Privacy Policy

Effective 30 August 2026 · Last updated 9 September 2026

LAKSA helps a shopkeeper track what they sell and decide what to reorder. To do that it needs to know what you stock and how much of it you sell. That is essentially all it collects. It carries no advertising and no analytics or tracking software, and it never asks for payment details.

Who we are

LAKSA is operated by Shubham Tapadar, doing business as Laksa Technology, a business registered in Ontario, Canada. Laksa Technology is a registered business name, not a separate legal entity, so where data-protection law requires it Shubham Tapadar is the data controller (or the equivalent term under your local law) for the information described here, and is personally accountable for it.

What we collect

Information you give us to create an account

Depending on how you sign in, this is your email address, your mobile number, or the name and email address your Google or Facebook account shares with us when you choose that sign-in method. We also store whether you run a thela or a kirana, because it decides which products the app offers you.

If you sign up with an email address and password, we store the password only as a cryptographic hash. Nobody at Laksa Technology can read it.

Information about your shop's trading

Which products you have chosen to stock, including any product you add yourself
The quantity you record as sold, and the date you record it against
Orders you place through the app, and what you actually received
Stock counts you enter when the app asks you to recount something
Figures the app calculates from the above — estimated stock on hand, expected supplier lead time, forecasts and reorder suggestions

Technical information

A push notification token for your device, if you allow notifications. It identifies the device to Google's messaging service so a reminder can reach it. It is not a device fingerprint and we do not use it to identify you anywhere else.
Anything you type into the Report a problem box, and ordinary server logs kept for security and debugging.
If the app crashes, a crash report — the error, where in our code it happened, your phone's model and Android version, how much memory and storage were free, and a short trail of which screens you had opened. It carries none of your sales, your products or your account details. Described in full below.

What we deliberately do not collect. No prices, revenue or profit figures — the app is built to work without them. No information about your customers. No location or GPS data. No contacts, photos, camera or microphone access. No advertising identifiers. No advertising, behavioural analytics or attribution software: no Firebase Analytics, no Meta pixel, nothing that follows what you tap or how long you spend doing it. Meta's app-event logging and advertising-ID collection — which its sign-in library switches on by default — are explicitly turned off, with both permissions removed from the app. We check this against the built app before a release rather than against our own source code, because third-party libraries add things you did not ask for. And no bank, card or payment details: LAKSA never asks for them, and never will through the app.

The one exception is crash reports, added on 9 September 2026 and described in the next paragraph. We would rather name it here than let this list imply otherwise.

Two things are unavoidable and we would rather name them than let the list above imply otherwise. Signing in and receiving notifications require the app to hold identifiers issued by Google — a per-installation ID and a notification token — and Google receives them. If you sign in by SMS, Google also runs an automated check on the device to confirm the request is genuine and not a bot. Neither is used to profile you, and neither is an advertising identifier, but both are real and they leave your device.

When the app crashes, it sends us a report. That report says what went wrong — the error and the point in our code it came from — along with your phone's model, its Android version, how much memory and storage were free, and a short trail of which screens you had opened, such as “sales, added a category, tapped Done”. It does not contain your sales, your products, your email address or your phone number.

We use these only to find and fix the fault. They are handled for us by Google (Firebase Crashlytics), listed in the table above. We added this deliberately: before it, an app that failed on a shopkeeper's phone told us nothing at all unless they wrote to us, and the failures hardest to reproduce are exactly the ones nobody reports.

Why we use it, and what we never do with it

Your trading data does three things. It shows you what is happening in your shop — what sold, how fast, and what is running low. It works out what you are likely to sell, so the app can tell you what to reorder before you run out. And it helps us make those forecasts and recommendations better. Your account details exist so you can sign in and so we can send you a verification code or, if you allow it, a reminder to log the day's sales.

The third one deserves plain words, because it is the one usually buried in vague language. When LAKSA suggests an order and you ignore it, change the quantity, or run out anyway, we use that to make the next suggestion better. Much of that learning stays inside your own account — the app tunes itself to how you actually order. Where we use it to improve LAKSA for everyone, the records are stripped of anything identifying you or your shop first, and what comes out is a pattern, not your shop's history.

We do not sell your data, rent it, or share it with advertisers. We do not show your shop's data to any other user. Products you create yourself and every sale you record are visible only to your own account.

We may publish or share statistics that combine many shops in a way that cannot identify any individual shop or person — for example, that a category tends to sell faster in a given season. Nothing that identifies you or your shop is included.

Who else touches your data

We use a small number of service providers to run the app. They act on our instructions and receive only what their job requires.

Service	What it receives	Why
Render	All app data, stored in its database	Hosts the application and database (United States)
Google Firebase	Your email address or mobile number where it is used to sign you in; Firebase's own account and installation identifiers; your push-notification token; your IP address and basic device and app information, which it collects itself to run the service and keep it secure; for SMS sign-in, an automated device-integrity check confirming the request is genuine; and, if the app crashes, the technical crash report described below	Verifies who you are; delivers notifications; blocks automated abuse; tells us when the app has broken
Meta / Facebook	Only what Facebook Login itself passes, and only if you choose that sign-in method. Meta's library does start up with the app even if you never use Facebook sign-in, but we have turned off its event logging and advertising-ID collection, so it reports nothing to Meta unless you sign in that way	Sign-in option
Resend	Your email address and the verification code	Sends sign-up and password-reset emails
Google (Gemini)	The name, category and unit of a custom product you create — nothing else, and no account details	Generates a picture for a product that has none
Zoho	Any email you send us, and our replies — including a request to see or delete your data	Hosts our contact mailboxes (Canada)
Cloudflare	Product images only. No personal or trading data.	Stores and serves the product pictures

We may also disclose information if the law requires it, or to protect the rights and safety of our users or ourselves.

