Privacy policy

The short version. Lipi is a personal finance app. We collect what you put into it and the minimum needed to run it safely. We don’t show ads, we don’t sell or share your personal data, and we don’t ask for your bank login. You can get a copy of your data or have it deleted at any time.

Who we are

Lipi is operated by Lipi Technology (“Lipi”, “we”, “us”). We are the data controller (called a “data fiduciary” under India’s DPDP Act) for the personal data described here.

• Legal name: Lipi Technology
• Company registration number: 610048917 (Nepal)
• Registered address: Balkumari-9, Lalitpur, Nepal
• Official email: info@lipi.com.np
• General support: support@lipi.com.np
• Privacy questions, requests and complaints (our grievance officer inbox): privacy@lipi.com.np

We have not yet appointed a representative in the European Union or the United Kingdom. We will name one here if our use in those regions requires it. Until then, people in the EU and UK can reach us directly at the privacy address above, and we will answer in the same way.

This policy covers the Lipi app at app.lipi.com.np, the website at lipi.com.np, and the Lipi API that both use.

What we collect

Information you give us

• Account details: your name, email address and password. We never store your password itself, only a one-way hash of it.
• Birth month and year: asked when you create an account, or once after you sign in if your account is older, to confirm you are 13 or older. Never the day. See Minimum age.
• Google sign-in: if you sign in with Google, Google tells us your name, email address and Google account identifier. We do not get your Google password or access to anything else in your Google account.
• Your financial records: everything you enter into Lipi, including accounts and balances, transactions, categories, tags, notes, budgets, recurring and scheduled items, loans, assets, splits and shared ledgers, and invoices with the client details, sender details and payment details you add to them.
• Attachments: receipts, bill photos you scan, and other files you upload.
• Preferences: language, theme, currency, date format, notification settings and similar choices.
• Messages to us: anything you send to support or the privacy inbox. A report you send by shaking your phone also carries the page you were on, the app version, your browser and device, your language and any recent error messages, so we can find the problem.

When you add details about other people, such as a client’s name and email on an invoice, or the name and email of someone you add to a split or invite to an account or ledger, you are responsible for having a right to share them with us. We only use them to provide the feature you are using.

Information collected automatically

• Session and device information: for each signed-in session we record a device name, your browser’s user agent, IP address and when the session was last used, so you can see and sign out of your sessions. We also keep a list of the devices that have signed in to your account (IP address, browser, a scrambled fingerprint of the two, and when each was first and last seen), so we can email you when your account is signed in from a new device.
• Account activity: when you sign in, which days you used Lipi, and a log of changes made in your account, such as creating or editing a record. This lets us support you, investigate problems and keep an audit trail.
• Server logs: IP address, time, requested address, response status and similar technical details. We use them for security, abuse prevention (for example, limiting repeated sign-in attempts) and fixing errors.
• Push notifications: if you turn them on, the push address your browser gives us and your browser’s name, so we can send you reminders and alerts.
• Usage analytics, only if you accept analytics cookies: if you press Accept on the cookie banner, the app and the website use Google Analytics to count how people use them. It records pages viewed and actions taken, such as “added a transaction”, “created a budget” or “finished reading an article”, with short labels like the transaction type or the page you came from, plus your browser, device type, approximate location (country or city, worked out from your IP address) and the site that sent you. In the app, when you are signed in, it also records a scrambled user ID so visits from your phone and laptop count as one person, and whether you are on Free, a trial or Premium, your language, and whether you are signed in. The scrambled ID is made from your Lipi account number with a one-way function: it is not your email or name, and Google cannot turn it back into your account. Analytics never receives your amounts, notes, account or category names, payees, email address, name or anything else you type. Until you press Accept, Google Analytics is not loaded at all: nothing is sent to Google and no analytics cookies are set. It also never runs when the app or website is opened on a local or test address, or by an automated browser.

What we don’t collect

We do not ask for or collect your bank or wallet login details. We do not collect your precise location, contacts, advertising identifiers or browsing activity on other sites. We do not use advertising cookies, and we do not use analytics for advertising. The only tracking cookies are the Google Analytics ones, and they are set only if you accept them (see Storage on your device).

How we use your information

We use personal data only for the purposes below. For people in the EU and UK, the table also gives our legal basis under the GDPR.

