Effective Date: 17 April 2026 • Last Updated: 17 April 2026

1. Introduction

Welcome to HenceSorted ("Data Fiduciary," "we," "our," or "us"). HenceSorted is a subscription and bill management application designed to help you ("Data Principal") track, manage, and stay ahead of your recurring subscriptions, bills, and commitments. We are committed to protecting your privacy and being transparent about how we handle your information.

This Privacy Policy explains what information we collect, how we use it, how we store it, and your rights regarding your data. By using HenceSorted, you consent to the practices described in this policy.

HenceSorted is built on a philosophy of manual control and user agency. This philosophy extends to our approach to data: we collect only what is necessary, we do not sell your data, and we give you full control over your information.

This policy is drafted in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA) of India, the General Data Protection Regulation (GDPR) for users in the European Economic Area and United Kingdom, and applicable app store requirements.

2. Information We Collect

2.1 Account Information

When you sign up for HenceSorted, we collect the following:

• First Name and Last Name: Used to personalise your experience, such as displaying greetings within the app.
• Email Address: Used as your primary means of authentication, for sending renewal and bill reminder emails, and for account recovery. Your email is your sole login credential — HenceSorted does not use passwords.

2.2 Subscription and Bill Data You Enter

HenceSorted is a manual-first tool. All subscription and bill data is entered by you. We store the following information that you provide:

• Subscription details: Service name, subscription type (paid or trial), category, billing cycle, renewal date, cost, and currency.
• Bill details: Bill name, category, amount, due date, billing cycle, currency, and payment status.
• Payment method nickname: A user-defined label or tag (e.g., "Main Visa" or "Dad's Card") used solely to help you identify which payment method is associated with a subscription or bill. We do not collect, store, or process any actual payment card numbers, bank account details, CVVs, expiration dates, or any financial account credentials whatsoever. The payment nickname is a free-text label with no connection to any financial institution or payment processor.
• Billing link: An optional URL to the service's billing or account page, entered by you or auto-mapped from our service directory.
• Email used for service: An optional field where you may record which email address you used to sign up for a particular subscription. This is stored as a reference note for your convenience.
• Notes: Free-text internal reference notes (e.g., plan tier, shared access information).
• Custom categories: Any custom categories you create for organising subscriptions and bills.
• Status: Whether a subscription is active, paused, or cancelled, and whether a bill is paid or unpaid, along with the dates of any status changes.

2.3 Device Information

To enforce our device limit policy (maximum 5 devices per account) and to provide account recovery, we collect:

• Device fingerprint: A combination of browser type, operating system, and device type used to identify unique devices.
• Device metadata: Browser name, operating system, device type (desktop, mobile, or tablet), and the timestamp of last activity.

We do not collect hardware serial numbers, IMEI numbers, or other persistent hardware identifiers beyond what is available through standard browser or platform APIs.

2.4 Usage and Analytics Data

We use PostHog (hosted on EU cloud infrastructure) to understand how the app is used. This includes:

• Anonymous usage events: Such as "subscription added," "bill added," "signup completed," and "export triggered."
• Page views: Which pages and views you visit within the app.
• General usage patterns: Aggregated, non-identifying behavioural data that helps us improve the product.

PostHog does not track subscription names, amounts, or personal financial data. We do not use analytics to build advertising profiles, and we do not serve ads within HenceSorted.

2.5 Push Notification Data

If you opt in to push notifications, we store your push subscription endpoint and associated keys to deliver renewal and bill reminders. Depending on your platform:

• Web (PWA): Web Push API subscription with VAPID keys
• iOS (native app): Apple Push Notification service (APNs) device token
• Android (native app): Firebase Cloud Messaging (FCM) registration token

Push notifications are entirely optional and can be toggled on or off at any time from Settings.

2.6 Information We Do NOT Collect

To be absolutely clear, HenceSorted does not collect:

• Credit card numbers, debit card numbers, or any payment card details
• Bank account numbers or banking credentials
• Financial transaction history
• Payment processor tokens or merchant data
• Passwords (we use email-only, passwordless authentication)
• Biometric data
• Location data (GPS or IP-based geolocation)
• Contacts, photos, or other personal files from your device
• Data from any third-party financial service or bank

3. Data-to-Purpose Mapping

The following table itemises each category of personal data we collect, the purpose for which it is processed, the legal basis for processing, and which third-party service (if any) receives it:

4. How We Use Your Information

We use the information we collect for the following purposes:

• Authentication and account management: To verify your identity, manage your account, and enable device-based access control.
• Core app functionality: To store and sync your subscription and bill data across your registered devices, calculate renewal and due dates, and display your information.
• Renewal and bill reminders: To send you email and/or push notification reminders at 7 days, 3 days, and 1 day before a subscription renewal or bill due date.
• Data portability: To enable you to export your data (CSV, Excel) and create full backups (JSON) that you control.
• Product improvement: To understand usage patterns through analytics and improve the product experience.
• Service directory: To maintain and improve our prebuilt service directory based on service suggestions submitted by users.

We do not use your information for:

• Advertising or ad targeting
• Selling to third parties
• Automated financial analysis or spending advice
• Profiling for credit scoring or insurance purposes
• Any purpose beyond what is described in this policy

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data under the following legal bases:

• Performance of a contract: Processing your account data, subscription data, bill data, and email address is necessary to provide the HenceSorted service to you.
• Consent: Push notifications are processed only with your explicit opt-in consent. You may withdraw consent at any time from Settings → Notifications.
• Legitimate interest: Anonymous analytics (PostHog) and device fingerprinting for security are processed under our legitimate interest in improving the product and preventing abuse, balanced against your rights and freedoms.

