Privacy

Last updated 14 September 2026

Haalkhata keeps a shop's books. That means it holds what you type into it, and nothing else. This page says exactly what.

What we store

• About you: your shop's name, its address and type if you give them, your name, and your phone number. Your password is stored only as a one-way hash — nobody can read it back, including us.
• Your books: the products, sales, customers, amounts owed, expenses, stock, suppliers and cash counts you record.
• To run the service: when sign-in attempts happen and whether they succeed, and which days your shop recorded business.
• In your phone's browser: a sale that could not be sent for lack of internet, until it is sent; a half-filled form; and a copy of the pages you have opened, so the last one seen can show without a connection. The forms and page copies are wiped when you sign out.
• Nothing else. No email address is asked for. No location, no contacts, no photographs, no device identifiers.

What we never do

• We do not sell, rent or share your data with anyone.
• There are no adverts and no advertising trackers today. If that ever changes you will be told before it happens, not after — and your books will still never be sold or shared.
• There is no outside analytics service. Nothing on this site or in the app reports your browsing to a third party.
• We do not read your books to build a profile of you or your customers.

Your customers' details

When you write down a customer's name and what they owe, that is your record of your own trade. It is visible to your shop's login, never shown to another shop, and we never contact your customers. For support, a Haalkhata administrator can open a shop; every visit and every change made is logged.

WhatsApp messages

If your number needs confirming, or you have forgotten your password, we send a six-digit code to your WhatsApp. That message is sent from a WhatsApp account running on our own server, not through a paid messaging service. Like any WhatsApp message, it is delivered by WhatsApp. The code is the only thing sent, and it stops working after a few minutes.

Counting visits to this website

We count, ourselves, how many times each page of this website is opened each day and where visitors came from (Google or Facebook, say). There is no cookie, no other company, and no address or browser detail is kept. To tell one visit from many in a day, a one-time token is made from the address and browser; it is thrown away when the day changes and never written down. If your browser asks not to be tracked, you are not counted.

Cookies

This website sets no cookies at all. The app sets two: one to remember you are signed in, and one to remember which language you chose. The sign-in cookie holds nothing but a random token, and neither is used to follow you anywhere.

Keeping it safe

Everything travels over an encrypted connection. Passwords are hashed. After five wrong passwords in fifteen minutes, sign-in pauses for that number, so somebody cannot simply guess their way in.

Deleting your shop

If you ask for your shop to be deleted, its records go — products, sales, customers, the lot. It is held for thirty days first so a mistake can be undone, and after that it is gone for good. A shop that was never really used (a number typed twice, say) may be deleted at once. Clearing your data in settings keeps the shop but erases its records immediately. The administrators' activity log keeps the shop's name.

Changes

If what the app does changes, this page changes with it, and the date at the top will say when.

Contact

If you have a question about your data, or you want it deleted, call 01720227242. Calling from the number your shop is registered with is the quickest way to be helped.