Privacy Policy
Last updated:
TLDR Money is free to use, and we are not paid by advertisers, lenders, insurers or fund houses, so we have no commercial reason to collect more about you than the product needs. This policy explains what we access, what we store, and what you can make us do about it.
1. Who we are
TLDR Money is operated by Sonal Systems Private Limited (“TLDR Money”, “we”, “us”), a company incorporated in India.
Sonal Systems Private LimitedCIN: U62099GJ2026PTC179785
A-3, Mehsana Nagar, Nizampura, Vadodara, Gujarat 390002, India
hello@tldrmoney.in
For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), Sonal Systems Private Limited is the Data Fiduciary for the personal data described here, and you are the Data Principal.
2. The short version
We hold read-only access. TLDR Money can never move money, place a trade, open an account, or send email on your behalf.
Your mail is read on your device, not on ours. Transaction alerts are found, stripped and redacted on your phone. No raw email is sent to or retained on our servers.
We store the parsed records, and only those. Amount, merchant, date and category, encrypted, on infrastructure located in India. You can export them or delete them with your account.
We do not sell or share your data. No ad networks, no third-party data brokers, no anonymised-and-resold arrangement.
You can withdraw consent and delete your data at any time. See sections 7 and 8.
3. What we access, and why
| Data | Why we need it |
|---|---|
| Transaction alert emails in your Gmail — UPI debits, card spends, salary credits and similar bank/issuer notifications | To identify and categorise your transactions automatically, so you don’t have to enter them by hand. Access is read-only. These messages are read and processed on your own device: the alerts are identified there, everything else is discarded, and headers, signatures, boilerplate and identifying details are removed there. We do not receive or retain your email. |
| A redacted snippet of each alert — a short extract, after the removal described above | To read the amount, merchant and date out of it. The snippet is sent over an encrypted connection to a language model running on Amazon Bedrock in the Mumbai region (ap-south-1), which returns a structured record. The models used are open-weight models operated by AWS; the snippets are not used to train any model, are not retained by Bedrock, and are not shared with any model provider. See the security page for detail. |
| The parsed transaction record — amount, merchant, date, category | To show you your spending, net worth and FIRE projection, and to keep your history available between sessions. Stored encrypted on infrastructure in India. |
| Asset values you enter yourself — mutual funds, stocks, gold, property, deposits, EPF | To compute a single net worth figure and your FIRE projection. |
| Account details — your email address and authentication identifiers | To create and secure your account. |
| Basic diagnostic and usage data — crash reports, app version, device type | To find and fix defects. |
| Page performance on this website — the page visited, browser, device type and operating system, network speed, and country | To find and fix slow pages on tldrmoney.in. Measured by Vercel Speed Insights, which records each page load anonymously: it is not tied to your IP address, and it cannot reconstruct a browsing session across pages or identify you. It sets no cookie, and it plays no part in any product feature. |
| Page views on this website — the page visited, the referring page, browser, operating system, device type and country | To see which pages are read and which are ignored. Measured by Cloudflare Web Analytics, which is cookieless: it sets no cookie, does not fingerprint your browser, and does not build a profile or follow you across sites. It runs only on this website and plays no part in any product feature. It never receives your financial data, because none of that data is present on this website. |
Those last two rows are the only measurement running on this website, and both are limited to it. Neither runs inside the product, and neither can see a transaction, an email or an account.
Google account access
TLDR Money requests read-only Gmail access through Google’s standard OAuth consent screen. We request the narrowest scope that lets the product work, we use that access solely to provide the features described in this policy, and we do not use it to build advertising profiles or to train generalised machine-learning models. You can revoke this access at any time from your Google Account permissions page, independently of anything you do inside TLDR Money.
4. What we do not do
- We do not sell your personal data.
- We do not share your personal data with advertisers or data brokers.
- We do not have write access to any of your financial accounts.
- We do not ask for your net-banking credentials, card PIN, or OTPs. Nobody from TLDR Money will ever ask you for these.
