Halaga

Privacy Policy

Effective date: September 24, 2026

Halaga App by Indoscorpios ("Halaga", "we", "us") provides personal-finance, planning, business/VA and community features through the Halaga web application and related Android/PWA experiences. This Privacy Policy explains what information Halaga handles, why it is handled, who may receive it, how it is protected, how long it is retained, and how you can exercise privacy rights.

Important: This notice describes the current implementation reflected in Halaga source control as of the effective date. It is not a substitute for legal advice. If the legal entity, providers, processing purposes, or product features change, this notice must be reviewed and updated.

1. Who controls your personal data

Personal Information Controller / privacy contact: Halaga App by Indoscorpios.
Privacy Office: privacy@halaga.app
General support: support@halaga.app
Billing: billing@halaga.app

For privacy requests, use privacy@halaga.app. Do not send passwords, MFA seeds, recovery codes, payment credentials, API keys, or other secrets by email.

2. Information we process

Account, identity and authentication

Email address and authentication account identifiers.
Profile information such as full name, username, public Halaga User ID, bio and profile-photo URL where provided.
Authentication/session state, Google sign-in information when you choose Google OAuth, MFA factor/security state, recovery-code hashes and salts, recovery attempts, and security events.

Personal finance information

Income and expense transactions, dates, descriptions, amounts, types, categories and notes.
Budgets, savings goals, recurring transactions, custom categories and transaction templates.
Investment accounts, holdings, tickers/assets, quantities, average cost, prices, currencies and account notes.
Other assets, asset snapshots, debts, lenders, balances, interest, minimum payments, extra payments and due dates.
Dashboard/workflow preferences and information used to calculate financial summaries, charts, insights and planning views.

Business and VA workspace information

Business/workspace name, type, industry, team size, status, business contact information, addresses and notes.
Business transactions, expenses, sales, products/inventory, customers, customer contact details, customer debts/payments, clients, projects, tasks, SOPs, time entries, invoices/items/payments, proposals, contracts, reminders, approvals and reports.
Workspace memberships, roles, client-portal relationships, dashboard preferences and business audit information.

If you enter information about another person (for example a customer, client, employee, VA or business contact), you are responsible for using Halaga only where you have an appropriate lawful basis and any notice or authorization required by applicable law.

Community and communications

Public community User ID, username, community profile information, posts, titles, topics, comments, reactions, follows, topic follows, blocks and reports.
Community notifications and read state.
Group conversations, membership/roles, messages and message read state. Messages are available to the relevant conversation participants according to the community access controls.
User-created community media references where the feature is used.

Content you choose to publish publicly in Community may be visible to other authenticated Halaga users according to the visibility controls offered by the feature.

Support, feedback and diagnostics

Support tickets, including your account User ID, account email/name, issue description, reproduction details, category/severity, page or route, app version, browser user-agent, error code, diagnostic ID, response and timestamps.
Product feedback categories, subcategories and optional free-text details.
Account-deletion and subscription-cancellation survey selections, optional details, plan/provider information and timestamps.
Security-event information such as event type/severity, hashed network/device-related identifiers where implemented, bounded metadata and timestamps.

Waitlist and marketing requests

If you voluntarily join a Halaga launch/product waitlist, we process the email address you submit for that request and related product communications.

Subscriptions and payments

Subscription status, plan, trial information, promotion-code/redemption information, purchase records and entitlement information.
Payment-provider and transaction-reference metadata used to verify purchases, subscriptions and promotions.
For Maya-hosted checkout, payment credentials are handled through the payment provider's flow rather than stored as full card or bank credentials in Halaga's application database.

Offline and device-local information

When offline support is used, applicable finance/workspace state and queued changes may be stored in the browser's local IndexedDB storage on your device.
The application may use browser/service-worker cache and local device storage needed for the PWA/application experience.
Halaga supports encrypted user-created backup/export files. If you manually share or upload a backup to Google Drive, Dropbox, or another destination, that transfer is initiated by you and is subject to the destination provider's terms and privacy practices.

3. Why we process information

Depending on the feature and context, Halaga processes information to:

create and secure accounts, authenticate users, support Google OAuth and MFA, and recover accounts;
store, synchronize and display finance, business and community information;
provide calculations, dashboards, planning views, financial insights, search, sorting, notifications and other requested functionality;
operate Premium subscriptions, trials, promotions, payment verification and purchase entitlements;
provide support, diagnose application problems, respond to feedback and improve reliability;
prevent abuse, protect accounts, enforce authorization and security controls, investigate incidents and maintain security records;
operate moderation/reporting and community-safety workflows; and
send communications you request or that are necessary to operate the service, subject to applicable law and your available preferences.

Our lawful bases may include performance of a contract or requested service, compliance with legal obligations, legitimate interests that do not override applicable privacy rights, and consent where consent is required. Where processing is based on consent, you may withdraw consent subject to applicable law and any consequences explained at the time of withdrawal.

4. Automated processing, profiling and insights

Halaga uses automated calculations, categorization/display logic, search and sorting, notification triggers, synchronization, fraud/security controls and community moderation workflows. Financial insights and dashboards are generated from information you provide.

