Leave whenever you like
Bills, stock and the khata export to CSV, free, with no tier and no support request. Anti-lock-in costs us nothing and it is the fear worth answering first.
DATA SECURITY & INTEGRITY
Your books. Here is the list of who can read them.
Not adjectives — a table. For each thing in your shop, who sees it: you, the boy at the counter, and us. Every “no” below is enforced by the server, which is the only kind of no that holds.
The short version
We cannot see your money, and we built it that way.
Support can tell whether your bills are syncing. They cannot open your khata, read a customer's name, or see a single rupee figure for your shop. It is not a policy we ask staff to follow — the endpoints do not return it.
A support conversation is “my bill did not sync” or “this product is flagged”. It is never “how much did you make”. A capability nobody needs only has a downside.
Access
Who sees what
The middle column is why you can hand the phone to someone else during a rush. The third one is why you can hand us your books.
| Can read | You | Your staff | Us |
|---|---|---|---|
| The day's takingsदिन की कुल बिक्रीFirst thing on the owner's home screen. There is no setting that turns it on for staff, and none per shop for us. | Yes — you | No — your staff | No — us |
| Individual billsअलग-अलग बिलA staff member sees the bills they rang up themselves. Every bill records who made it, and only the owner reads across members. | Yes — you | Limited — your staff | No — us |
| The udhaar bookउधार खाताOwner-scoped in the data model, not by a screen that hides it. Customer names and balances are off limits to support by design, and the record is never sold or monetised. | Yes — you | No — your staff | No — us |
| Prices, and changing themरेट, और उन्हें बदलनाStaff read them. Changing one needs a permission you grant per person, off by default. A discount on a sale in front of them is bargaining, not a price change. | Yes — you | Limited — your staff | No — us |
| Which phones are signed inकौन-कौन से फ़ोन साइन-इन हैंSelf-only, and no role widens it. An owner removes a staff member's access by ending the membership — the control is over the job, not over their phone. | Limited — you | Limited — your staff | No — us |
| Whether the shop is syncingसिंक हो रहा है या नहींThe one row where the third column says yes, and it is why the rest of the column can be believed. A stuck sync has to be visible to us or it is found by the shopkeeper, late. | Yes — you | Yes — your staff | Yes — us |
The third column is the one worth reading twice. Most access tables in this category have two, because the company writing them is not a party in its own diagram.
Commitments
Four things that stay true
Delete means delete
One request removes the account and its data. The page that describes it is linked from inside the app, and it is a real process rather than a form that opens a ticket.
Your phone has a copy
The app writes to the phone first and syncs after. If our servers vanished tomorrow, the bills you made today would still be on your handset.
Nothing on your receipt but you
No logo, no watermark, no 'sent via'. The receipt is the shop's signboard, not our billboard, so there is no de-branding to sell back to you later.
The inventory
What leaves the phone, and what never does
Two columns rather than a paragraph, because a promise you can check against a list is a different kind of promise.
Leaves the phone
- Your bills and stock changes, so a lost phone is not a lost book
- The shop's name, pin and opening hours — the things a customer searches for
- Anonymous counts of which screens get used, with no identifier attached
Never leaves it
- The udhaar ledger, and every customer name and number in it
- Your prices and your margins
- A trail of where the phone has been — no such record is kept anywhere
- Anything at all to an advertiser, a data broker or a lender
The left column is short because it is only what the product needs to work. Anything that would make the right column shorter would have to be built on purpose, and this is the page it would have to be written on first.
DATA SOVEREIGNTY & EXPORT
Your data stays on your phone. Export or backup anytime.
No lock-in, no ransom, and no cloud hostage tricks. Karobari stores your transactions, item catalogs, and customer credit ledgers locally on your device with automated daily backups to device storage.
- Automated Local Backups: Schedule daily or on-demand backups directly to phone storage.
- 1-Tap Excel & CSV Exports: Download clean itemized spreadsheets of sales, inventory, and customer khata to open in any software or share with your accountant.
- Instant Restore: Migrate to a new handset in seconds by importing your encrypted local backup file.
- Zero Server Leaks: We never sell, monetize, or harvest your customer phone numbers or basket details.
Why free
Free, and you are not the product
So how does this pay for itself?
Today it mostly doesn't need to. The app works offline, so it barely touches a server; the running cost of one shop is close to nothing. That is a real answer and it only works at this size, which is why the team is small.
Later, money comes from places where the value is already obvious — listing placement for shops that want it, ordering between businesses, analytics for people who ask for analytics. Never from the till.
What does “never from the till” mean exactly?
Billing, stock, the udhaar book and sync do not become paid, get row limits, get a device count, or start charging to restore a backup. Those are the five ways this category usually monetises, and each one works by removing something that already worked.
A paid listing will also never be allowed to outrank a real search result. If we ever sell placement it is a separate, labelled, capped slot — not a thumb on the scale.
Will you sell my data?
No, and the sharpest version of that promise is about the khata specifically: the udhaar book is never sold, never shared, and never monetised. It is the record of a relationship that existed before this app and will outlast it.
Lending against your transaction history is the obvious way to make money here. It is also the obvious way to lose the trust the whole thing depends on, and it is written down internally as a decision that cannot be made quietly.
Who is actually behind it?
A small team building this in India, in the open, with a support address you can talk to a human in. There is no growth team and no ad budget — which is also why you found this page rather than an advertisement.
Straight answers
Things we are deliberately not claiming
Every security page on the internet says “bank-grade” and “encrypted”. Here is where those words would be doing more work than they deserve.
- Not end-to-end encrypted
- Traffic is encrypted in transit and data is encrypted at rest, but our server can read your shop's rows — it has to, in order to sync them between your phones and render your public page. Anyone claiming end-to-end encryption on a product that syncs and serves a web page is describing something else.
- Not “we technically cannot access it”
- An operator with database access can reach data. The honest control is that the operations console cannot show per-shop revenue or customer references to anybody, every action on it is written to an audit log including reads, and the wide-open admin panel is closed in production. Scoped and recorded beats an impossible promise.
- Not a backup service
- Your bills sync to us and you can export them any time, but the app is not a vault and does not claim to be one. Take the CSV occasionally. That advice is free and it is what we would tell a friend.
- Not audited or certified
- There is no SOC 2 report and no external penetration test to point at, because this is a revenue and buying one would be theatre at this stage. When there is, it will be linked here rather than described.
The other half of trust
Nobody worries about a shop app until the network drops mid-sale. That is a separate page, and it is the one that shows the actual mechanism.