finwipe 0.1.4 → 0.1.5

package/README.md

@@ -6,786 +6,300 @@ FinWipe is an open-source CLI tool that helps Indian citizens exercise their **r
 
 Every request gets a unique **DPR-ID** (e.g., `DPR-2026-000001`) for full auditability. All data stays on **YOUR machine**.
 
-## 📊 By the Numbers
-
-| Metric | Value |
-|--------|------:|
-| **npm downloads** | **0** |
-| GitHub stars | ⭐0 |
-| Registry | 91 entities (12 banks, 18 NBFCs, 59 fintechs, 2 HFCs) |
-| Monthly requests | 5,000+ (estimated) |
-| Success rate | 38% avg (shame list varies) |
-| Legal basis | DPDP Act 2023 + RBI DLG |
-
-## 🚨 Status: **Not published yet**
-
-FinWipe is **not available on npm** (e.g., `npm install finwipe` returns package not found).
-
-**However:** The repository is ready for publishing once all components are completed and tested.
-
-## Key Features
-
-- 📧 **Email + Registered Post** — Send deletion requests via multiple channels
-- 🏛️ **Legal Enforcement** — Escalate to DPDP Board, RBI Ombudsman, Consumer Forum
-- 📊 **Audit Trail** — Full DPR-ID tracking for compliance verification
-- 📱 **Multi-Platform** — Parse emails, PDFs, CIBIL reports, WhatsApp, AA apps
-- 🏢 **Cloud Integration** — Forwarder service for passive FI discovery
-- ⚡ **Automation** — Cron-based follow-ups and escalations
+---
 
-## Installation
+## 🚀 Install
 
+**Option 1 — npm (recommended, cross-platform):**
 ```bash
-# Quick install from this repo
-cd finwipe
-go build -o finwipe ./cmd/finwipe
-
-# Future (after publishing to npm)
 npm install -g finwipe
-finwipe init
 ```
 
-## Commands
-
-### Core Commands
-- `finwipe new` — Create deletion request (DPR-ID)
-- `finwipe send` — Dispatch via email/post
-- `finwipe track` — Monitor request lifecycle
-- `finwipe escalate` — File complaints with authorities
-
-### Discovery Commands
-- `finwipe discover-from-cibil` — Parse CIBIL reports
-- `finwipe discover-from-bank-statement` — Extract FIs from bank statements
-- `finwipe discover-from-email` — Scan Takeout exports
-- `finwipe discover-from-whatsapp` — Parse WhatsApp chats
-- `finwipe discover-from-aa` — Pull from Account Aggregator apps
-
-### Enforcement Commands
-- `finwipe dpd-board` — Generate DPBB complaints
-- `finwipe portability` — Request data exports
-- `finwipe verify` — Confirm deletions
-- `finwipe compliance --shame` — Community shame list
-
-## Development Status
-
-**Current State:** Development complete, testing in progress
-**Expected Release:** When all features are tested and cloud deployment is ready
-
-## Usage
-
+**Option 2 — Homebrew (macOS/Linux):**
 ```bash
-# Quick setup and demo
-./finwipe init                    # Configure your profile
-./finwipe discover-from-cibil --file your_cibil_report.pdf --auto
-./finwipe send --dry-run          # Preview deletion requests
-./finwipe send                     # Send all requests
-./finwipe track --all             # Monitor progress
+brew tap das-rebel/finwipe
+brew install finwipe
 ```
 
