Pixel, or any other third-party analytics or advertising tracker. We don't build an advertising profile from your usage, and nothing you do in the app is sold or shared for marketing purposes — by us or anyone we work with.

Gramafin sets a single session cookie (managed by our authentication system) so you stay logged in — it identifies your session only and isn't used for tracking across other sites. We also use your browser's local storage for two device-level preferences: your dark/light mode choice and sidebar layout — these stay on your device, aren't sent to us, and don't sync across devices. We do not use third-party advertising or tracking cookies.

You can, at any time, by emailing saad@gramafin.com from your account's address:

• Access — request a copy of the data we hold on your account
• Correction — most of your data is editable directly in the app; anything that isn't, we'll fix on request
• Deletion — permanently delete your account and all associated data
• Portability — request an export of your financial data in a machine-readable format

Gramafin is a small, single-operator service — these requests are handled by a person, not a self-serve portal, and we aim to respond within a few days.

Our infrastructure providers (Vercel, Upstash, Resend) operate global networks that may process or store data outside Pakistan. All data in transit is encrypted (HTTPS); at rest, financial records are stored in our database with no public access path.

We retain your data for as long as your account is active. To request deletion of your account and all associated data, email saad@gramafin.com from the address on your account — we will confirm and delete your records.

Gramafin is not directed to, and should not be used by, anyone under the age of 18.

If we make material changes to this policy, we'll update the date at the top of this page. Continued use of Gramafin after a change means you accept the updated policy.

Questions about this policy? Email saad@gramafin.com. See also our Terms of Use and Legal notices.