Bazaar Ledger — Privacy Policy

Effective: 18 October 2026

Bazaar Ledger is a billing, credit book and stock app for shops. It is built so that a shop's books stay on the shop's own phone. This policy says exactly what leaves the phone, when, and why. The technical detail behind every line is in what_leaves_the_phone.md, published with the app's source.

This policy is published at the /privacy page of our server, the address the app talks to, and how to delete your data at its /delete-account page.

The short version

• Your books stay on your phone. Bills, customers, credit books, stock, prices and cheques are stored on your phone, encrypted, and nowhere else unless you send them.
• Our server cannot read them. We run a server so that, if you choose, phones that never share a wi-fi can keep the same books and a lost phone's books can come back. What it is sent is locked on your phone first, with keys we are never given: we keep a copy we cannot open. Nothing goes to it unless you turn it on in the app.
• The AI assistant is yours to turn on. "Ask / Tell" understands simple commands on your phone, with no internet. Only if you turn the AI on, a command your phone cannot understand goes, with the few names in it, through our server to Anthropic's Claude, and the answer fills a screen you check. The same goes for a question about your books, a photo of a supplier's bill or of an old khata page, and the headings of a file you import, each only when you ask for it and each with its credits shown first. In the AI chat, the AI sees what you type there, the names it needs, the figures of answers shown in that chat, what you asked it to remember and, when a question needs them, the figures your phone looks up in your books for it: only those, worked out on your phone, as you are allowed to see them, never the whole book, and never kept (you can turn this off). Our server does not keep your words, your figures or your photos.
• Nothing is sold, shared for advertising, or used to profile you. The app has no ads and no analytics of its own.

What stays on your phone

Everything you enter: your shop's details, items, customers and suppliers, bills, payments, cheques, stock, staff names and their PINs (stored as hashes), photos of items, and settings. The database is encrypted with a key kept in Android's keystore.

What leaves your phone, and only when you choose it

Third-party services

• Meta (WhatsApp Business Platform, Cloud API), only if the owner turns on *WhatsApp automatic* with their own key. The messages you choose to send automatically, and the PDF of a bill or statement, go from your phone to Meta, which delivers them from your own WhatsApp number. Meta's privacy policy applies to them, and Meta bills your account directly. Our server does not take part and never sees them. Off unless you turn it on.
• Google Play Billing, to buy a plan. Payment details go to Google, not to us. Google's privacy policy applies.
• Google Sign-In and Google Drive, only if you turn on Drive backup. The app asks for access to its own app folder (drive.appdata) and nothing else on your Drive, and never for your name or email.
• Google Sign-In for an account, optional. The first time the app opens it offers to create an account or sign in with Google, and to continue without one; you can also sign in later in Settings. No account is needed to use the app. If you sign in, or when you buy a plan (or turn on the cloud), our server receives the sign-in. Google tells us your Google account's id and your email address, and nothing else: not your name, photo, contacts or files. If you never sign in, we never receive an email address from you. Signing out on the phone forgets the account on the phone and never deletes your books.
• Google Play Integrity, only when your phone asks our server for a paid plan's licence: Google tells our server whether this is the app installed from Google Play and whether the phone passes Google's checks. We keep only a daily count of failed checks, with nothing that says whose.
• Anthropic (Claude), only if you turn on the AI assistant, and only for a command or question your phone could not understand by itself, or a photo or file you chose to have read: Anthropic receives the command's words and the few customer, supplier and item names sent with it, to work out which screen to fill; or the photo of a bill or khata page; or the headings and sample rows of an import file; or, in the AI chat, the few figures your phone looked up in your books for a question that needed them. It acts for us as a service provider, under its commercial terms, which do not let it train its models on what it is sent; it keeps it for a limited time for safety and then deletes it. Anthropic's privacy policy applies to its side. Speaking a command uses your phone's own speech recogniser (Google's, on most phones): the app never records sound, and only the text the recogniser hands back reaches it.
• Google ML Kit reads barcodes, and the words printed on a pack when you use "Camera se pehchanein", on the phone (the words model comes through Google Play services). The camera's pictures never leave the phone. ML Kit sends Google anonymous diagnostic data (performance and an installation identifier). This is Google's, not ours, and is described in Google's ML Kit terms.

