Privacy Policy

01What ZarKul is

ZarKul is a personal and household finance application. You use it to record transactions, track accounts, manage budgets, and prepare financial summaries including your annual income tax working. ZarKul is currently in private beta — available by invitation only.

ZarKul is operated by Haroon Naseer, Lahore, Pakistan. You can reach us at support@zarkul.com.

02What data we collect

Data you enter directly:

• Your name, email address, and password (used to create your account)
• Financial transactions — amounts, dates, descriptions, account names
• Account details — bank accounts, investments, assets, liabilities
• Household member names and email addresses (if you invite family members)
• SMS text you paste into the SMS parser for transaction entry

Data collected automatically:

• Your login activity (timestamp, device type) — used only for security
• Error logs — used only to fix bugs. These do not include your financial data.

What we do not collect:

• Your bank login credentials — ZarKul never asks for these
• Your CNIC, NTN, or any government identity number beyond what you voluntarily enter in your profile for tax report generation
• Location data
• Advertising identifiers

03How we store your data

Your data is stored in a PostgreSQL database hosted on Supabase, running on Amazon Web Services in the Singapore region (ap-southeast-1). Supabase is an enterprise-grade platform used by thousands of production applications worldwide.

• Encryption: All data is encrypted in transit (TLS) and at rest (AES-256).
• Access controls: ZarKul uses row-level security — a database-level permission system that means each user can only ever read their own data. This is enforced at the database itself, not just the application layer. Even within the same household, each member sees only what their assigned role permits.
• Who at ZarKul can see your data: The database administrator (currently the founder) has technical access for maintenance, backup, and support purposes. This access is used only when necessary to keep the service running. We do not browse your financial records.

04SMS text you paste into the parser

When you paste an SMS bank alert into ZarKul's SMS parser, that text is sent to Anthropic's Claude API for processing. Anthropic extracts the transaction details (amount, date, account) and returns them to ZarKul. The SMS text is not stored by ZarKul after parsing is complete.

Anthropic's data handling is governed by their own privacy policy at anthropic.com. ZarKul uses Anthropic's API under a commercial agreement that prohibits Anthropic from using your data to train their models.

05Who we share your data with

We share your data with no one, with the following narrow exceptions:

We do not sell, rent, or share your data with advertisers, data brokers, government agencies (unless compelled by law), or any third party beyond the four infrastructure providers above.

06Household members

If you invite family members to your ZarKul household, they can see the financial data their role permits — as you configured it. You control their access level. You can remove a household member at any time, which immediately revokes their access.

Household members' own personal accounts (their ZarKul login) belong to them. Removing them from your household does not delete their ZarKul account.

07Backups and data retention

ZarKul takes regular backups of the database. Backups are stored securely and off-server. We have tested our restore process — in the event of a database failure, we can restore your data with minimal loss.

Your data is retained for as long as your account is active. If you delete your account, your data is deleted within 30 days. You can request deletion at any time by emailing support@zarkul.com.

08Your rights

You have the right to:

• Access a copy of all your data — email us and we will provide it
• Export your data — ZarKul provides data export from within the app (coming soon — available before public launch)
• Correct any data — you can edit transactions and account details directly in the app
• Delete your account and all associated data — email support@zarkul.com

09If ZarKul shuts down

In the event ZarKul ceases to operate:

• You will be given at least 60 days' advance notice by email
• A full data export will be made available to every user before the service closes
• Your data will not be sold to any third party as part of any wind-down

10Cookies and tracking

ZarKul uses session cookies strictly necessary for login. We use no advertising cookies, no cross-site tracking, and no analytics services that share your data with third parties.

11Security

We take the following measures to protect your data:

• Row-level security enforced at the database layer
• All connections encrypted with TLS
• Regular security testing including adversarial access tests
• No financial data in logs or error reports
• Invite-only access during beta — no open public registration

If you discover a security vulnerability, please report it responsibly to support@zarkul.com. We will respond within 48 hours.

12Changes to this policy

If we make material changes to this policy, we will notify you by email before the changes take effect. The updated policy will always be available at zarkul.com/privacy.

13Contact

ZarKul
Lahore, Pakistan
support@zarkul.com