Privacy Policy

• Account: your email address and, if you sign in with Google, the name on your Google account. Passwords are stored only as a secure hash.
• Your funds: the fund transactions read from your CAS (see below) or that you enter by hand (fund, date, amount and units), and the values we work out from them.
• Plan and payments: whether you are on Premium, and for each payment its reference, amount, status and, if it failed, the reason Razorpay gave. When you press an upgrade button, we note the time and the page it was on, to count how many people look at Premium.
• Testimonials: if you choose to write one, the name, message and optional photo you submit, and your agreement to it being published.
• Technical data: your IP address, used briefly for rate limiting and security.

We process your data on the basis of the consent you give when you create an account, and only to:

• run your account and sign you in (account data);
• show your Journal and Stock Journal (fund and stock data);
• take payments and give you Premium (plan and payment data), and keep the records the law requires;
• show your testimonial on the site, if you submit one and agree to it being published;
• send the emails you ask for or that concern your account (such as payment receipts);
• keep the service secure and stop abuse (technical data).

We don't use your data for advertising or profiling, and we don't make automated decisions about you.

Your mutual fund CAS PDF is parsed locally in your browser and is never uploaded to or stored on our servers. Its password never leaves your device either.

From it, only your fund transactions are sent to us: for each fund, its name and ISIN, and the date, amount, units and NAV of every purchase and redemption. We store these to show your Journal and work out its figures. Your name, PAN, address, folio numbers and bank details are not sent. You can remove any fund from your Journal at any time.

For the Stock Journal we store what you add: each stock's NSE symbol, its type (delivery, intraday or F&O), quantity, buy and sell prices and dates. A Zerodha CSV is read in your browser and only those fields are sent; the file itself isn't uploaded. You can delete any entry at any time.

Payments are processed by Razorpay. We never see or store your card, UPI or bank details — Razorpay handles them under its own privacy policy. We keep only the payment reference, amount, status and, if a payment fails, the reason Razorpay gives.

We do not sell, rent or share your personal data with third parties, advertisers or brokers. We don't run ad scripts. We use Vercel Web Analytics to count page visits; it uses no cookies and doesn't identify you.

Data is processed only by the providers needed to run the service, and only on our instructions: Supabase (login, database and file storage), Google (if you sign in with Google), Razorpay (payments), Resend (sending emails), Upstash (caching your plan status) and Vercel (hosting). Fund NAVs come from AMFI's public daily file, and stock prices from NSE's public end-of-day file, both downloaded by our server; nothing about you is sent to get them.

These providers run on cloud servers that may be located outside India, including in the United States and Europe, so your data may be stored and processed there. Each provider is bound by its own security and data-protection commitments, and data is encrypted in transit (HTTPS). We transfer data outside India only to the extent the DPDP Act, 2023 and any Government of India restrictions under it allow.

We use only essential cookies and browser storage: to keep you signed in, and to remember your funds' values from your last visit so we can show how they've changed (this stays in your browser). There are no advertising or analytics cookies — our page-visit counting (Vercel Web Analytics) is cookieless. Clearing your browser's site data removes them.

We keep your data while your account is open. You can delete your account at any time from your dashboard (Delete my account): your account, Journal funds and stocks, any earlier upload records, upgrade clicks and testimonial (with its photo) are deleted straight away, and any Premium subscription stops.

• Payment records (reference, amount, status, date) are kept for 8 years without your account attached, as Indian law requires. Razorpay keeps its own records under its policy.
• IP addresses used for rate limiting are kept for at most one hour.
• Server and email-delivery logs kept by our hosting and email providers are deleted automatically, usually within 30 days.
• Backups made by our database provider are overwritten within 30 days, so deleted data leaves them by then.

Under the Digital Personal Data Protection Act, 2023 you can:

• ask what personal data we hold about you and how we use it;
• ask us to correct, complete, update or erase it;
• withdraw your consent at any time (we'll then stop processing and delete your data, except records the law requires us to keep);
• nominate another person to exercise these rights if you die or become unable to;
• raise a grievance with our Grievance Officer (below), and if you're not satisfied with our response, complain to the Data Protection Board of India.

Email us from your account's email address and we'll respond within 30 days.

Arthtome is only for people aged 18 or older. We don't knowingly collect data from anyone under 18; if we learn we have, we delete it.

Email: support@arthtome.in

Grievance Officer: Hemant Koli (Grievance Officer), hello@arthtome.in. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. See also our Terms.