Based on the current implementation, Halaga does not use automated processing to make decisions that have legal or similarly significant effects on you, such as credit approval, employment decisions, insurance eligibility or investment decisions. If this changes, the relevant notice and user controls will be updated as required.

5. Who may receive information

Service providers and infrastructure

Supabase — authentication, MFA, database, Row Level Security, Edge Functions and related backend infrastructure.
Vercel — website hosting, serverless/API runtime and deployment infrastructure.
Maya — hosted payment checkout, payment verification and webhook/reconciliation processing.
Google — Google OAuth authentication when you choose to sign in with Google.

These providers receive information only as needed for the services they provide to Halaga, subject to their applicable agreements, security controls and privacy policies.

User-directed transfers

You may intentionally export, download, share or upload information outside Halaga, including encrypted backups. Halaga does not receive your password for a third-party storage account merely because you choose to save a backup there.

Legal, safety and business events

Information may be disclosed where required or permitted by applicable law, legal process, security requirements, fraud prevention, protection of rights, or a corporate transaction such as a merger or acquisition, subject to applicable notice and legal requirements.

Halaga does not sell personal or sensitive user data.

6. Security safeguards

Halaga uses HTTPS/TLS for network transmission, authenticated sessions, Supabase Row Level Security, server-side authorization for privileged operations, MFA-aware administrative controls, hashed recovery/security identifiers, payment verification, input validation, security headers, restricted CORS where applicable, and encrypted local offline data mechanisms where implemented. Access to production secrets is separated from the browser and development/prototype environments.

No online service can guarantee absolute security. You should protect your credentials, MFA devices, recovery codes and the devices on which Halaga is used.

7. Retention

Halaga follows a purpose-based retention approach rather than retaining identifiable information indefinitely.

Account and finance/business/community records: retained while your account and the relevant service are active, or until you delete them/account, subject to lawful retention needs.
Payment, purchase and subscription records: retained as necessary to verify transactions, maintain entitlements, resolve disputes, prevent fraud, meet accounting/tax/legal obligations, and satisfy provider requirements.
Security and operational records: retained only for as long as reasonably necessary for security, troubleshooting, fraud prevention, incident response, legal claims and operational integrity.
Support, feedback and survey records: retained only for the period reasonably necessary to respond, analyze product issues, protect the service, establish or defend claims, or comply with law. Account deletion removes account-linked feedback/survey records in the current deletion workflow rather than intentionally preserving identifiable feedback after deletion.
Waitlist information: retained only while needed for the waitlist/product-communication purpose or until you request removal, subject to applicable legal requirements.
Local browser/device data: remains under your device/browser controls until cleared, expired or removed by the application; deletion from Halaga's servers does not by itself guarantee that every browser cache, downloaded backup, screenshot or user-created copy has disappeared.
Third-party provider records: may have separate retention periods under the provider's policies and applicable law.

Where law permits or requires longer retention for legal claims, security, fraud prevention, accounting/tax obligations or other lawful purposes, Halaga may retain the minimum information necessary for that purpose and will securely dispose of it when the applicable need ends.

8. Account deletion

You can start account deletion from Settings → Danger zone → Delete account after signing in. The flow requires account-email confirmation and the phrase DELETE MY ACCOUNT; when verified MFA exists, an elevated MFA-authenticated session is also required.

The public account deletion page provides the external deletion information required for account-deletion transparency but does not itself delete an account.

The deletion workflow removes the authentication account and account-linked Halaga data, including personal finance, business/workspace, community, notification, recovery, support, feedback/survey, security, subscription, purchase and other directly user-linked records identified by the current database relationships. Payment webhook records tied to the account's purchase references are also removed by the deletion workflow.

Deletion does not automatically erase information that you intentionally copied outside Halaga, such as downloaded files, screenshots, manually shared backups, or records retained by independent third-party providers under their own lawful retention requirements.

9. Your privacy rights

Subject to the Data Privacy Act of 2012, its IRR, other applicable law and lawful limitations, you may have rights including:

to be informed about processing;
to access personal data and information about its processing;
to request correction or rectification of inaccurate or incomplete information;
to object to or restrict certain processing where applicable;
to request erasure or blocking where applicable;
to request data portability where applicable;
to withdraw consent where consent is the lawful basis, subject to applicable consequences and law; and
to lodge a complaint with the National Privacy Commission where you believe your rights have been violated.

To exercise a right, contact privacy@halaga.app. We may need to verify your identity and may apply lawful exceptions or limitations. We will explain material limitations where applicable.

For Philippine privacy information and complaint procedures, see the National Privacy Commission's data-subject rights information.

10. Children's privacy

Halaga is not directed to children and is not intended to knowingly collect personal information from children where prohibited by applicable law. Do not use Halaga where you are not legally permitted to do so.

11. Changes to this policy

We may update this Privacy Policy when the product, processing activities, service providers or legal requirements change. The effective date at the top will be updated for material revisions. Where required, we will provide additional notice or obtain consent.

12. Contact

Privacy: privacy@halaga.app
Support: support@halaga.app
Billing: billing@halaga.app