Privacy

Jotto is a product of Indie Labs, which operates the service and is the controller of your data. Jotto only sees the messages you send to the Jotto WhatsApp number. We use them to build your log — calories, expenses, notes, todos, habits, bookmarks — and, without their contents, to count how Jotto gets used. We don't sell your data, we don't show ads, and we don't train models on your captures.

Your WhatsApp phone number (it's your account), the messages you send to Jotto — text, voice notes, and photos — and the entries extracted from them. If you upgrade to Pro, the checkout collects your email for billing receipts.

We cannot see any of your other WhatsApp chats. WhatsApp only delivers messages addressed to our number.

Captures are processed automatically to extract structure — for example, turning “₹200 uber” into an expense. That processing uses third-party AI services (currently Google for text and image understanding, and Groq for voice transcription), our messaging provider Gupshup for WhatsApp delivery, Supabase for storage, Cloudflare for encrypted backups, Vercel for hosting, Dodo Payments for Pro billing, and PostHog for usage counts (below). Each processes your data only to provide the service.

We use PostHog to see how Jotto is used. For each message you send, we record when it arrived, whether it was text, a voice note or a photo, and which part of Jotto it went to — meals, money, a note — never what it says. On heyjotto.com and in your dashboard, we record which pages are opened and, on the homepage, which start button was tapped — not what's on the page or what you type. Sign-in links and codes are removed from page addresses before anything is sent. There are no screen recordings.

These records are tied to a random account ID, never your number, name or email. The website keeps a random ID in your browser's storage — not a cookie — so a repeat visit counts once.

If you start a chat with Jotto by tapping an ad on Facebook or Instagram, WhatsApp tells us which ad it was, and we keep that ad's ID with your account so we can tell which ads are worth running. We don't send Meta anything about you or what you log.

Your data is encrypted in transit and at rest. Opening your dashboard takes a one-time sign-in link or code sent to your WhatsApp number — there's no password to steal.

So nothing is lost to an accident, we keep a nightly backup of the database. Each one is encrypted before it is stored, kept for 30 days, and then deleted.

You can download everything in your account from Settings anytime, as one file, and your expenses and meals as CSV too. To delete your account and everything in it, go to Settings → Delete account, where you can take that copy first; it's erased straight away, and gone from our backups within 30 days. You can also email [email protected] from any address with your WhatsApp number, and we'll confirm over WhatsApp and erase it.

Himal Jung Thapa is responsible for how Jotto handles your data. If you have a question about it, or a complaint, email [email protected] and we'll reply within 7 days.

If this policy changes in a way that matters, we'll tell you on WhatsApp before it takes effect.