Our server, if you use it

The cloud is off until you turn it on. When it is on:

• Your books are locked on your phone before they are sent: backups with a key made from your recovery code, sync changes with your shop's own sync key. Neither is ever sent to us, so we cannot read your customers, bills, amounts or anything else in your books, and neither can anyone who gets into our server.
• Only the shop's owner can turn it on or off, see the recovery code, and add or remove phones. Turning it on is a paid plan's (backups: Silver; phones kept in step over the internet: Gold). Bringing your books back is never held to a plan, and a shop that stops paying keeps every backup already there.
• No phone number or name is asked for. Your shop is a random number on our server, and each of your phones proves it is yours with a key made on the phone. If you sign in with Google for a plan or the cloud, we keep your Google account's id and email, linked to your shop's number, so your plan follows you; nothing else about you.
• Your plan. When you buy a plan, we keep which plan, whether it is active, cancelled or refunded, and until when, as Google Play tells us. If you use a reviewer access code, we keep that your account used it, when, and the plan and days it gave, but never the code. It goes with the account when you delete it. Even if your plan ends or is refunded, your books always open, export and restore, and your backups on our server can always be listed and downloaded.
• What we can see: your shop's random number; your phones' public keys and ids, and the day each was last seen; when your phones sync or back up and how much they send; your backups' file names, which are dates; and the IP address each request comes from. We use the address to stop abuse (too many requests from one place), and write it in our log only when we refuse a request. Our log never holds what you sent: each line is the time, the kind of request, its path without anything after a ?, the answer, how long it took and, for a request from one of your phones, the shop's random number. It is a rolling log that is overwritten as new lines arrive.
• We keep your newest seven backups and the sync changes until every one of your phones has them, and then delete them. A copy of our server's data, still locked, is kept off the server for thirty nights in case the server fails.
• Your recovery code is shown on your phone for you to write down, copy, send to your own WhatsApp or print. We keep a key made from it, never the code. It is kept on the phone the cloud was turned on from, so the owner can see it again, and is never in your books or sent anywhere. With it alone a new phone gets your shop back after every phone is lost. If you lose every phone and the code, nobody can open your backups — not you, and not us. We cannot reset it, because we never had it.
• Adding a phone over the internet works like joining a counter on your wi-fi: the owner's phone shows a QR, or an invitation to send and a six-digit code to say on a call. The code is never sent; the two phones make a key between them with it, and only then is the new phone let in. An invitation copied without its code lets nobody in.

Links you send (bills and live account links)

• You choose every link. "Send a link" on a bill, or "Live credit book link" on a customer's account, and only while the cloud is on.
• Each link has its own key, made on your phone. The bill or the account is locked with it before it is sent, and the key is put only in the part of the link after the #, which browsers never send to any server. Our server keeps the locked copy and cannot read it: not the customer's name, not the amounts, not the items.
• What our server sees of a link: a random id, which shop it belongs to, whether it is a bill or an account, its size, when it was made, updated and last opened (and how many times), when it expires, and the IP address of whoever opens it, which is used to stop abuse and logged only when a request is refused.
• Anyone who has the whole link can read that one bill or that one account, just as anyone can read a PDF that is forwarded to them. A live account link keeps showing the customer's account as it changes until you withdraw it.
• You can withdraw a link at any time (on the account, or Settings › Links). It stops opening at once and its locked copy is deleted from our server; a copy someone already downloaded cannot be taken back. Bill links expire after 90 days, account links 30 days after they were last updated.
• The page that opens a link is served by our server and loads nothing from anywhere else.

The owner's dashboard on a PC

• You let each PC in, from your phone. "Naya phone jorein" on the owner's phone, the invitation pasted on the PC and the six-digit code typed there. The PC appears as "PC dashboard" in the phone's device list, and you can remove it there at any time; from then on our server refuses it.
• The PC opens your books itself. It fetches your locked backup and your books' locked changes, and opens them in its browser with the shop's key, which your phone locked for that PC alone. Our server cannot read them.
• It only reads. Our server refuses the PC anything that would change the shop: no change to your books, no backup, no new phone, no link.
• The PC keeps nothing unless you ask it to remember. Then it keeps your books in the browser locked with a passphrase you set on that PC, which is never sent anywhere; without it, closing the tab forgets everything. "Is computer ko bhool jaayein" wipes it.
• The honest limit. The dashboard's page is served by our server. A server changed to serve a dishonest page could read the books a PC opens after that change. The page loads nothing from anywhere else and is in our published source for anybody to check; if that is not enough for you, do not use the dashboard: your phones' sync and backups do not depend on it.

