Apna Records Privacy Policy
Draft — pending legal review
This privacy policy is a draft. A lawyer has not reviewed it yet, and it is not in force. It describes what the service actually does today.
Text in square brackets, such as [Counsel: …] notes, is still to be completed by the lawyer before publication.
Effective date: [Effective date]
1. Who we are
Apna Records is provided by Amit Kumar (Apna Records), Amrit Dairy, Sonipat, Haryana, India ("we", "us").
- Privacy questions: asheoran007@gmail.com
- Grievance Officer: Amit Kumar, Proprietor, asheoran007@gmail.com, Amrit Dairy, Sonipat, Haryana, India
This policy covers the Apna Records Android app, the website at https://app.apnarecords.amitsheoran.com (account console, account deletion page and shared-file viewer) and the servers behind them.
2. The short version
- Your documents are encrypted on your phone before they are uploaded. We store them but cannot open them.
- We can read your e-mail address and some information about how your account is organised, which we need to run the service. Section 4 lists all of it.
- We do not show ads, sell personal data or use analytics or advertising tools in the app.
- The app reads text from documents on your phone. Google's ML Kit, which does this, sends Google usage and performance data about the text reader, not your documents (section 6).
- You can export your data, delete documents, and delete your account in the app or on the web.
3. What end-to-end encryption means in Apna Records
Your phone creates the keys. Your master passphrase, your recovery kit and your trusted phone protect them. Before anything leaves your phone, the app encrypts:
- your files (photos, scans, PDFs, previews), their file names and their details;
- document titles and notes, and the numbers, names and dates the app reads from your documents;
- the names, photos, signatures and contact details of the people, companies, vehicles and accounts you add;
- workspace and vault names, family relationship details, checklist notes;
- passwords, card details and notes in the secure section;
- your full support messages, the files you share by link, and your share history.
Our servers store this information only in encrypted form. Our staff and our systems do not have the keys to read it.
There is no back door. If you lose your master passphrase, your recovery kit and every trusted phone, we can give you back your account through your e-mail address, but nobody, including us, can open your encrypted records.
End-to-end encryption does not cover the information in section 4.
4. Information we can read, and why
| Information | Why we need it |
|---|---|
| Your e-mail address, chosen language, account status and dates | To sign you in with a code, send security notices and deletion confirmations |
| Sign-in records: sessions (phone or web, times, last activity) and short-lived sign-in codes (stored only as hashes; they expire after 10 minutes) | To keep you signed in and to protect your account |
| Trusted phones: a random device id, the phone's public key and the security level reported by Android (not the phone's model, number or IMEI) | Fingerprint or screen-lock unlock |
| Your IP address, used in memory for each request; stored only as a keyed hash in security records, and with the last part removed in web server logs | Rate limits, abuse prevention, security investigation. We do not use it to find your location |
| Workspace structure: workspace kind, members and their roles, invitations. Owners and admins of a workspace can see the e-mail addresses of its members. Addresses you invite are used to send the invitation and then kept only as a keyed hash | Family and team sharing |
| Information about your documents, not their content: document type and category (for example "passport"), priority, state, file type and size, page count, a quality score, the kind of each value read (for example "expiry date", not the date itself), and dates of changes | Lists and filters, storage limits, keeping the best copy of duplicates |
| Keyed codes (HMAC) made on your phone from document details and from the folders you approve | Finding duplicates and recognising a folder again, without revealing the details or the folder's location |
| If you turn on reminders, after you agree: the document's expiry date, your time zone and when to remind you | Reminders |
| How your records are organised: the kind of each profile (person, company, vehicle…), relationship types between profiles (parent, spouse, sibling), family-tree positions, checklist states, and whether you marked an identity document as uploaded for a profile | Family tree, checklists and showing the right status |
| Share links: which documents, expiry, view limit and views used. The key that opens the file is in the part of the link after "#", which browsers do not send to us | Expiring links |
| Support: the topic and, only if you add one, a short summary you confirm has nothing sensitive in it | Answering support requests |
| Purchases: plan, monthly or yearly, status, dates, Google Play order number and the purchase token (stored encrypted on our server) | Checking purchases with Google Play and giving you the right plan |
| Your consents: what you agreed to, when, and a fingerprint of the exact text you saw | Proving consent and its withdrawal |
| Security and audit records: what kind of action happened, when, and record ids, never content or names | Security, accountability, legal obligations |
| Storage used and counts | Plan limits |
5. Information we do not collect
We do not collect your location, contacts, call logs, SMS, calendar, microphone recordings or advertising id. The app does not read your e-mail. It has no ads and no analytics or crash-reporting tools of our own. We do not sell personal data and we do not build advertising profiles.