-## Legal Disclaimer
-
-FinWipe helps you exercise your legal rights:
-- **Section 8(6)** — Right to erasure
-- **Section 6(9)** — Right to data portability
-- **RBI DLG** — Lending guidelines
-
-**Limitation:** NBFCs may not respond within 30 days. However, you have evidence of requests and a clear escalation path to authorities.
-
-## Tech Stack
-
-- **Go 1.21+** — Single binary, no external deps
-- **Cobra** — CLI framework
-- **SQLite (WAL)** — Request history
-- **gofpdf** — PDF generation
-- **Viper** — Configuration management
-
-## Files
-
-- `cmd/finwipe/` — Main CLI application
-- `internal/` — Core business logic
-- `data/nbfcs.yaml` — 91-entity registry
-- `templates/` — Email/letter templates
-- `README.md` — This documentation
-
-## Future Plans
-
-Once published, the roadmap includes:
-
-1. **npm Publication** — Ready to publish to npm
-2. **GitHub Actions** — Monthly automation
-3. **Cloud Integration** — Full forwarder service
-4. **Mobile App** — Android/iOS companion
-5. **Community Dashboard** — Show compliance rates publicly
-6. **Legal Templates** — Pre-filled court filings
-7. **Compliance Tools** — Automated escalation workflows
-
-## Helping You Start
-
+**Option 3 — Direct binary (no package manager):**
 ```bash
-# First steps
-cd finwipe
-./finwipe init                    # Your profile
-./finwipe list                    # Browse FIs
-./finwipe discover-from-cibil --file your_report.pdf --auto
-./finwipe send                     # Start deletion requests
-./finwipe track --all             # Monitor progress
+# macOS (Apple Silicon)
+curl -fsSL https://github.com/Das-rebel/finwipe/releases/latest/download/finwipe-darwin-arm64 -o finwipe
+chmod +x finwipe && sudo mv finwipe /usr/local/bin/
 ```
 
-**"Your financial data. Your rules."**
-
----
-
-## The Problem
-
-Indian citizens have no easy way to:
-- Know which NBFCs, fintechs, and lenders hold their data
-- Send legally-grounded deletion requests at scale
-- Track which entities complied vs. ignored requests
-- Escalate non-compliant entities to the Data Protection Board
-
-**FinWipe solves all of this.**
-
----
-
-## The Solution
-
+**Option 4 — Build from source:**
+```bash
+git clone https://github.com/das-rebel/finwipe
+cd finwipe && go build -o finwipe ./cmd/finwipe
 ```
-┌─────────────────────────────────────────────────────────────────┐
-│  YOUR MACHINE                                                │
-│                                                              │
-│  finwipe new --nbfc-id bajaj-finserv                        │
-│  finwipe send                                               │
-│  finwipe track --request-id DPR-2026-000001                │
-│  finwipe dpd-board --request-id DPR-2026-000001            │
-│                                                              │
-│  All data: ~/.finwipe/                                     │
-│  • history.db        — SQLite with full audit trail         │
-│  • letters/          — PDF deletion letters                │
-│  • config.yaml       — Your profile + SMTP                  │
-│  • evidence/        — Screenshots, acknowledgments         │
-└─────────────────────────────────────────────────────────────────┘
+
+Verify it works:
+```bash
+finwipe --help
 ```
 
 ---
 
-## Quick Start
+## ⚡ Quick Start (5 Steps)
 
 ```bash
-# 1. Install
-git clone https://github.com/das-rebel/finwipe
-cd finwipe
-go build -o finwipe ./cmd/finwipe
+# 1. Set up your profile (name, email, SMTP)
+finwipe init
 
-# 2. Setup (one-time)
-./finwipe init
+# 2. Browse the 91-entity registry
+finwipe list --category fintech
 
-# 3. Preview what would happen
-./finwipe send --dry-run
+# 3. Create a deletion request
+finwipe new --nbfc-id bajaj-finserv
 
-# 4. Send deletion emails
-./finwipe send
+# 4. Preview, then send
+finwipe send --dry-run    # preview first
+finwipe send              # actually send emails
 
 # 5. Track responses
-./finwipe track --all
+finwipe track --all
 ```
 
 ---
 
-## Core Commands
+## 📋 Core Commands
 
 ### `finwipe init`
-Initialize your profile with name, email, address, and SMTP credentials.
-
+One-time setup. Saves to `~/.finwipe/config.yaml`.
 ```bash
-./finwipe init
-# Interactive — asks for:
-#   • Full name
-#   • Email address
-#   • Address (for registered post)
-#   • SMTP host (e.g., smtp.gmail.com)
-#   • SMTP port (e.g., 587)
-#   • SMTP username (your email)
-#   • SMTP password (app password)
+finwipe init
+# Interactive prompts for:
+#   Full name, email, phone, address
+#   SMTP host (e.g. smtp.gmail.com), port (587), username, app password
 ```
 
-Config saved to `~/.finwipe/config.yaml`
-
----
-
 ### `finwipe list`
-Browse the 91 registered NBFCs, banks, fintechs, and HFCs.
-
+Browse 91 registered entities.
 ```bash
-./finwipe list
-./finwipe list --category fintech
-./finwipe list --category bank
-./finwipe list --search HDFC
-./finwipe list --json
+finwipe list                          # all 91
+finwipe list --category fintech       # 59 fintechs
+finwipe list --category bank          # 12 banks
+finwipe list --category nbfc          # 18 NBFCs
+finwipe list --search HDFC            # search by name
+finwipe list --json                   # JSON output
 ```
 
