Privacy Policy

Effective date: June 1, 2026 · Last updated: September 11, 2026 · Version 1.3

1. Who We Are

FreeBy44 is operated by Shrutika Patil, a sole proprietor doing business as "Dreamverna", based in Pune, Maharashtra, India. This Privacy Policy explains what personal data we collect when you use FreeBy44, how we use it, and your rights over it. It is written in plain language to comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable IT Act rules.

FreeBy44 is a privacy-first website. We do not connect to your bank, we do not read your financial accounts, and we never use your data for advertising or sell it to anyone. Everything you enter is entered manually by you, for you.

Time-limited pilot notice. We are currently running a limited pilot using PostHog, a third-party product-analytics tool, to understand how people use the website and where they get stuck. This includes session recording. Section 2E describes exactly what it captures and Section 4 describes where it is processed. PostHog will be removed once the pilot concludes, and all recordings deleted with it.

Your use of FreeBy44 is also governed by our Terms of Service, which form part of this Privacy Policy.

2. What Data We Collect

We collect the following categories of data:

A. Account Data (from Google OAuth)

Your name
Your email address
Your Google profile picture (optional, display only)
Your Google account identifier (the unique sub claim, used to link your sessions securely)
Account creation timestamp and last login timestamp

We receive this from Google when you sign in. We do not receive your Google password or access any other Google services.

B. Financial Data (entered manually by you)

Asset names, categories, and current values
Monthly snapshot data (invested and current amounts per asset)
Monthly income, total investments, and total expenses
Outstanding liability names, amounts, and EMIs
Insurance policy details (provider, coverage, renewal dates)
FIRE settings (target corpus, SWR, inflation rates, expense baseline)
Milestones and sinking fund targets

This data is entered entirely by you. We never pull it from banks, brokerages, or any external financial source.

C. Session Data and Cookies

FreeBy44 sets an essential cookie — a secure, HTTP-only session cookie set by NextAuth.js to keep you signed in. This cookie contains no financial data, only your authentication token. It expires 30 days after you sign in, or when you log out. You can clear this cookie at any time via your browser settings; doing so will sign you out.

During the pilot described in Section 4, PostHog also sets analytics cookies. These group your page views into a single visit so we can see how a journey through the website unfolds. They are removed when the pilot ends.

We do not use advertising cookies, and we do not allow any third party to track you across other websites.

D. Technical Data (collected transiently by Vercel)

Your IP address and standard web request metadata (timestamp, browser type, URL requested) are logged transiently by Vercel for security, abuse prevention, and operational purposes. This data is not linked to your financial records and is not used for tracking or profiling.

E. Usage and Session Recordings (pilot only)

While the pilot runs, PostHog records how you interact with the website so we can find where the experience breaks down:

Pages visited, and the order and timing of your visit
Clicks, scrolling, and mouse movement
A replay of what was displayed on screen, which includes financial figures and names you have already saved — for example asset names and amounts shown on your dashboard
Your browser type, device type, and screen size

Values you type into forms are masked and are never recorded. We do not use these recordings to make any decision about you; they exist only to improve the website. To opt out, email us at [email protected] and we will exclude your account. All recordings are deleted when the pilot ends.

What we do NOT collect: bank account numbers, card details, Aadhaar, PAN, passwords, precise location data, persistent device identifiers, advertising identifiers, or any data from third-party financial platforms.

3. How We Use Your Data and Lawful Basis

We process your personal data on the basis of your consent, given when you create your account by signing in with Google. You may withdraw consent at any time (see Section 7).

We use your data solely to provide the FreeBy44 service to you:

Authenticate your identity and maintain your session
Store and display your financial data across sessions
Compute your dashboard metrics, FI ratio, and corpus projections
Show milestone progress, savings rate, and lifestyle creep signals
Generate the Monthly Plan section on the Cash Flow page

We do not use your data for advertising, profiling, analytics resale, or model training.

4. Data Storage, Third-Party Processors, and Cross-Border Transfers

Your data is stored and processed by the following services on our behalf:

MongoDB Atlas — Mumbai, India (ap-south-1)

All financial data you enter is stored in a MongoDB Atlas cluster hosted in Mumbai, India. Data is encrypted at rest and in transit. MongoDB Atlas is operated by MongoDB, Inc. and is subject to MongoDB's security and compliance standards.

Vercel — global edge network

The website is hosted and served by Vercel, Inc. Server-side functions execute in Vercel's Mumbai region (bom1). Static assets are served from Vercel's global edge network for performance. Vercel may log standard request metadata (IP address, timestamp) for security purposes.

Google — OAuth authentication only

Google provides authentication via OAuth 2.0. We receive only your name, email, profile picture, and account identifier from Google. We do not access your Gmail, Google Drive, or any other Google service. No financial data is ever shared with Google. Google's use of data during authentication is governed by Google's Privacy Policy.

Vercel Analytics — global edge network

We use Vercel Analytics for privacy-friendly, cookieless usage analytics (aggregate page views and session counts). No cookies are set. No financial data is collected. IP addresses are processed transiently to derive a daily hash for deduplication and are not retained in identifiable form. Vercel Analytics is operated by Vercel, Inc.