6. What happens only on your phone
- Reading text from documents (English and Hindi), suggesting the document type and the person, measuring image quality, and search all run on your phone.
- The document scanner is provided by Google Play services and runs on your phone.
- The list of files already added from a folder you chose is kept on your phone as codes, not names. The optional background check only counts new files and shows a notice without details.
- Reminder notifications are scheduled on your phone. The lock screen shows only "Open the app to see details".
- The app blocks screenshots, locks itself after 15 minutes without use or after a minute in the background, and keeps nothing from your documents in Android backups.
Google ML Kit. The text reader and the scanner use Google's ML Kit. Google states that ML Kit processes the images and text on the phone and does not send them to Google. ML Kit does send Google information such as the phone's manufacturer, model and Android version, the app's name and version, per-installation identifiers, performance measurements, settings, event types and error codes, which Google uses for diagnostics and usage analytics. Google's use is described in Google's Privacy Policy (https://policies.google.com/privacy).
7. Permissions
The app asks only for: internet access; fingerprint or face unlock (shown by Android when you unlock); and, on Android 13 and later, permission to show notifications, which we ask for only when you turn on your first reminder. It does not ask for access to your storage, photos, camera, location or contacts. You choose files with Android's file picker, the share sheet or a folder you approve; the camera and the scanner are Android and Google Play services screens.
8. Why we use information, and on what basis
We use the information in section 4 only to provide Apna Records, keep accounts secure, prevent abuse, handle purchases, answer support requests and meet legal obligations.
[Legal basis under the Digital Personal Data Protection Act, 2023 for each purpose — for example consent for reminders and connected sources, and the uses the Act allows without consent where they apply. To be completed by counsel.]
You can withdraw a consent at any time in the app (More → Privacy and your data). Withdrawing does not affect what was done before. If you withdraw your consent to reminders, we delete the expiry dates we stored for them.
9. Who receives information
- People you choose. When you share through Android's share sheet, the app hands the file to the app you pick. When you create a link, anyone who has the full link can open the file until it expires, is revoked or reaches its view limit. Members of a workspace can open the vaults you give them access to.
- Our service providers, who process data only on our instructions:
- hosting and database: Amazon Web Services (Amazon Lightsail), Mumbai, India;
- encrypted file and backup storage: Amazon Web Services (Amazon S3), Mumbai, India;
- e-mail delivery (sign-in codes, security notices, invitations): Amazon Web Services (Amazon SES), Mumbai, India;
- Google: Google Play (purchases and their verification) and ML Kit (section 6).
- Authorities, when the law requires it. We can only hand over what we can read (section 4).
[Text on business transfers, if wanted — counsel.]
10. Where information is stored
Your information is stored in India (AWS Mumbai region). Encrypted backups and server logs are stored in India (AWS Mumbai region). Some service providers, including Google and our e-mail provider, may process information in other countries.