-**Categories:** `bank` (12) · `nbfc` (18) · `fintech` (59) · `hfc` (2)
-
----
-
 ### `finwipe new`
-Create a new deletion request. Returns a **DPR-ID** for tracking.
-
+Create a deletion request → returns a **DPR-ID**.
 ```bash
-# Single NBFC
-./finwipe new --nbfc-id bajaj-finserv
-
-# Batch by category
-./finwipe new --batch fintech --count 10
-
-# With specific categories
-./finwipe new --nbfc-id bajaj-finserv \
-  --categories marketing,third_party,app_usage
+finwipe new --nbfc-id bajaj-finserv
+finwipe new --nbfc-id tata-capital --categories marketing,third_party
 ```
 
-**DPDPA Deletion Categories:**
-- `marketing` — Promotional and marketing communications
-- `third_party` — Data shared with third parties
-- `behavioral` — Behavioral and usage data
-- `app_usage` — App activity and preferences
-- `call_records` — Call recordings and service logs
-- `loan_profile` — Pre-approved loan offers and credit profile
-- `all_non_essential` — Everything except legally required data
-
----
+**Deletion categories:** `marketing` · `third_party` · `behavioral` · `app_usage` · `call_records` · `loan_profile` · `all_non_essential`
 
 ### `finwipe send`
-Dispatch deletion requests via email or registered post.
-
+Dispatch requests via email or registered post.
 ```bash
-# Send all pending requests
-./finwipe send
-
-# Dry run (preview)
-./finwipe send --dry-run
-
-# Specific request
-./finwipe send --request-id DPR-2026-000001
-
-# Rate limit (ms between emails)
-./finwipe send --rate-limit 2000
-
-# Via registered post (generates letter PDFs)
-./finwipe send --channel post
-
-# Via CIC (in-person filing)
-./finwipe send --channel cic
+finwipe send --dry-run                # preview (no emails sent)
+finwipe send                          # send all pending
+finwipe send --request-id DPR-2026-000001
+finwipe send --rate-limit 2000        # 2s between emails
+finwipe send --channel post           # generate PDF letters
 ```
 
----
-
 ### `finwipe track`
-Track deletion request lifecycle and audit trail.
-
+Monitor the full lifecycle.
 ```bash
-# Track specific request
-./finwipe track --request-id DPR-2026-000001
-
-# All active requests
-./finwipe track --all
-
-# Requests overdue (past acknowledgment deadline)
-./finwipe track --overdue
-
-# Requests awaiting acknowledgment
-./finwipe track --awaiting-ack
-
-# Escalated requests
-./finwipe track --escalated
+finwipe track --request-id DPR-2026-000001
+finwipe track --all                   # all active
+finwipe track --overdue               # past deadline
+finwipe track --awaiting-ack          # no response yet
 ```
 
-**Request Lifecycle:**
+**Lifecycle:**
 ```
 INITIATED → DISPATCHED → ACK_RECEIVED → RESPONSE_OK → CLOSED
-                 ↓
-           AWAITING_ACK
-                 ↓
-           DELIVERY_FAILED (retry)
-                 ↓
-           ESCALATED
-                 ↓
-           DPDP_BOARD / RBI_OMBUDSMAN / CONSUMER_FORUM
-                 ↓
-              CLOSED
+                ↓                                   ↓
+          AWAITING_ACK                        ESCALATED
+                ↓                                   ↓
+          DELIVERY_FAILED               DPDP_BOARD / RBI_OMBUDSMAN
 ```
 
----
-
 ### `finwipe ack`
-Record when an NBFC acknowledges your deletion request.
-
-```bash
-./finwipe ack --request-id DPR-2026-000001
-./finwipe ack --request-id DPR-2026-000001 --reference ABC123XYZ
-```
-
----
-
-### `finwipe followup`
-Send follow-up emails after 48 hours of no acknowledgment.
-
+Record an NBFC's acknowledgment.
 ```bash
-# Follow up on all awaiting-ack requests
-./finwipe followup
-
-# Specific request
-./finwipe followup --request-id DPR-2026-000001
+finwipe ack --request-id DPR-2026-000001
+finwipe ack --request-id DPR-2026-000001 --reference ABC123XYZ
 ```
 
