Security And Data Safety

• Protected app areas use Supabase server sessions to identify the signed-in user before production records are shown.
• Production records are scoped to a family record workspace. Server-side queries and document actions check the active workspace before returning purchases, assets, family members, storage locations, documents, analytics, and exports.
• Workspace roles limit sensitive actions. Owners and admins can manage members; export actions check export permission.
• Uploaded bills and jewellery photos are saved through private storage. Document previews and downloads use temporary signed links after the app confirms the user can access the same workspace.
• Bill uploads are checked for file type, file size, file name, and duplicate SHA-256 hash. Jewellery photo uploads are checked for file type, file size, file name, and duplicate hash.
• AI bill extraction runs on the server when configured. The browser does not receive the OpenAI API key.

• Activity history exists for selected workspace events, such as member changes, invitations, and some record actions. It is not a complete audit log of every view, edit, or download.
• Document deletion removes database records and attempts to remove the stored file. If storage deletion fails, the app reports that limitation to the user.
• Workspace deletion marks a family record as deleted in the app. It is not a guaranteed immediate purge from all systems or backups.
• The app has a custom redacting logger for selected server errors, but not every server log path uses that logger yet.

• Ghar Ka Sona does not currently provide self-service full account deletion for the signed-in user.
• Ghar Ka Sona does not currently provide end-to-end encryption, zero-knowledge encryption, or user-managed encryption keys.
• Ghar Ka Sona does not currently provide a complete machine- readable export of every record, file, and account setting. Available exports are limited to the current in-app export features.
• Ghar Ka Sona does not currently include a public bug bounty program or formal security certification.

• Use a strong password and keep access to your email account secure, because email is used for confirmation and password recovery.
• Invite only people who should access your family record, and remove members when access is no longer needed.
• Upload only documents, photos, and personal information that you are allowed to store and share in Ghar Ka Sona.
• Review AI-assisted draft records before relying on them. AI can misread bills, weights, dates, names, or amounts.

No online service can guarantee absolute security. Ghar Ka Sona is designed to reduce risk through server-side checks, workspace access control, private storage, and temporary document links, but these controls do not remove every risk.

Ghar Ka Sona is a record-keeping service. It does not physically protect jewellery, replace safes or lockers, verify ownership, or provide legal, insurance, appraisal, tax, investment, or valuation advice.

If you believe you found a security issue, email support@gharkasona.com. Include a clear description, affected account or workspace if relevant, steps to reproduce, and screenshots or logs if they are safe to share. Do not access another user's records or download data that is not yours.