Security & Data Protection
Your family’s jewellery is more than just value — it’s your history, memories and legacy. We use layered security, privacy practices and access controls to help keep your records, photos and documents safe, and always in your control.
Our approach
We combine modern security technology with thoughtful design to keep your jewellery records, photos and documents private, secure and accessible only to the people you trust.
Learn more about our approach
Keep your data privateDesigned with privacy at the core.
You are in controlChoose who can access your records.
Transparent and trustworthyClear practices, no hidden surprises.
Built for familiesSecurity that respects your relationships.
Explore the details of how we keep your data safe, organized by topic.
Managed key-service integration and automatic key rotation are not currently enabled. App locking and amount masking do not encrypt files already downloaded to your device. No app lock can replace a secure device and protected sign-in credentials.
If you believe you found a vulnerability, email legal@gharkasona.com. Include a clear description, affected page or feature, reproducible steps, date and time, browser or device details, and screenshots with private information removed.
Do not access another user's data, modify or delete records, use denial-of-service techniques, upload malware, social-engineer users or staff, publicly disclose unresolved vulnerabilities or demand payment. We do not currently operate a paid bug bounty program.
We follow security best practices and continuously improve our security to keep your family’s most precious records safe for generations to come.
A safer tomorrowNeed to get in touch?
We’re here to help. Reach out to our team for any questions about data protection, privacy or security at Ghar Ka Sona.
Contact our security team legal@gharkasona.comQuick answers to common questions about security and data protection.
Sign-in checks, family permissions, private document access and encryption work together to protect your records. Your six-digit app PIN protects locked sessions and revealing masked amounts. Individual actions do not require an extra PIN.
New private uploads in our encrypted storage flow and selected sensitive fields use AES-256-GCM. These fields include family notes, invoice numbers, purchase comments and extraction results. Connections use HTTPS. Older private files may not have the additional application encryption.
No. Encryption is managed by the server so authorised requests can display records and support features such as bill extraction and exports. We do not claim that the service operator is technically unable to decrypt your information.
Encryption helps protect stolen stored content when the attacker does not also have the necessary keys or permissions. A compromised authorised server can still pose a risk. We investigate suspected incidents, restrict access where necessary and communicate according to the circumstances and applicable obligations.
Only the account owner can access a workspace. Family members are saved as names and details for organising records; they are not separate users and cannot sign in to the workspace.
We use providers for authentication, hosting, private storage, email, payments and requested AI features. Information needed for those features is processed under the applicable provider arrangements. Our Privacy Policy explains the categories of data and processing.
There are no workspace administrators, editors or viewers. Service personnel may need restricted operational access for support or security. A sufficiently privileged operator with the necessary server access and keys could decrypt protected data; this is not a zero-knowledge service.
When you request bill extraction or a Studio preview, the relevant uploaded content is sent to the configured AI provider. Extraction results are drafts that you should check and correct. Manual entry is available according to current plan rules.
Use the available record deletion controls or request account deletion in Profile settings. Account deletion requires confirmation. Copies in retained backups or provider systems may not disappear immediately.
Records and private uploads are held by our configured cloud data and storage providers. Hosting, email, payment and AI providers may process information needed for their services. We do not promise that all processing stays within one country; refer to our Privacy Policy for details.
Only the workspace owner can access workspace records through the app. Providers process data needed to operate requested services, and other disclosures may be required for legal or security purposes as described in the Privacy Policy. We do not publish your private documents as open public files.
Automated tests and browser checks cover selected access, encryption, PIN and session behaviours. Encrypted backups and isolated recovery tests support service recovery. Independent penetration testing remains planned, and internal checks are not a security certification.
Email legal@gharkasona.com with the affected feature and steps to reproduce the issue, removing private information from screenshots. Do not access another person’s records or perform disruptive testing. Our team will assess the report.
Keep your family’s jewellery records safe and organised.