----
-
 ### `finwipe escalate`
-Escalate ignored requests to higher authorities.
-
+Escalate ignored requests up the chain.
 ```bash
-# Escalate to NBFC's DPO (Data Protection Officer)
-./finwipe escalate --request-id DPR-2026-000001 --to dpo
-
-# Escalate to DPDP Board (Section 27(3))
-./finwipe escalate --request-id DPR-2026-000001 --to dpd_board
-
-# Escalate to RBI Ombudsman
-./finwipe escalate --request-id DPR-2026-000001 --to rbi_ombudsman
-
-# Escalate to Consumer Forum
-./finwipe escalate --request-id DPR-2026-000001 --to consumer_forum
+finwipe escalate --request-id DPR-2026-000001 --to dpo           # L1: Data Protection Officer
+finwipe escalate --request-id DPR-2026-000001 --to dpd_board     # L2: DPDP Board §27(3)
+finwipe escalate --request-id DPR-2026-000001 --to rbi_ombudsman # L3: RBI
+finwipe escalate --request-id DPR-2026-000001 --to consumer_forum # L3: Consumer Forum
 ```
 
-**Escalation Path:**
-```
-L0 → L1: DPO (7 days no ack)
-L1 → L2: DPDP Board (30 days no response)
-L2 → L3: RBI Ombudsman / Consumer Forum
-```
-
----
-
 ### `finwipe close`
-Close a request with outcome.
-
+Close a request with an outcome.
 ```bash
-./finwipe close --request-id DPR-2026-000001
-./finwipe close --request-id DPR-2026-000001 --outcome deleted
-./finwipe close --request-id DPR-2026-000001 \
-  --outcome rejected --notes "NBFC claimed data already deleted"
+finwipe close --request-id DPR-2026-000001 --outcome deleted
+finwipe close --request-id DPR-2026-000001 --outcome rejected --notes "claimed already deleted"
 ```
 
-**Outcomes:** `deleted` · `acknowledged_not_deleted` · `partial` · `rejected` · `exemption_claimed` · `no_response` · `escalated`
-
----
+**Outcomes:** `deleted` · `acknowledged_not_deleted` · `partial` · `rejected` · `exemption_claimed` · `no_response`
 
 ### `finwipe report`
-Dashboard showing compliance metrics.
-
+Dashboard with compliance metrics.
 ```bash
-./finwipe report
-./finwipe report --days 30
-./finwipe report --format json
-./finwipe report --format csv
+finwipe report
+finwipe report --days 30 --format json
 ```
 
 ---
 
-### `finwipe compliance`
-Track NBFC compliance rates (anonymized community data).
+## 🔍 Discovery Commands
 
-```bash
-./finwipe compliance
-./finwipe compliance --shame
-```
-
-**Shame List:** Ranks NBFCs by worst acknowledgment rates.
-
----
-
-## Discovery Commands
-
-Find out which entities hold your data before sending deletion requests.
+Find out **who holds your data** before sending requests.
 
 ### `finwipe discover-from-cibil`
-Parse a CIBIL credit report PDF and auto-generate deletion requests for every institution that queried your report.
-
+Parse a CIBIL report PDF → auto-create requests for every institution that queried your credit.
 ```bash
-./finwipe discover-from-cibil --file your_cibil_report.pdf
-./finwipe discover-from-cibil --file report.pdf --auto
+finwipe discover-from-cibil --file your_cibil_report.pdf --auto
 ```
 
-**How it works:**
-1. CIBIL shows every institution that queried your credit report
-2. These are FIs that have done due diligence on you
-3. Cross-references against 91-entity registry
-4. Creates deletion requests for matched entities
-
----
-
 ### `finwipe discover-from-bureau`
-Parse credit bureau reports from all 4 bureaus: CIBIL, Experian, Equifax, CRIF HighMark.
-
+All 4 bureaus: CIBIL, Experian, Equifax, CRIF HighMark.
 ```bash
-./finwipe discover-from-bureau --file Experian_Report.pdf
-./finwipe discover-from-bureau --file CRIF_HighMark.pdf --auto
+finwipe discover-from-bureau --file Experian_Report.pdf --auto
 ```
 
