Privacy Policy

Last updated: 9 October 2026

On this page:

1. Who we are and what this covers
2. Your business records
3. Information collected automatically
4. Information you send us
5. How we use information
6. Service providers and sharing
7. Permissions
8. Cookies and browser storage
9. Sharing, printing and backups you start
10. How long we keep data
11. Security
12. Your rights and choices
13. Children
14. Changes to this policy
15. Contact and Grievance Officer

1. Who we are and what this covers

SahiBill is published by Auspo Apps (“we”, “us”, “our”). This policy covers:

• the SahiBill Android app (package com.auspo.invoice.maker, earlier called Invoice Maker), from Google Play;
• the SahiBill web app at www.sahibillbook.in/app/, which runs in your browser;
• this website, www.sahibillbook.in (sahibillbook.com and sahibillbook.in lead here).

“The apps” below means the Android app and the web app together. For the purposes of the Digital Personal Data Protection Act, 2023 (India), we are the Data Fiduciary for the personal data described in sections 3 and 4. The business records described in section 2 do not reach us.

2. Your business records

Everything you enter is stored on your device:

• Android app: in a database inside the app's private storage, which other apps on your phone cannot read.
• Web app: in your browser's storage for www.sahibillbook.in, on that computer or phone only. Another browser or device does not see it.

This includes:

• Business profile — business name, address, phone, email, GSTIN, state, bank details and UPI ID that you choose to print, and any logo or signature image.
• Parties — the names, phone numbers, email addresses, GSTINs, addresses, balances and groups of your customers and suppliers.
• Items — product and service names, codes, HSN/SAC codes, prices, tax rates, stock and any item photos.
• Transactions — invoices, bills, orders, estimates, challans, returns, payments, expenses, cheques and account adjustments, with their line items, amounts and any photos you attach.
• Settings — tax rates, numbering, print options, message templates, language, theme and, if you set one, the passcode lock.

These records are not sent to us or to the providers in section 6, and we cannot see, recover or delete them on your behalf. When you share, print, back up or import, your records go where you choose (section 9).

3. Information collected automatically

3.1 By the apps

• Identifiers: an anonymous ID for your install. In the Android app it is a Firebase user ID created on first launch and shown in Settings → About, so you can quote it to us; the app also has a Firebase installation ID, and Google Analytics for Firebase reads the Android advertising ID. In the web app, while “Share anonymous usage data” is on, it is a Firebase user ID created for your browser and shown in More → About; Mixpanel and Google Analytics also keep a random ID in your browser. The apps show no ads.
• App activity: which screens and features you use, and events such as “invoice saved” or “language changed”. With them go counts and dates (how many parties, items and bills you have added, the days you billed, when you last billed), your business's state and type (for example “Retail”), the app language, theme and your device's language, and yes/no flags such as whether your business profile has a GSTIN, logo or UPI ID — never the names, numbers, GSTINs, addresses or amounts themselves.
• Where you came from: the Google Play campaign that led to the Android install, or for the web app the website or campaign link that brought you (for example “google.com”).
• Diagnostics (Android app): crash reports and their logs, with the device model, Android version and app version.
• Notifications (Android app): a Firebase Cloud Messaging token and topics (app language, and whether you use the free days or SahiBill Pro), so we can send messages about the app.
• Plan: whether you have SahiBill Pro, which plan and since when, and how much of the free period is left.

Our analytics providers may work out an approximate location (country or city) from your IP address.

3.2 By this website

The website's own pages (everything outside /app/) run no analytics or advertising code and set no cookies. They load fonts from Google Fonts. Firebase Hosting, which serves the website and the web app, keeps the request logs that every web server keeps (IP address, the page asked for, browser type) to deliver the site and protect it from abuse.

4. Information you send us

If you email us — for help, feedback, a comment after rating the app, or to ask for a passcode recovery code — the Android app opens your email app with a draft that includes the app version, your phone model, Android version and your anonymous user ID; the web app's draft includes the app version, your browser and your anonymous user ID. Nothing is sent until you send it. We then receive your email address and whatever you write.

We do not collect your contacts, SMS, call logs, files, precise location, or payment card, UPI PIN or bank details.

5. How we use information

We process personal data on the basis of your consent — given when you install or open the apps, grant permissions and, in the web app, leave “Share anonymous usage data” on — and for the legitimate uses permitted by law. You can withdraw consent at any time (section 12).