The AI assistant

• Off until you say yes. The first time your phone is not sure about a command, the app asks, in plain words, whether to use the AI. You can turn it off again in Settings › AI assistant. Simple commands are understood on your phone either way, with no internet and no credit.
• What goes, and only for a command your phone could not understand by itself: the words, your app's language, your shop's currency and country, and the names (and an item's unit and price) of the few customers, suppliers and items your phone found for the names in the words. Never your balances, bills, phone numbers or anything else from your books.
• What our server keeps: your Google account (AI credits belong to it), and for each command the time, which kind of screen it filled, how many tokens it used and what that cost, and your credits: monthly plan credits, packs you bought, refunds. Not your words or the names. If you report something the AI wrote, we keep why, which kind of answer it was and Anthropic's reference for it, never the words; the words stay on your phone.
• Questions, photos and files (M115). A question about your books sends the question and the few names in it, never a figure; the answer is worked out on your phone, from your books. "Explain in words" sends the numbers on the screen, with no names. A photo of a supplier's bill or of a page of an old khata is made smaller on your phone, sent through our server to Anthropic to be read, and is not kept by our server. To map a file from another app, only its headings and up to 20 sample rows go (phone numbers cut to four digits); the rest of the file stays on your phone. Each tells you its credits before it is sent: a question 1, explaining 1, a bill photo 3, a khata page 2, mapping a file 1 (the first one on your account is free). Only a file you exported yourself is read; this app never opens another app's own backup.
• Wording, price instructions, profit and help (M116). "Write with AI" asks for a reminder or a greeting once for each group of your customers (how late they are or whether they are new, and the language they read): no name, amount, date or phone number goes, and your phone puts each customer's own in; your offer words never leave your phone. A price instruction sends your words, your category and supplier names and a few matched item names, never a price or a cost. "Why?" explains a change in profit from labelled numbers with no names. "Ask AI" in Help sends your question and the text of the top matching help topics, nothing from your books. Each tells you its credits first (wording 1, a price instruction 1, a profit explanation 2, a help question 1). The phone checks what comes back, and everything the AI writes has a Report button. The automatic WhatsApp never sends AI wording: it sends only templates Meta approved.
• The AI chat (M121). A conversation with the AI, where any of the above can be asked for. What your phone understands by itself is answered on your phone, free. A message the AI reads uses 1 credit (3 when the AI reads our guide to the app, files about the app kept on our server, to answer it; nothing more is sent from your phone) and sends only what you typed, the last few messages as short text (in a long conversation also a short summary of its earlier part, written by the AI from those messages, sent back to your phone and kept there with the conversation; making a new one costs 1 credit, shown with that message), the names it needs (a few customers, suppliers and items your phone matched, help topic titles, and for a price change your category and supplier names), today's dates, and the figures of the latest answer shown in the chat with names hidden as #1, #2, and your preferences and the few notes that match your message from what the AI remembers (see below): the AI sees what you type there, the names it needs, the figures of answers shown in that chat and what you asked it to remember. When you ask about the app's settings, a short list of them goes with that message ("AI memory: on", "Language: English", whether FBR invoicing, the cloud or the app lock is on, the date of your last backup): only a fixed list of switches and choices for what your role may see, never a password, PIN, key, token, recovery code, phone number, email, address, bank, card or account number or tax number. The conversation and its summary are kept on your phone only, never on our server.
• Figures from your books, when a question needs them (M149). When the AI needs figures it was not given (to compare, explain or add up), it asks your phone, at most twice a message. Your phone works the answer out from your own books, under the signed-in person's own permissions (a cashier's phone sends nothing a cashier cannot see), and sends back only that short result (or, for a settings question, the same fixed list of switches and choices as above): never the whole book, never a PIN, password, recovery code, key or token, a bank account number only to its last four digits, a CNIC, NTN or STRN hidden. Our server passes it to Anthropic for that one message and keeps none of it; between the phone's lookups it holds only the message's reserved credits, ids and counts, and gives the credits back if the phone does not return. Such an answer costs 4 credits (what it does not use goes back), and under it one line shows what the AI looked at; a tap shows exactly what was sent. Settings › AI assistant › "Let the AI read figures from my books" turns it off: then nothing from your books is sent, and the AI answers without your figures.
• PDF and Word documents (M144). In the AI chat, Attach lets you send a PDF or a Word (.docx) document of up to 10 pages. Before anything is sent your phone counts the pages and shows the price ("This PDF has 4 pages: 11 credits"), and you choose whether to send it. The document's contents go through our server to Anthropic for that one request, and are never kept on our server: not the file, not its text, not the words you typed beside it, not the answer. Our server keeps the time, the number of pages, the tokens and your credits. What comes back is words or a draft (a price list for Change prices, a supplier's bill or quotation for a purchase, a company's policy for the policy screen) that you check; the AI never saves anything from a document, even under Full access. A failed read gives the credits back.
• What the AI remembers (M135). Short notes that help the AI know you, such as your answer language, your usual payment way or what you call a customer. They are kept on your phone, belong to you alone (another person who uses the app does not see them), travel sealed with your books to your other phones and into your backups, and our server cannot read them. Only your preferences and the few notes that match a message are sent with it, at most 400 characters, and our server does not keep them. When you ask the chat what it remembers (how many notes, to list them), all your notes go with that one message, at most 4,200 characters, so it can answer; our server does not keep them either. In Settings, AI assistant, What the AI remembers, you can see, edit and delete every note or turn memory off, and then nothing is sent or saved.
• The AI only fills a screen. You check the bill, payment, item, party, expense, draft purchase, khata rows or import preview it filled and tap Save yourself. Nothing is saved by the AI.
• Credits. Paid plans include credits each month; packs are bought in Google Play. A failed command gives its credit back. In a long AI chat (M151) the whole conversation goes with each message (kept in Anthropic's short-lived cache, never on our server), so a message costs more by its size: the chat shows the price by Send and asks once for the chat, and charges only what the answer took.