Purpose	Data used	Legal basis (GDPR)
Create your account and sign you in	Account details, Google sign-in data, session information	Performing our contract with you
Store, sync and show your records, and run features such as budgets, reports and reminders	Financial records, attachments, preferences	Performing our contract with you
Send service emails, such as email verification, password reset and important notices	Name, email address	Performing our contract with you
Keep Lipi secure, prevent abuse and fraud, and enforce our terms	Session and device information, activity log, server logs	Our legitimate interest in protecting users and the service
Check you meet the minimum age of 13	Birth month and year	Legal obligation, and our legitimate interest in keeping children under 13 off a financial service
Diagnose problems and improve reliability	Server logs, activity log	Our legitimate interest in running a working service
Count which pages and features are used, so we know what to fix and improve	Usage analytics	Your consent, given by pressing Accept on the cookie banner, which you can withdraw at any time in Cookie settings
Answer your support and privacy requests	Messages, account details	Performing our contract, or our legal obligations
Manage Premium and record payments	Account details, plan and payment records	Performing our contract; legal obligations for accounting
Comply with the law and respond to lawful requests	Any data, as strictly required	Legal obligation
Optional features you choose to use, such as receipt scanning	The data that feature needs	Your consent, which you can withdraw at any time

We do not use your data for advertising, we do not build marketing profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

The website at lipi.com.np

The marketing website shows the same cookie banner as the app, and your answer applies to both. If you press Accept, it uses Google Analytics in the same way as the app (see Usage analytics), without any user ID, because you do not sign in there. If you press Reject, or do not answer, Google Analytics is not loaded. Besides that choice and the analytics cookies, the website stores two things in your browser: your light or dark theme choice, if you pick one, and when you last opened each article, so a page view is counted once every 30 minutes rather than on every reload. The view count itself is a single number per article and holds nothing about you. Video guides, on the website and in the app, play from YouTube (in its privacy-enhanced mode) or Vimeo. Nothing loads from them until you press play; after that, YouTube or Vimeo receives your IP address and browser details under its own privacy policy. Our hosting provider processes your IP address and request details to deliver the pages and protect them from attacks. We may also use Cloudflare’s privacy-friendly Web Analytics to count page views; it sets no cookies and does not follow you across other sites.

Storage on your device

The Lipi app stores a few things in your browser so it can work:

• Sign-in tokens in local storage, so you stay signed in.
• A copy of your data in the browser’s database (IndexedDB), so the app is fast and can work offline. Bill photos and support reports waiting for a connection are kept there too. It is wiped when a different person signs in on the same device.
• Preferences and app settings such as theme, language, dashboard layout, which tips you have already seen, and an ID for this device that keeps offline changes in order.
• App lock, if you turn it on: your PIN as a salted one-way hash, and for fingerprint or face unlock, a passkey your device keeps. Your fingerprint or face never leaves your device.
• Your cookie choice: a cookie called lipi_consent that records whether you pressed Accept or Reject on the cookie banner. It is set on lipi.com.np and its subdomains, so one answer covers both the website and the app, and it expires after 12 months, when we ask again.
• Google Analytics cookies (_ga and _ga_ followed by a code), only if you press Accept. They let Google Analytics tell a returning browser from a new one. They are first-party cookies set on Lipi’s own address, and they expire after up to two years.

The sign-in tokens, the copy of your data, your preferences, the app lock and the cookie-choice cookie are strictly necessary for the service you asked for, so they need no consent. The Google Analytics cookies are not, so they wait for yours. You can change your answer at any time: in the app, go to Settings → Privacy → Cookie settings; on the website, use Cookie settings at the bottom of any page. Choosing Reject there turns Google Analytics off and deletes its cookies straight away. Lipi works the same either way. Signing out removes your sign-in tokens. Clearing your browser’s site data removes everything.