- We do not earn commissions, referral fees or distribution fees on any financial product, so we have no incentive to profile you for someone else’s sales funnel.
5. Legal basis and consent
We process your personal data on the basis of the consent you give when you connect your Gmail account and when you create an account, as required by the DPDP Act. Where processing is necessary to meet a legal obligation — tax records, for example — we rely on that obligation instead.
You can withdraw consent at any time, and withdrawing it is designed to be as easy as giving it. See section 8.
6. Who we share data with
We use a small number of service providers to run the product. They act as processors on our instructions, are bound by contract, and may not use your data for their own purposes.
| Provider | What it does | Where |
|---|---|---|
| Amazon Web Services | Runs the service that turns a redacted snippet into a transaction record (Amazon Bedrock), the API and application layer that receives it, encryption key management, operational logs and audit records. | India — Mumbai (ap-south-1) |
| Supabase | The database holding your account, your transaction records and your categories. | India — Mumbai |
| The source of the transaction alerts, under the read-only access you grant. Google is your provider here, not ours; your mail stays in your Google account, and you can revoke our access from your Google Account at any time. | Per your Google account | |
| Vercel | Serves this website, and measures page performance as described in section 3. It plays no part in the product and never receives your financial data. | Website only |
| Cloudflare | Sits in front of this website as its network and security layer, so every request to tldrmoney.in passes through it and it sees the connecting IP address. It also counts page views as described in section 3. It plays no part in the product and never receives your financial data. | Website only — global edge network |
Where your data is processed
Your transaction data and your account data are processed and stored in India. The application layer, the database and the model that reads the redacted snippets all run in the Mumbai region. The two models we use support in-region inference only — cross-region routing, which on some services can send a request to another country when local capacity is tight, is not offered for them in any commercial AWS region, so those requests cannot leave Mumbai.
One thing sits outside that boundary and should not be read as covered by it: this website, which is served globally. There is no payment processing to place inside or outside it, because the product is free and we take no payments.
We may also disclose data where we are legally required to — a binding order from a court or a competent authority, for example. We will not disclose more than the order requires.
7. How long we keep it
We keep your data for as long as your account is active. When you delete your account, we delete the personal data associated with it, except where we are required by law to retain specific records. We issue no invoices and hold no billing records, because the product is free.
8. Your rights
Under the DPDP Act you have the right to:
- Access — obtain a summary of the personal data we hold about you and how it is being processed.
- Correct and complete — have inaccurate or incomplete data corrected or updated.
- Erase — have your personal data deleted, where we are not legally required to keep it.
- Withdraw consent — at any time, with the same ease as giving it. Withdrawing consent does not affect processing already carried out lawfully before withdrawal.
- Nominate — name another individual to exercise these rights on your behalf in the event of your death or incapacity.
- Grievance redressal — raise a complaint with us and receive a response, before escalating to the Data Protection Board of India.
You can disconnect your Google account and export or delete your data from inside the app. To exercise any of these rights directly, email hello@tldrmoney.in.
9. Security
We use industry-standard technical and organisational measures to protect your data, including encryption in transit and at rest, and access controls limiting which of our systems and people can reach what.
The architectural point matters more than any specific control: your mailbox is parsed on your own device, so the most sensitive material in this system — your actual email — never reaches our infrastructure and cannot be breached from it. What does reach us is the parsed record, which is stored encrypted in India. That is a deliberate design decision, not a claim that any system is perfectly secure — no system is.
10. Children
TLDR Money is not directed at children. You must be 18 or older to hold an account. We do not knowingly process the personal data of children.
11. Grievance officer
Grievances about how we handle your personal data can be sent to hello@tldrmoney.in and will be acknowledged and addressed. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
12. Changes to this policy
If we change this policy materially, we will update the date at the top and notify you in the app or by email before the change takes effect.
13. Contact
Questions about this policy: hello@tldrmoney.in, or see our contact page. Our terms of service are at tldrmoney.in/terms.