----
-
 ### `finwipe discover-from-bank-statement`
-Extract financial institution references from bank statement PDFs.
-
+Extract FI references from bank statement PDFs (EMI deductions, NACH mandates).
 ```bash
-./finwipe discover-from-bank-statement --file statement.pdf
-./finwipe discover-from-bank-statement --directory ./statements/
-./finwipe discover-from-bank-statement --bank hdfc --auto
+finwipe discover-from-statement --file statement.pdf
+finwipe discover-from-statement --directory ./statements/ --auto
 ```
 
-**Parses:**
-- EMI deductions (identifies lender)
-- NACH/NECS references
-- Transaction descriptions with FI names
-- Standing instruction mandates
-
----
-
 ### `finwipe discover-from-email`
-Parse Gmail Takeout exports to find financial institutions.
-
+Parse Gmail Takeout exports.
 ```bash
-./finwipe discover-from-email --file gmail_export.zip
-./finwipe discover-from-email --format mbox --auto
+finwipe discover-from-email --file gmail_export.zip --auto
 ```
 
-**Supported formats:** ZIP (Takeout), MBOX, CSV, plain text
-
----
-
 ### `finwipe discover-from-whatsapp`
 Extract FI contacts from WhatsApp Business chat exports.
-
 ```bash
-./finwipe discover-from-whatsapp --path ./whatsapp_chat.txt
-./finwipe discover-from-whatsapp --auto
+finwipe discover-from-whatsapp --path ./whatsapp_chat.txt
 ```
 
-**How to export WhatsApp chats:**
-1. iPhone: WhatsApp → Chat → Export Chat
-2. Android: GB WhatsApp → Chat → Export
-
----
-
 ### `finwipe discover-from-aa`
 Discover FIs via Account Aggregator apps (NADL, CAMS, SAafe, Finvu).
-
 ```bash
-./finwipe discover-from-aa --provider nadl
-./finwipe discover-from-aa --provider cams --auto
+finwipe discover-from-aa --provider nadl
 ```
 
-**What it does:**
-1. Opens AA app login page in browser
-2. You authenticate with phone + OTP
-3. AA shows all linked financial accounts (FIPs)
-4. These are entities that have your financial data
-
-**AA Providers:** NADL · CAMS · SAafe · Finvu
-
 ---
 
-## Enforcement Commands
-
-### `finwipe dpd-board`
-Generate a pre-filled complaint to the **Data Protection Board of India** (DPBB).
-
-```bash
-./finwipe dpd-board --request-id DPR-2026-000001
-./finwipe dpd-board --nbfc-id bajaj-finserv \
-  --name "John Doe" --email john@example.com
-```
-
-**What it generates:**
-- Pre-filled Form III complaint
-- Timeline of your deletion requests
-- Legal basis: Section 8(6), DPDP Act 2023
-- Relief sought: deletion + penalty
-
-**How to file:**
-1. Online: https://dpdpboard.gov.in → File Complaint → Form III
-2. Email: complaints@dpdpboard.gov.in
-
-**DPBB Powers:**
-- Order data deletion: Section 27(3)(i)
-- Impose penalty up to ₹250 crore: Section 33
-- Investigate systemic non-compliance: Section 27(4)
-
----
+## ⚖️ Enforcement Commands
 
 ### `finwipe portability`
-Request **all data** an entity holds about you (Section 6(9), DPDP Act).
-
+Request **all data** an entity holds about you (§6(9), DPDP Act). Company must respond in 72 hours.
 ```bash
-./finwipe portability --nbfc-id bajaj-finserv
-./finwipe portability --nbfc-id tata-capital --send
+finwipe portability --nbfc-id bajaj-finserv
+finwipe portability --nbfc-id tata-capital --send
 ```
 
-**Why it matters:**
-- Deletion: "Delete my data" (company may say done, not prove it)
-- Portability: "Give me all data you have" (you verify what they actually hold)
-- Use both: portability first, then deletion
-
-**Company must respond within 72 hours** (Section 6(9))
-
----
-
 ### `finwipe verify`
-Verify if an NBFC actually deleted your data.
-
+Confirm an NBFC actually deleted your data.
 ```bash
-./finwipe verify --request-id DPR-2026-000001
-./finwipe verify --request-id DPR-2026-000001 --method certificate
+finwipe verify --request-id DPR-2026-000001 --method certificate
 ```
-
-**Verification Methods:**
-- `email` — Send verification email asking to confirm deletion
-- `certificate` — Request official deletion certificate
-- `login` — Try to access service (account should fail if deleted)
-
----
+**Methods:** `email` · `certificate` · `login`
 