Who we share it with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined in California law. We share personal data only with the following:

Service providers (processors) that run parts of Lipi for us, under contracts that allow them to use the data only to provide their service to us:

Provider	What they do	Data involved
Cloud hosting provider	Runs the Lipi API, database and search	All account data and records
Cloudflare, Inc.	Hosts the app and website, stores attachments and backups (R2), protects against attacks, and reads the bill photos you scan (Workers AI)	IP addresses, request data, attachments, backups; for a scan, the photo, the text read from it and the names of your categories and accounts
Google LLC	Google sign-in. The app loads Google’s sign-in script when it opens, so Google receives your IP address and browser details; on the sign-in and sign-up pages Google may offer its own account chooser. Your name and email reach us only if you pick a Google account	Sign-in request, IP address, browser details; name, email and account identifier if you sign in with Google
Google LLC	Google Analytics, only if you accept analytics cookies: counts visits and feature use on the app and website	Usage analytics, IP address, browser and device details, analytics cookies, scrambled user ID
Email delivery provider	Sends service emails	Name, email address, email content
Better Stack, Inc.	Server logs and uptime monitoring	Server logs, which may include IP addresses and account identifiers
Anthropic, PBC	Reads a photo of a document into figures, only when an AI assistant you connected asks Lipi to (see AI assistants you connect)	The image the assistant sends

People you choose to share with. When you share an account, add people to a split or share a ledger, they see what that feature shows them, such as the shared account’s transactions, the split’s expenses and who owes what, or the ledger’s entries. A ledger’s public link shows that ledger to anyone who has the link, until you turn the link off.

Push services. If you turn on push notifications, they are delivered through your browser maker’s push service (for example Google, Apple, Mozilla or Microsoft). The message is encrypted, so the push service passes it on without being able to read it.

Our staff. A small number of authorised people can open account records when it is needed to give you support you asked for, to investigate abuse or security incidents, or to meet a legal obligation. Access is limited to what the task needs, and administrative actions are recorded in an audit log.

Legal and safety reasons. We may disclose data if the law requires it, to respond to a valid legal request, or to protect the rights, safety or property of our users, the public or Lipi. Where the law allows, we will tell you first.

Business changes. If Lipi is merged, acquired or sells its assets, your data may transfer to the new owner, who must keep honouring this policy. We will tell you before that happens.

With your permission. In any other case, only if you ask us to.

International transfers

Lipi is operated from Nepal. Our servers and service providers may be located outside Nepal, including in the United States and the European Union, and Cloudflare serves content from locations around the world. Using Lipi therefore means your data is transferred outside Nepal and outside the country you live in.

Where the GDPR or UK GDPR applies, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum), or on the EU–US Data Privacy Framework where a provider is certified under it. For people in India, we transfer data only to countries the Indian government has not restricted. You can ask us for more detail about these safeguards.

How long we keep it

Data	How long
Your account and records	While your account is open
Your birth month and year	While your account exists, deleted with it. Not kept at all when an under-13 sign-up is refused
Records you delete	Removed from your account at once, and permanently purged about 90 days later
Everything, after you delete your account	Erased about 30 days later
Backups	Stored in Cloudflare R2, encrypted at rest. Kept for a limited period and then deleted on a rolling basis, so deleted data also leaves the backups after that period
Server logs	A limited period, then deleted
Usage analytics held by Google Analytics (only if you accepted)	For the retention period set in Google Analytics, then deleted by Google
Your cookie-banner choice, in your browser	12 months, then we ask again
The days you used Lipi	400 days
Account activity log	As long as we need it for support and security, then deleted or archived; entries about you are erased when your account is erased
Records of actions our staff took on your account	Kept for accountability, with your personal details removed after your account is erased
Payment and accounting records	As long as tax and accounting law requires

How we protect it

• All traffic to Lipi is encrypted with HTTPS.
• Passwords are stored only as one-way hashes.
• Each person’s data is separated. Every request is checked against the signed-in account, so no one can see another person’s records.
• Staff access is restricted and administrative actions are logged.
• Backups are encrypted at rest.

No system is perfectly secure. If a personal data breach puts your rights at risk, we will notify the relevant authorities within 72 hours of becoming aware of it where the law requires, and tell affected users without undue delay, including what happened and what you can do.

Your rights

Wherever you live, you can ask us to:

• Access the personal data we hold about you and get a copy.
• Export your data in a portable format (JSON and CSV). On Premium you can download it yourself in Settings; on any plan, you can ask us for a copy.
• Correct data that is wrong or incomplete. You can edit most of it yourself in the app.
• Delete your account and personal data.
• Object to or ask us to restrict certain uses.
• Withdraw consent for anything that relies on it, such as analytics cookies (in Cookie settings) or receipt scanning, without affecting what happened before.