Permissions

• Camera: to scan barcodes, asked for the first time you tap scan.
• Nearby devices / Bluetooth: to print on a paired Bluetooth printer.
• Internet: for a network printer, wi-fi counters, Drive backup, our server when you turn it on, the AI assistant when you turn it on, FBR and Google Play. The app works fully offline without it.
• Microphone: none. Speaking a command opens your phone's own speech recogniser, which needs no permission from this app.
• Photos: through Android's own photo picker, which needs no permission. Only the photo you pick is read.

Children

The app is for shopkeepers running a business and is not directed at children under 13.

Deleting your data

Uninstalling the app deletes everything on the phone. Backups you made or shared, and the Drive app folder, are in places you control: delete them there (Google Drive › Settings › Manage apps › Bazaar Ledger › Delete hidden app data).

Our server, in the app. The owner opens Settings › Cloud and taps "Account aur cloud data mitaa dein". After the owner's PIN (or a typed word), everything we hold for the shop is deleted at once: the account link (your Google account's id and email), the plan record and your AI credits and reports; every phone's key; every sealed backup; the sync changes still waiting on the server; every link; and every PC dashboard let in (its key, and its being read-only). Your books stay on your phone. It needs the internet, and it cannot be undone.

Our server, without the app. If you have lost the phone, or no longer have the app, write to the address below from the email of your Google account, or with the first group of your recovery code (never the whole code), and we will delete the same things within 30 days. The page at /delete-account says how, in English and Roman Urdu.

What we keep after that: nothing about you or your shop, except two things that go on their own. The server's rolling log (a shop's random number and, for refused requests, an IP address; no email, no books) is overwritten as new lines arrive (it holds about 50 MB, which is days to a few weeks of traffic). And the locked copy of our server's data, kept off the server for thirty nights in case it fails, ages out within thirty nights: an account deleted today is gone from every copy by day thirty. If we ever have to restore from a copy, we delete again what you had asked us to delete before we put the server back in use. If you never turned the cloud on, we hold nothing to delete.

Google Play subscriptions are separate. Deleting your account does not cancel a plan you bought through Google Play, and we cannot cancel it for you. Cancel it first in Google Play (Play Store › Payments & subscriptions › Subscriptions), then delete your account. Google Play keeps its own record of the purchase, under Google's policy.

Withdrawing a single link deletes that link's locked copy at once.

Changes

If this policy changes, the new version is published at the same address with a new effective date before the app that needs it is released.

Contact

Questions about privacy and requests to delete your data: bazarledger@gmail.com