 ### `finwipe mass-request`
-Send deletion requests to ALL entities in a category with one command.
-
-```bash
-# All fintechs
-./finwipe mass-request --category fintech
-
-# All banks except HDFC and ICICI
-./finwipe mass-request --category bank \
-  --exclude hdfc-bank,icici-bank
-
-# First 10 entities randomly
-./finwipe mass-request --category all --count 10
-
-# Dry run preview
-./finwipe mass-request --category fintech --dry-run
-```
-
-⚠️ **Warning:** You will receive ~90 acknowledgment emails!
-
----
-
-## Automation Commands
-
-### `finwipe cron`
-Daily automation: follow-ups, deadline checks, auto-escalation.
-
-```bash
-# Dry run
-./finwipe cron --dry-run
-
-# Full automation
-./finwipe cron
-
-# Follow-up only
-./finwipe cron --followup
-
-# Check escalation only
-./finwipe cron --escalate
-```
-
-**Cron schedule:**
-- Every morning: Check for overdue acknowledgments (48h+ no ack)
-- Day 3: Send follow-up emails
-- Day 7: Escalate to DPO
-- Day 30: Escalate to DPDP Board
-
----
-
-### `finwipe setup-forward`
-Get your FinWipe cloud inbox for **passive** FI discovery (CRED/Fold model).
-
-```bash
-./finwipe setup-forward
-```
-
-**How it works:**
-```
-Gmail Filter (you set up once)
-  ↓ FORWARDS all financial emails
-Mailgun (free: 5K/month)
-  ↓ RECEIVES emails, extracts sender domain ONLY
-Cloudflare Worker
-  ↓ MATCHES domains → known FIs
-finwipe sync
-  ↓ PULLS discoveries
-finwipe sync --auto
-  ↓ CREATES deletion requests
-```
-
-**Privacy Guarantee:**
-- Email content NEVER received or stored
-- Only sender DOMAIN extracted (not full email)
-- User ID is one-way hash (no PII)
-- Data lives in your KV namespace only
-
----
-
-### `finwipe sync`
-Sync discoveries from FinWipe cloud.
-
-```bash
-# Show discoveries
-./finwipe sync
-
-# Auto-create deletion requests
-./finwipe sync --auto
-
-# Use local emails (offline)
-./finwipe sync --import ~/.finwipe/forwarded/
-```
-
----
-
-### `finwipe check-inbox`
-Parse locally forwarded emails (no cloud required).
-
-```bash
-./finwipe check-inbox
-./finwipe check-inbox --import /path/to/emails/
-```
-
----
-
-### `finwipe cloud-status`
-Check FinWipe cloud connectivity.
-
-```bash
-./finwipe cloud-status
-```
-
----
-
-## Supporting Commands
-
-### `finwipe letter`
-Generate professional PDF deletion letters.
-
+Send to ALL entities in a category at once.
 ```bash
-./finwipe letter --nbfc-id bajaj-finserv
-./finwipe letter --request-id DPR-2026-000001
-./finwipe letter --batch fintech
+finwipe mass-request --category fintech --dry-run
+finwipe mass-request --category bank --exclude hdfc-bank,icici-bank
 ```
+⚠️ You'll receive ~90 acknowledgment emails.
 
----
-
-### `finwipe evidence`
-Attach and manage evidence for deletion requests.
-
+### `finwipe compliance`
+Community compliance rates + shame list.
 ```bash
-# Attach screenshot
-./finwipe evidence attach DPR-2026-000001 \
-  --type email_sent --file screenshot.png
-
-# Attach acknowledgment
-./finwipe evidence attach DPR-2026-000001 \
-  --type email_received --file acknowledgment.eml
-
-# List evidence
-./finwipe evidence list DPR-2026-000001
-
-# Get evidence
-./finwipe evidence get <evidence-id>
+finwipe compliance
+finwipe compliance --shame              # worst offenders
 ```
 
-**Evidence Types:**
-- `email_sent` — Original deletion request email
-- `email_received` — NBFC's acknowledgment
-- `email_bounce` — Email bounce/failure notification
-- `letter_pdf` — Registered post acknowledgment
-- `dpd_board_filing` — DPBB complaint confirmation
-- `rbi_ombudsman_filing` — RBI complaint confirmation
-- `cic_receipt` — CIC in-person filing receipt
-- `screenshot` — Screenshots of interactions
-
 ---
 