To use any of these rights, email privacy@lipi.com.np from the address on your account. We may ask you to confirm your identity. We will reply within 30 days, and tell you if we need longer where the law allows it. Using your rights is free, and we will not treat you differently for using them.

European Union and United Kingdom

You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and UK GDPR. You can object at any time to processing based on our legitimate interests. You also have the right to complain to the data protection authority where you live or work. In the UK, that is the Information Commissioner’s Office.

California

Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We use sensitive personal information, such as your account password and the financial records you enter, only to provide the service, so the right to limit its use does not change anything. You can use an authorised agent to make a request for you. We will not discriminate against you for exercising these rights.

In the last 12 months we have collected these categories of personal information, for the purposes and from the sources described above: identifiers (name, email, IP address, account identifiers); age (birth month and year); financial information you enter; internet or network activity (session and log data, and usage analytics); and account login credentials. We have disclosed them only to the service providers listed above, for business purposes.

India

Under the Digital Personal Data Protection Act, 2023, you have the right to access information about your personal data, to correct, complete, update and erase it, to grievance redressal, and to nominate someone to exercise your rights if you die or become incapacitated. Send grievances to privacy@lipi.com.np. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Nepal

Under the Individual Privacy Act, 2075 (2018), your personal information is collected with your consent, used only for the purpose it was collected for, and kept confidential. You can ask us to correct or remove it by writing to the privacy address above.

Minimum age

You need to be 13 or older to use Lipi. To confirm this, we ask for your birth month and year when you create an account, or once after you sign in if your account is older than this rule. We never ask for the day you were born.

We use your birth month and year only to check the minimum age. We do not show them to anyone, including on your profile, and our staff see only an age range (13 to 17, or 18 and over). We keep them for as long as your account exists and delete them with it. To correct them, contact support.

If someone under 13 tries to sign up, we do not create the account and do not keep the birth date they entered. If an existing account holder tells us they are under 13, we sign the account out and block sign-in; we do not delete its data automatically, and our team reviews the account. If you believe a child under 13 is using Lipi, contact us.

Receipt scanning

Scanning a bill is optional, and the app explains how it works before your first scan. When you scan a bill:

• The photo is uploaded to our servers and stored with your attachments. If you save the transaction, it stays attached as the receipt.
• Our own software reads the text on it. We then send the photo, that text and the names of your categories and accounts to Cloudflare Workers AI, which picks the merchant, amount, date, category and account from the options we give it. Cloudflare does this for us as a service provider.
• If Cloudflare is unavailable, a model running on our own server picks from the text instead, and nothing leaves our servers.
• The result only fills in the form. Nothing is saved until you check it and press Save.

AI assistants you connect

You can connect an AI assistant, such as ChatGPT or Claude, to your Lipi account from Settings → AI assistants. Nothing is connected unless you do it.

• What it can see and do. You choose when you connect. Read only (the default) lets the assistant look at your accounts, transactions, budgets, loans, assets and reports. Full access also lets it add and change records, with the same checks and plan limits as the app. It can never see your password, change your sign-in details, or delete your account.
• What goes to the assistant’s provider. When you ask the assistant something, the records it needs to answer are sent to that assistant’s provider (for example OpenAI or Anthropic). What happens to them there is covered by your agreement with that provider and its privacy policy, not this one.
• Reading document photos. If the assistant cannot read an image itself, it can ask Lipi to read a photo of a document, such as a loan schedule or a statement. That image is sent to Anthropic, which returns the figures. Reading a photo saves nothing by itself.
• What we keep. For each connection we keep its name, the access you chose, when it was last used, and the IP address and app it last connected from. We log each request it makes (which action, a shortened copy of the details, and whether it worked) so you can see it in Settings → AI assistants. That log is deleted after 30 days.
• Turning it off. Disconnect at any time from Settings → AI assistants. The assistant’s access stops at once, and it can’t reconnect without asking you again.

Changes to this policy

If we make a material change, we will tell you by email and in the app at least 30 days before it takes effect. For smaller changes, we will update the date at the top of this page. Earlier versions are available on request.

Contact

Lipi Technology, Balkumari-9, Lalitpur, Nepal (company registration no. 610048917) Official email: info@lipi.com.np Privacy and grievances: privacy@lipi.com.np Support: support@lipi.com.np