6. Data Storage and Security

6.1 Where Your Data Is Stored

Your subscription and bill data is stored in the cloud using Upstash Redis (a Redis-based key-value store hosted on AWS infrastructure) via Vercel KV to enable sync across your devices. A local copy is also maintained on your device using browser localStorage (with a cookie-based fallback) and IndexedDB for device identification.

6.2 Security Measures

We implement reasonable and appropriate security measures to protect your data, including:

• Secure HTTPS encryption for all data transmitted between your device and our servers
• Server-side email validation including format checking, disposable email blocking, and MX record verification
• Device-based access control with a maximum of 5 devices per account
• License key-based authentication for all API requests
• Encryption at rest provided by our infrastructure providers

While we take data security seriously, no system is completely immune to risk. We encourage you to use the JSON backup feature regularly to maintain a personal copy of your data.

6.3 Data Retention

We retain your data according to the following schedule:

• Account data (name, email): Retained for as long as your account is active, deleted within 30 days of account deletion request.
• Subscription and bill data: Retained for as long as your account is active. Paused and cancelled items are retained to allow recovery and for your historical records.
• Device information: Retained while the device is registered; automatically removed when you remove the device or delete your account.
• Push notification tokens: Retained while push notifications are enabled; deleted when you opt out or delete your account.
• OTP codes: Auto-expire within minutes of generation.
• Analytics data: Governed by PostHog's retention settings (anonymous, no personal identifiers).

If you request account deletion, we will permanently remove your personal data from our systems within 30 days, except where retention is required by applicable law.

7. Data Sharing and Third Parties

We share your information only in the following limited circumstances:

Service providers: We use the following third-party services to operate HenceSorted:

These providers process data only as necessary to provide their services to us and are bound by their own privacy policies and data processing agreements.

Legal requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.

Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change.

We do not sell, rent, or trade your personal information to any third party for marketing, advertising, or any other commercial purpose.

8. Cross-Border Data Transfers

HenceSorted is operated from India. Our infrastructure providers (Vercel, Upstash, Resend, PostHog) may process data in jurisdictions outside India, including the United States and the European Union.

For users in the EEA/UK, we ensure that cross-border transfers are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) where applicable between us and our service providers
• Selecting service providers who maintain adequate data protection certifications
• PostHog's EU cloud deployment, which keeps analytics data within the EU

For users in India, cross-border transfers are conducted in compliance with Section 16 of the DPDPA and any rules issued thereunder.

9. Cookies and Local Storage

HenceSorted uses browser localStorage as its primary client-side storage mechanism, with cookies as a fallback. These are used to:

• Store your authentication state and license key
• Cache subscription and bill data for offline access and faster loading
• Store your preferences and settings
• Maintain device identification for the device limit feature

PostHog may use cookies for analytics purposes. You can manage cookie preferences through your browser settings. Note that disabling localStorage and cookies may significantly impact the functionality of the app.

10. Your Rights and Choices

10.1 Access and Export

You can access all of your subscription and bill data at any time within the app. You can export your data in CSV, Excel, or JSON format from Settings → Data Management. The JSON backup contains your complete dataset and can be used to restore your data.

10.2 Correction

You can edit any subscription or bill data directly within the app at any time. Your account name and email are set during sign-up; to change these, please contact us at the support email listed below.

10.3 Deletion

You can delete individual subscriptions and bills within the app. To delete your entire account and all associated data, go to Settings → Advanced Actions → "Delete My Account." This permanently removes all your data from our servers, including your account information, all subscriptions, all bills, device registrations, and push notification subscriptions. We will process account deletion within 30 days.

10.4 Consent Withdrawal

You may withdraw your consent for specific processing activities at any time:

• Push notifications: Toggle off from Settings → Notifications
• Analytics: Contact us at hello@hencesorted.com to opt out of analytics tracking
• Entire account: Delete your account from Settings → Advanced Actions

Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

10.5 Push Notifications

You can opt in or out of push notifications at any time from Settings → Notifications. Opting out does not affect email reminders.

10.6 Device Management

You can view and remove registered devices from Settings → Devices. Removing a device revokes that device's access to your account.

10.7 Additional Rights for EEA/UK Users (GDPR)

If you are located in the European Economic Area or United Kingdom, you additionally have the right to:

• Object to processing based on legitimate interest
• Request restriction of processing
• Data portability (receive your data in a structured, machine-readable format — available via JSON export)
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at hello@hencesorted.com.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Data Protection Board of India as required under the DPDPA
• Notify affected users via email without undue delay
• For EEA/UK users, notify the relevant supervisory authority within 72 hours as required under the GDPR
• Provide details of the breach, the likely consequences, and the measures taken to address it

12. Children's Privacy

HenceSorted is not intended for use by individuals under the age of 18. In accordance with the DPDPA, we do not knowingly collect personal data from children (defined as individuals below 18 years of age). If we become aware that we have inadvertently collected data from a child, we will take steps to delete such information promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this document and notify you via email or in-app notification where appropriate.

Continued use of HenceSorted after changes to this policy constitutes acceptance of the updated terms. Where required by law, we will obtain your renewed consent for material changes.

14. Grievance Redressal

In accordance with the DPDPA, if you have any grievances regarding the processing of your personal data, you may contact our Grievance Officer:

Grievance Officer: HenceSorted Support
Email: hello@hencesorted.com
Response time: We will acknowledge your grievance within 48 hours and resolve it within 30 days.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as established under the DPDPA.

For EEA/UK users, you may also lodge a complaint with your local data protection supervisory authority.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Email: hello@hencesorted.com
Grievance Officer: HenceSorted Support (hello@hencesorted.com)
Product: HenceSorted — Ahead of the recurring
Website: https://hencesorted.com