11. How long we keep information
| Information | How long |
|---|---|
| Documents you move to the recycle bin | 30 days, then deleted for good (unless the vault's owner has placed the document on hold) |
| Export files | 7 days after they are ready |
| Encrypted files you shared by link | Until you revoke the share (then deleted within about a day) or delete the document's workspace. Expired links stop working at once |
| Invitations | Expire after 7 days |
| Sign-in codes | Expire after 10 minutes |
| Sessions | End after 30 days without use, and after 90 days at most |
| Your account and records | Until you delete them; account deletion runs after a 7-day grace period |
| Purchase and subscription records, without your name, e-mail or documents | [Period required by tax and accounting law — the app currently says "up to 8 years"; counsel to confirm] |
| Security and audit records (action, time, ids) | 400 days, then deleted automatically. While a document in a workspace is on legal hold, that workspace's records are kept until the hold is released |
| Used and expired sign-in codes | The e-mail address kept with an unused code is removed within about an hour after the code expires; the code itself is deleted 7 days after it expired |
| Records of ended sessions | Deleted 90 days after the session ended (signed out, revoked or expired) |
| Encrypted database backups | Daily backups up to 36 days; monthly backups up to 366 days |
| Deleted files in storage version history | Up to 30 days |
| Server logs (no document content) | Up to 181 days |
12. Deleting your account
- In the app: More → Privacy and your data → Delete account. Confirm with your fingerprint, face, screen lock or master passphrase.
- On the web, without your phone: https://app.apnarecords.amitsheoran.com/delete-account — sign in with a code sent to your e-mail and confirm.
Deletion starts after a 7-day grace period. During that time your workspaces are read-only, you can still open and export your records, and you can cancel. Then we delete your documents and files, profiles, family tree, checklists, reminders, shared links, secure items, consents, support tickets, exports, keys, trusted phones, sessions and your e-mail address. Workspaces you own are deleted for all their members. In other people's workspaces only your membership and your private data are removed; records you added to a shared vault stay with that workspace.
We keep purchase records and minimal security and audit records without your name, e-mail or documents (section 11), and a record that the deletion happened.
Deleting stops the renewal of Google Play subscriptions for the deleted workspaces. You can also manage subscriptions in Google Play.
Copies in encrypted backups, storage version history and logs disappear on their own schedule (section 11). If we ever restore a backup, we carry out completed deletions again.
Files on your phone, in WhatsApp or in Google Drive are never touched.
13. Your rights
Under the Digital Personal Data Protection Act, 2023 and its Rules you can ask us to:
- tell you what personal data we process about you and with whom we have shared it;
- correct, complete or update it;
- erase it;
- handle a complaint (grievance);
- let a person you nominate exercise your rights if you die or cannot act.
Much of this is self-service: your records and settings are in the app, you can download an encrypted export (More → Privacy and your data → Export your data), and you can delete documents or your account. For anything else, write to asheoran007@gmail.com or the Grievance Officer. We will answer within [number] days.
[Counsel: confirm the response periods in the DPDP Rules 2025 (the Government's announcement mentions a maximum of 90 days), how requests are verified, and how nomination works.]
If you are not satisfied, you can complain to the Data Protection Board of India after using our grievance process.
14. Security
We protect information with end-to-end encryption of your records, HTTPS for all connections, separation of each customer's data in the database, encrypted backups held with keys only our operators have, and logs that never contain document content. No system is perfectly secure. Please keep your master passphrase and recovery kit private and use a screen lock on your phone.
15. If something goes wrong
If a personal data breach affects you, we will tell you and the authorities as the law requires.
[Counsel: confirm the DPDP Rules 2025 breach-notice duties and any CERT-In reporting duties, and which already apply.]
16. Children
Apna Records is not meant for children. You must be 18 or older to create an account. Parents and guardians may keep their children's documents in their own vault.
[Counsel: confirm what the DPDP Act, 2023 (section 9) and the Rules require when a parent stores a child's documents, and whether any age check is needed.]
17. Cookies on our website
Our website uses only these cookies, all needed for the service: __Host-apna_at (your sign-in, up to 10 minutes), __Host-apna_rt (keeps you signed in, up to 30 days) and apna_locale (your language, 1 year). There are no advertising, analytics or tracking cookies.
18. Changes to this policy
We will post changes here with a new effective date, and tell you in the app or by e-mail before important changes take effect.
19. Contact
Amit Kumar (Apna Records), Amrit Dairy, Sonipat, Haryana, India. Privacy: asheoran007@gmail.com. Grievance Officer: Amit Kumar, asheoran007@gmail.com.