6. Service providers and sharing

We do not sell or rent your personal data. We share it only with service providers who process it for us:

We may also disclose information if required by law, to respond to lawful requests from authorities, or to protect our rights, users or the public. Some providers process data outside India; where they do, it is protected by their contractual and security commitments.

7. Permissions

7.1 Android app

The Android app holds no contacts, storage or photos permission: “Pick from contacts”, and choosing a logo, a photo, a CSV sheet or a backup, all use Android's own pickers, which hand the app only what you select.

7.2 Web app

The web app asks your browser for the camera only when you scan a barcode (the picture is read in the browser and not uploaded), and for notifications only if you turn on payment reminders. Files and photos you open or save go through your browser's own file, camera and share dialogs. “Pick from contacts” (Chrome on Android) uses the browser's contact picker, which hands the web app only the contact you choose. Fingerprint unlock uses your device's own screen lock through the browser: the web app never sees your fingerprint.

You can withdraw any permission in your phone's or browser's settings; only the feature that needs it stops working.

8. Cookies and browser storage

• Website pages: no cookies.
• Web app: keeps your records, settings and a few app notes (such as when you first used it) in your browser's storage, and stores its files so it can work offline. While “Share anonymous usage data” is on (Settings → General), Google Analytics sets its own cookies (named _ga) and Mixpanel keeps its random ID in browser storage, for the analytics in section 3, and Firebase keeps the anonymous sign-in for your user ID. Turning the setting off stops all of these. To fetch remote settings such as the length of the free period, Firebase Remote Config also keeps an installation ID in your browser.

9. Sharing, printing and backups you start

These are the only ways your business records leave your device, and each one is something you do:

• Share a PDF, Excel or CSV file — the app creates the file and opens your device's share sheet. You choose the destination; that app's privacy policy governs what happens next.
• WhatsApp and SMS — the app opens WhatsApp or your messages app with the party's number and a ready message. It is sent only if you send it.
• Print — through your device's print service, or the Bluetooth thermal printer you pick.
• Backup and restore — to a file location you pick. If you choose a cloud folder such as Google Drive, the backup is stored there under that provider's terms. The apps never see your cloud sign-in.
• UPI QR code — printed on bills when you enable it. It holds only your UPI ID, business name and the amount due, and is made on your device.
• Imports — CSV sheets and backup files you pick are read on your device.

Invoices, statements and reports you share contain information about you and about the party they concern. You are responsible for sending them only to people entitled to receive them.

10. How long we keep data

• Your business records stay on your device until you delete them, clear the app's storage or your browser's site data, or uninstall the app. Backups stay where you saved them and must be deleted there.
• Analytics and crash data are kept only as long as needed to improve SahiBill, under the retention settings of the providers in section 6.
• Hosting request logs are kept by Firebase Hosting for a limited period under Google's policies.
• Emails are kept as long as needed to answer you and follow up.

11. Security

The Android app keeps your records in its private storage, and you can add a passcode or fingerprint lock. The website and web app are served only over HTTPS, and data the apps send to the providers in section 6 is encrypted in transit. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information. Protecting your device with a screen lock, and keeping backups somewhere safe, is in your hands.

12. Your rights and choices

Your business records are under your control in the apps: edit or delete any record, clear the app's storage or your browser's site data, or uninstall. For the data in sections 3 and 4, and subject to applicable law, you can:

• ask for a summary of the personal data we hold about you;
• ask us to correct or complete it;
• ask us to delete it — email auspoapps@gmail.com with the user ID from Settings → About in the Android app or More → About in the web app;
• withdraw consent: turn off “Share anonymous usage data” in the web app, turn off notifications, uninstall the app, or write to us;
• nominate another person to exercise these rights on your behalf;
• raise a grievance with our Grievance Officer (section 15) and, if unresolved, with the Data Protection Board of India.

On Android you can reset or delete the advertising ID in Settings → Privacy → Ads (on some phones, Settings → Google → Ads).

13. Children

SahiBill is a business tool meant for adults and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has used SahiBill, contact us and we will delete the data linked to that install.

14. Changes to this policy

We will update this policy when SahiBill changes, for example if a future version adds an account or online backup, and describe the change here before it ships. The new version will carry a new “Last updated” date, and for significant changes we will also tell you in the app.

15. Contact and Grievance Officer

Questions, requests or complaints about privacy:

• Email: auspoapps@gmail.com
• Grievance Officer: Auspo Apps, at the email address above

We aim to acknowledge requests within 72 hours and resolve them within 30 days.

You can also read the Terms of Service.