Privacy & Security Charter

Privacy Policy

Last Updated: September 2026 • Miraha Professional Services

Miraha Professional Services operates the Mirahaman application and the mirahaman.online platform. We are committed to absolute data privacy and transparency. This policy details our data handling standards, encryption practices, and security measures.

1. Zero Third-Party Advertising Trackers

We do NOT track your physical GPS location, access your contact lists, or sell personal behavior to third-party ad brokers. Mirahaman is built offline-first: your daily life and money records are your private property.

2. Data Handled by the Application

Authentication & Security: Your registered email, display name, mobile phone number, salted cryptographic password hash, and 4-digit security PIN hash.
Tasks & Daily Schedule: Task titles, categories, priority rankings, alarm intervals, and sub-task checklists stored locally in SQLite with secure cloud backup.
Personal Financial Ledger: Multi-fund balances (Cash, Bank, Wallets, UPI), expense categories, transaction records, and debt ledgers. All financial data is encrypted locally with AES-256 and transmitted with TLS 1.3.
Active Device Management: When signed in, device model, operating system version, client IP address, and last activity timestamp are logged strictly to power the Active Device Vault and remote session kill-switch.

3. Spreadsheet & Statement Exports

When you export financial statements to genuine Microsoft Excel (.xlsx) or PDF format, files are generated securely on-device. These export workbooks contain your categorized financial summaries and are never shared or uploaded to third-party analytics services.

4. Email OTP Verification

Your registered email address is used solely for critical transactional security: sending one-time passwords (OTP) for biometric PIN recovery, new device authentication, and verifying permanent account deletion requests.

5. Device Hardware Permissions

Exact Alarms (`SCHEDULE_EXACT_ALARM`): Essential for delivering 3-stage persistent notification alarms (15m pre-alarm, 5m urgent alert, on-time alert) reliably even during battery saver mode.
Biometric Sensor (`USE_BIOMETRIC`): Used exclusively by your device's local hardware security module to unlock your PIN vault. Biometric data never leaves your physical device.
Notification Permissions (`POST_NOTIFICATIONS`): Required to alert you to approaching task deadlines and debt settlement due dates.

6. Anti-Brute Force Protection

To defend against unauthorized PIN or password guessing, rate-limiting algorithms temporarily restrict repeated invalid attempts from unknown IP addresses or unauthorized hardware.

7. Data Ownership & Permanent Deletion

You have full ownership of your data at all times. You can permanently wipe your account and all associated cloud sync backups immediately using our self-service Account Deletion Portal.

8. Contact & Security Inquiries

For questions or privacy inquiries, contact our data protection team at support@mirahaman.online.