PostHog — United States · pilot only, temporary

PostHog provides the product analytics and session recording described in Section 2E. Usage data and recordings are processed and stored on PostHog's United States infrastructure, operated by PostHog, Inc. This is a transfer outside India; the United States is not a country restricted by the Indian government under Section 16 of the DPDP Act, 2023. PostHog is contractually bound to process this data only on our instructions, and does not sell it or use it for advertising. This is a temporary pilot. PostHog will be removed from FreeBy44 once it concludes, and all recordings deleted.

All processors listed above are bound by data processing agreements that obligate them to maintain appropriate security and process personal data only as instructed.

Static assets (HTML, CSS, JavaScript) may be cached and served from Vercel's global edge network outside India for performance. Your financial records are stored and queried entirely in Mumbai, India — database queries, API calls, and server-side functions all execute there. The exceptions are Google OAuth, which processes authentication metadata on its global infrastructure, and the PostHog pilot described above, whose usage data and session recordings are processed in the United States. We do not transfer data to any country restricted by the Indian government under Section 16 of the DPDP Act, 2023. No other third parties receive your data. We do not use advertising networks or data brokers.

5. No Selling or Sharing of Your Data

Dreamverna does not sell, rent, or share your personal or financial data with any third party for their own purposes — ever. Your financial data is yours. The only parties who ever access it are the infrastructure providers listed above (MongoDB Atlas, Vercel, Google, Vercel Analytics, and PostHog during the pilot), and only to the extent necessary to operate and improve the service.

6. Data Security

We implement reasonable security practices aligned with industry standards including ISO/IEC 27001 and OWASP Top 10 guidance:

All data transmitted over TLS 1.2 or higher (HTTPS enforced)
Data at rest encrypted using AES-256 (MongoDB Atlas default)
Authentication via Google OAuth 2.0 with secure, HTTP-only session cookies
Database access restricted by IP allowlist and credential-based authentication
Application input validation and output encoding to mitigate OWASP Top 10 risks
Internal access on a least-privilege basis, only when required for support or maintenance
Encrypted backups on a 30-day rolling window — older backups are automatically overwritten and subject to the same access restrictions as primary data

No system is perfectly secure. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users without undue delay, in the manner and within the timelines prescribed under the DPDP Act and Rules.

7. Your Rights Under the DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023, you have the following rights:

Right to Access: You can download a complete copy of all your data at any time from Settings → Export my data. You may also request a summary by emailing us.

Right to Correction: You can update or correct your data directly within the website (assets, settings, cash flow entries, etc.). For account-level data (name, email), please update it via your Google account.

Right to Erasure: You can permanently delete your account and all associated financial data at any time directly from Settings → Delete my account. You may also request deletion by emailing [email protected]. Deletion is completed in primary systems immediately. Encrypted backups may retain residual data for up to a further 30 days before being overwritten in our normal backup rotation, after which all copies are permanently removed.

Right to Withdraw Consent: You may withdraw consent for processing at any time. Withdrawing consent will result in account deletion, as we cannot operate the service without processing your data. Withdrawal is as easy as giving consent — simply use Settings → Delete my account, or email us at the address below to initiate it.

Right to Nominate: Under Section 14 of the DPDP Act, you may nominate another individual to exercise your data rights in the event of your death or incapacity. To register a nominee, contact us at [email protected].

Right to Grievance Redressal: If you have a concern about how we handle your data, contact our Grievance Officer (see Section 12). We acknowledge complaints within 24 hours and resolve them within 15 days. If unresolved, you may raise a complaint with the Data Protection Board of India once it becomes operational.

8. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you. All projections, FI ratios, milestone statuses, and traffic light signals shown in the website are deterministic calculations based entirely on data and assumptions you enter yourself. No AI or machine learning models are applied to your data.

9. Data Retention

We retain your data for as long as your account is active. The value of FreeBy44 compounds over time — your historical snapshots are what make trends and projections meaningful — so we keep your data until you request deletion.

Accounts inactive for 24 consecutive months will be flagged for deletion. We will email you at least 30 days before taking any action, giving you the opportunity to log in and retain your account.

Pilot session recordings are retained only for the duration of the pilot and are deleted in full when it ends, along with the PostHog integration itself. They are never merged into your account records.

After account deletion by your request, all data is removed from primary systems immediately. For inactivity-triggered deletions, removal occurs within 30 days of the scheduled deletion date. In both cases, encrypted backups are purged within a further 30 days through our normal backup rotation, after which all copies are permanently removed.

10. Children

FreeBy44 is intended for users aged 18 and above. We do not knowingly collect personal data from individuals under 18. Consistent with the DPDP Act, we do not engage in behavioural tracking, targeted advertising, or any processing directed at children. If you believe a minor has created an account, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date and "last updated" date above. For significant changes, we will notify you via the email linked to your Google account or via an on-site notice before the changes take effect.

12. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, the details of the Grievance Officer are:

Name: Shrutika Patil

Designation: Grievance Officer & Data Protection Contact, Dreamverna

Address: Pune, Maharashtra, India

Email: [email protected]

We acknowledge complaints within 24 hours and endeavour to resolve them within 15 days of receipt, in accordance with the IT (Intermediary Guidelines) Rules, 2021.