Privacy Policy

Who we are

This privacy policy applies to Nafa: NEPSE Portfolio Tracker (the "App"), published on Google Play by KripaShreeApps ("we", "us"), an independent app studio.

Information we collect

• Nothing reaches us. Nafa only handles information you give it, and keeps it on your device:
• Accounts you create, such as a name for each family member's demat account.
• Holdings: scrip symbols, units, purchase prices, costs and last traded prices.
• Transactions and sales: dates, quantities, prices, broker charges, and the profit and capital gains tax Nafa works out from them.
• Settings: your theme and whether App lock is on.
• Nafa does not collect your location, contacts, photos, phone number, device identifiers, or information about other apps on your device.

Permissions

• Biometric (fingerprint, face): used only for App lock, and only when you turn it on.
• Internet: used only to download public share prices, as described below.
• Nafa requests no storage, location, camera, contacts or phone permissions. It opens and saves files only through your device's file picker, and only the ones you choose.

Third-party services

• None in the app. Nafa has no ads, analytics, tracking or third-party code that collects data.
• Google Play distributes Nafa and handles downloads and updates under Google's privacy policy (https://policies.google.com/privacy). If you have agreed to share usage and diagnostics data with Google, we may see crash reports and overall statistics, such as the number of installs, in Google Play Console. These never include anything you entered in Nafa.

Files you import

You can import files you export yourself from MeroShare (the WACC report, My Portfolio and Transaction History) and from TMS (the trade book and sell settlements). You choose each file with your device's file picker, and Nafa can open only the file you choose.

Nafa reads the file on your device, shows you a preview, and keeps only what it needs: scrip symbols, units, prices, dates, costs and amounts. Some of these files also contain your demat number (BOID), client code or name. Nafa ignores these and does not store them.

Share prices

To show current values and profit/loss, Nafa downloads the latest prices for every company listed on NEPSE. Every user downloads the same list, so the request does not reveal which shares you hold, and Nafa sends no account, holdings, device identifier or other information about you with it.

Like any website, the server that provides the prices can see your IP address and the time of the request. If you edit a price yourself, that price stays on your device.

Where your information is kept

Everything is saved in Nafa's private storage on your device, which other apps cannot read. It is not sent to us or to anyone else.

Nafa opts out of Android's automatic Google Drive backup, so your data is not copied to the cloud. When you set up a new phone, Android's phone-to-phone transfer may copy Nafa's data directly from your old phone to the new one. That transfer happens between your own devices and never passes through us.

Backups you make

If you choose Settings → Back up to a file, Nafa saves your data to a file at a location you pick. The file is encrypted with AES-256 using a key built into Nafa, so it cannot be read or changed outside the app, and any change to it is detected. It is not protected by a password: anyone who has the file and Nafa can restore it. Keep it private, and delete it when you no longer need it.

If you save a backup to a cloud folder, such as Google Drive, that service's own privacy policy applies to the file. Nafa only reads a backup when you choose to restore it.

App lock

If you turn on App lock, Nafa asks your device to confirm it is you using its own sign-in: fingerprint, face, or screen lock PIN, pattern or password. Your device only tells Nafa whether the check succeeded. Nafa never receives or stores your fingerprint, face data or PIN.

This page

Settings → Privacy policy in Nafa opens this page in your browser. It opens outside Nafa.

This website has no accounts, cookies, analytics or ads. It is hosted by Vercel, which, like most web hosts, may record basic technical information such as your IP address and browser type to run and secure the site (https://vercel.com/legal/privacy-policy).

Keeping and deleting your data

Your data stays on your device until you delete it. Because we hold no copy, you can see, correct and delete all of it yourself in Nafa at any time, and we cannot recover it for you, so keep a backup if it matters to you. Backup files you saved elsewhere are not affected by the steps below; delete them yourself when you no longer need them.

• Delete a holding or an account from its menu in Nafa.
• Settings → Clear all data deletes everything Nafa has stored on your device.
• Uninstalling Nafa also removes everything it stored.

Not financial advice

Nafa is an independent app and is not affiliated with NEPSE, CDSC, MeroShare or any broker. Figures are estimates based on the data you enter or import, and are not financial advice. If a change to this policy affects how Nafa handles your data, we will also say so in the app's release notes.

When we share information

We do not sell your personal information. We may disclose information we hold only:

• as required by law, such as to comply with a subpoena or similar legal process;
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with trusted service providers who work on our behalf, have no independent use of the information, and have agreed to follow this policy.

Data retention

Where we hold data, we keep it only as long as needed: automatically collected data for up to 24 months, user-provided data for the duration of your use plus 12 months, aggregated and anonymized data indefinitely (it no longer identifies you), and any data required for legal compliance for as long as the law requires.

Your rights

You may ask us to access, correct, or delete personal data we hold about you, or withdraw consent where processing is based on consent. Uninstalling the App stops further collection but does not automatically delete data already transmitted.

If you are a California resident, you have the right to know what personal information is collected, to delete it, to opt out of its sale or sharing, and to non-discrimination for exercising these rights (CCPA/CPRA).

Where data is transferred outside your country, including outside the EEA, we or our service providers use appropriate safeguards such as Standard Contractual Clauses or adequacy decisions where required by law.

Children's privacy

We do not knowingly collect personally identifiable information from children under 13. If you believe a child has provided personal information through the App, contact us and we will delete it.

Nafa is meant for adults aged 18 and over who invest in the share market. It is not directed at children.

Security

We use reasonable physical, electronic, and procedural safeguards to protect any information we process. If a data breach affects your personal data, we will notify you as required by applicable law.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page with a new effective date. Where required by law, we will seek your consent to material changes before they take effect. Previous versions are available on request.

Contact us

Questions about this policy or requests about your data: supportme.app@gmail.com

KripaShree Flowers and Handicraft, New Road Ward No. 8, Pokhara, Nepal