Private by default.

In a browser, Baant keeps your groups in that browser’s own storage on your computer or phone. In the phone apps they are kept in a database on the phone. There is no Baant server holding a copy, and no account to break into.

Baant asks the browser to keep this data even when space runs low. Clearing the browser’s site data, or uninstalling it, removes it, so download a backup now and then (Import and export, then Download a backup).

Baant itself makes one kind of request: when an expense or payment is in a currency other than the group’s, it asks Frankfurter, a public service publishing European Central Bank rates, for that day’s rate. The request contains two currency codes and a date. It contains no amounts, names or anything about your groups.

Two optional features use your browser’s own abilities. If you press the microphone to say an expense, your browser turns the speech into text, usually with its maker’s online speech service, and Baant receives only the words. Scanning a bill on this website runs inside your browser, and the photo is not uploaded.

When you share a message, a link or a file, it goes where you send it: WhatsApp, email or another app you choose. Baant does not read your chats or contacts.

The website and app run no analytics scripts, no advertising code and no third-party trackers. Fonts and icons are served from the same place as the site itself.

Baant builds a standard UPI payment request (the payee’s UPI ID, the amount and a note) and hands it to your own UPI app. You check the details and enter your UPI PIN there. Baant never sees your PIN, card or bank details and cannot move money.

Because opening a UPI app proves nothing, Baant asks you whether the payment went through and asks the person paid to confirm it. Each step is recorded.

UPI IDs are shown partly hidden in lists (de•••k@okicici). When someone’s UPI ID changes, Baant flags it for a day so a wrong ID is noticed before anyone pays it.

Every change to a group is stored as a new entry: an edit adds a version, a deletion marks the expense void. Each entry carries a SHA-256 fingerprint of the entry before it. If any old entry were altered or removed, every fingerprint after it would stop matching. Baant checks the whole chain each time it opens a group and will not use a broken one.

Changing money after people have started paying needs a written reason, which is kept in the history.

Groups have an owner, admins, members and guests. Owners and admins manage people and settings. A guest is someone without the app; an owner or admin can record things on their behalf. A person’s UPI ID can be changed only by that person, or by an owner or admin when the person is a guest.

A share link contains the group itself, so treat it like the group: send it only to the people in it.

Everything you type is treated as text, never as code. Exported spreadsheets are protected against formula injection, so a description such as =HYPERLINK(...) opens as plain text.

Every page carries a content policy that tells your browser to load only this site’s own files. Scripts, images and requests from anywhere else are refused, with one exception: the exchange-rate lookup described above.

If two tabs or windows change the same group, each one first catches up with what the other saved, so the record never splits in two. If a saved record is ever altered outside Baant, the group is not used: you are told, the record is kept as it is, and you can download it.

Amounts are whole numbers of paise or cents, never floating-point numbers, so they cannot drift.

Receipts you attach are kept in your browser; they are not uploaded anywhere.

Sync between devices will need a server. The plan is encrypted connections throughout, encryption of stored data, sign-in with passkeys or one-time codes, and support staff who cannot casually browse anyone’s groups. This page will be updated with the details before sync is switched on.