Where your data is stored

Our servers and database are hosted in the United States, and the providers above operate internationally. If you use LAKSA from India, Canada or anywhere else, your information is transferred to and processed in countries whose data-protection laws may differ from your own. Creating an account means agreeing to this policy, including that transfer. If you would rather your information were not processed outside your own country, do not create an account; if you change your mind later, you can delete your account in the app, or ask us to delete it. We take reasonable steps to see that it stays protected wherever it is held.

How long we keep it

We keep your account and trading history for as long as your account is open, because the forecast is built from your own sales history — a shorter window would make the app worse at its job. Verification codes are deleted shortly after they expire.

You can close your account two different ways, and they are not the same.

Deactivate (Settings → Deactivate account) simply switches the account off. Your sales, orders, inventory and history stay exactly as they are, and signing in again reactivates it. Nothing is deleted.
Delete (Settings → Delete account) erases it. Your account and your shop's trading history — sales, orders, inventory, forecasts and everything derived from them — are removed from our systems. This cannot be undone, and we ask you to type DELETE to confirm because we cannot get it back for you afterwards. The email address or phone number becomes free to use for a new account again.

Crash reports are separate, and deleting your account does not remove them. They are not filed against your account — they identify an installation of the app rather than a person — so there is no way for us to find yours and no way for you to be identified from them. Google deletes them on its own schedule (90 days at the time of writing). We would rather say this plainly than let “delete erases everything” stand when it does not.

Backups are overwritten on their ordinary cycle, and we may keep the minimum needed to meet a legal obligation. If you would rather ask us to erase your data than do it yourself — or no longer have the app installed — write to privacy@laksa.app and we will. Delete your account has the full instructions.

Being specific about this matters, because you cannot meaningfully withdraw consent you were never told you had given. We rely on your consent for exactly two things — and there is a third thing we do that consent is not the honest word for. All three are below:

Running the app for you. Creating an account and recording what you stock and sell, so the app can forecast and suggest reorders. This is the core of the service; without it there is nothing for LAKSA to do.
Push notifications. Separate, optional, and asked for by your device the first time. Declining costs you nothing else.

Crash reports are the third, and they are not separately switchable. If the app breaks on your phone it tells us, and there is no setting to turn that off today. We think that is the right trade for an app this young — a crash nobody reports is a crash nobody fixes — but you should be told it rather than discover it. It carries none of your shop's data, and it stops the moment you stop using the app.

We do not rely on consent for advertising, marketing or profiling, because we do none of those things.

Withdrawing it. Turn notifications off on your device, or in your device settings, at any time — everything else keeps working. To withdraw consent for the rest, delete your account under Settings → Delete account. Deleting your account also deletes the personal and trading data held against it — there is no second step and nothing to ask us for. You can instead ask us to do it, by writing to privacy@laksa.app. Withdrawing consent for the core service means you can no longer use LAKSA, because there is no version of it that works without knowing what you sell. Withdrawal is not retrospective: it does not undo processing that already happened lawfully.

Your rights

You can ask us to:

give you a copy of the personal information we hold about you
correct anything that is wrong
deactivate your account, keeping everything — in the app, under Settings → Deactivate account
erase your account and its data — in the app, under Settings → Delete account, or by writing to us. See How long we keep it above for what each one does
stop sending you notifications — you can also just turn them off on your device
withdraw consent — see Where we rely on your consent above
nominate someone to exercise these rights on your behalf if you die or become unable to act for yourself. Write to us with their name and how to reach them.

Write to privacy@laksa.app from the address or number on your account and we will respond within 30 days. There is no charge.

If you are not satisfied with our answer, you can escalate. In India, raise it first with our Grievance Officer named below, and then, if it is still unresolved, with the Data Protection Board of India. In Canada, you may complain to the Office of the Privacy Commissioner of Canada.

Security

Traffic between the app and our servers is encrypted in transit. Passwords are stored only as hashes. Each account's data is scoped to that account on the server, so one shopkeeper cannot read another's products, sales or orders. No system is perfectly secure, but we take these obligations seriously and fix problems promptly when we find them.

Children

LAKSA is a business tool and is not directed at children. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

If we change how we handle your information we will update this page and change the "last updated" date above. If the change is significant we will tell you in the app or by email before it takes effect.

Grievance Officer

Shubham Tapadar
doing business as Laksa Technology, Ontario, Canada
privacy@laksa.app

Shubham Tapadar is the person responsible for answering questions and grievances about how we handle your information, including for the purposes of India's Digital Personal Data Protection Act, 2023. Grievances are acknowledged and answered within 30 days.

Contact

Shubham Tapadar
doing business as Laksa Technology
Ontario, Canada
privacy@laksa.app