Privacy-by-Design Architecture

Privacy Policy & Data Protection

Effective Date: October 31, 2026 • Compliant with Digital Personal Data Protection (DPDP) Act, 2023

1. 100% In-Browser Local Calculation Execution

At Finminto, your financial numbers belong exclusively to you. Every calculation — including monthly salaries, loan principals, interest rates, tenure selections, and tax deductions — executes purely within your client device's browser memory via local TypeScript modules.

No entered calculation inputs are transmitted to our servers, edge workers, or external analytics systems during normal calculator usage.

2. No Account Creation or Personal Identity Collection

Finminto requires no user registration. We do not ask for, capture, or store:

  • Permanent Account Number (PAN) or Aadhaar numbers
  • Bank account or credit card credentials
  • Mobile phone numbers or WhatsApp contact details
  • Employer names or salary slips

3. Rate Limiting & Cryptographic Salted IP Hashing

To protect our optional scenario sharing and feedback endpoints from distributed denial-of-service (DDoS) and bot abuse, our edge worker processes incoming HTTP requests using a strict privacy safeguard:

Zero Plaintext IP Persistence: Your IP address is never written to databases, logs, or disk in cleartext. Instead, the edge runtime computes a one-way SHA-256 hash combined with a secret, high-entropy server salt (SHA-256(Client_IP + IP_SALT)). This irreversibly anonymized hash is utilized purely for rate-limiting time windows (e.g. limiting scenario saves to 15 per 5 minutes) and cannot be reverse-engineered to identify you.

4. Cookies, Local Storage & Advertising Disclosures

Local Storage: We use your browser's localStorage strictly to remember:

  • UI visual theme preference (light or dark)
  • Language preference (en or hi)
  • Your explicit privacy consent choice (accepted or declined)

Google AdSense & Web Analytics: In accordance with Google AdSense Publisher Policies and the DPDP Act 2023, third-party advertising cookies or privacy-preserving telemetry tags are only loaded if enabled and permitted by your consent preference. Users can accept, decline, or reset their cookie preferences at any time via the consent banner.

5. Voluntary Submissions (Feedback & Scenarios)

If you voluntarily use the "Share Scenario" button, a sanitized JSON payload of your non-PII slider numbers is assigned an unguessable slug (s_...) so you can share the link. If you submit error reports via our Feedback form, any optional email address you provide is used solely to respond to your technical inquiry.

6. Contact & Grievance Redressal

For privacy inquiries, technical audits, or grievance notifications under Indian IT and data protection rules, please contact our administrative team via our Contact page.