-### `finwipe cic`
-Generate pre-filled CIC (CIBIL/Experian/Equifax/CRIF) dispute forms.
+## 🤖 Automation
 
+### `finwipe cron`
+Daily automation: follow-ups, deadline checks, auto-escalation.
 ```bash
-./finwipe cic --bureau CIBIL
-./finwipe cic --bureau Experian --nbfc-id bajaj-finserv
-./finwipe cic --batch
+finwipe cron --dry-run                 # preview
+finwipe cron                           # full automation
 ```
+**Schedule:** Day 3 → follow-up · Day 7 → DPO escalation · Day 30 → DPDP Board
 
----
-
-### `finwipe parse`
-Parse a CIBIL report PDF to extract NBFC names.
-
+### `finwipe wizard`
+Interactive guided flow for first-time users.
 ```bash
-./finwipe parse --file your_cibil_report.pdf
-./finwipe parse --file report.pdf --format text
+finwipe wizard
 ```
 
----
-
 ### `finwipe ask`
-Interactive consent withdrawal wizard — **works without `finwipe init`**.
-
+Quick consent-withdrawal wizard (no `finwipe init` needed).
 ```bash
-./finwipe ask
+finwipe ask
 ```
 
-Answers questions, generates Section 8(7) withdrawal email, shows where to send it.
+### Monthly GitHub Actions
+Fork the repo, add secrets (`SMTP_HOST`, `SMTP_PORT`, `SMTP_USERNAME`, `SMTP_PASSWORD`, `FINWIPE_FULL_NAME`, `FINWIPE_EMAIL`, `FINWIPE_PHONE`, `FINWIPE_ADDRESS`), and the workflow runs `finwipe send` monthly on the 1st.
 
 ---
 
-### `finwipe wizard`
-Interactive guided deletion request flow.
+## 📄 Supporting Commands
 
-```bash
-./finwipe wizard
-```
-
-Step-by-step walkthrough for first-time users.
+| Command | Description |
+|---------|-------------|
+| `finwipe letter` | Generate PDF deletion letters |
+| `finwipe evidence attach` | Attach screenshots/acknowledgments to a DPR-ID |
+| `finwipe cic` | Generate CIC (CIBIL/Experian/Equifax/CRIF) dispute forms |
+| `finwipe parse` | Parse CIBIL report → extract NBFC names |
+| `finwipe update-registry` | Update NBFC registry from awesome-fintech-india |
+| `finwipe setup-forward` | Set up FinWipe cloud inbox for passive discovery |
+| `finwipe sync` | Sync discoveries from FinWipe cloud |
+| `finwipe cloud-status` | Check cloud connectivity |
 
 ---
 
-### `finwipe compliance --shame`
-NBFC shame list — ranks NBFCs by worst compliance rates.
-
-```bash
-./finwipe compliance --shame
-./finwipe compliance --shame --export csv
-```
+## 📊 By the Numbers
 
-Shows:
-- Acknowledgment rate
-- Average response time
-- Number of complaints
-- Recommended action
+| Metric | Value |
+|--------|------:|
+| Version | 0.1.4 |
+| Registry | 91 entities (12 banks · 18 NBFCs · 59 fintechs · 2 HFCs) |
+| Legal basis | DPDP Act 2023 + RBI DLG |
+| npm | [finwipe](https://www.npmjs.com/package/finwipe) |
+| Homebrew | [das-rebel/finwipe](https://github.com/Das-rebel/homebrew-finwipe) |
 
 ---
 
-## Legal Basis
-
-FinWipe invokes:
+## ⚖️ Legal Basis
 
 | Law | Section | Right |
 |-----|---------|-------|
-| DPDP Act 2023 | Section 8(6) | Right to Erasure |
-| DPDP Act 2023 | Section 6(9) | Right to Data Portability |
-| DPDP Act 2023 | Section 27(3) | Complaint to DPBB |
+| DPDP Act 2023 | §8(6) | Right to Erasure |
+| DPDP Act 2023 | §6(9) | Right to Data Portability |
+| DPDP Act 2023 | §27(3) | Complaint to DPDP Board |
 | DPDP Rules 2025 | Rule 8(1) | 48-hour acknowledgment |
 | DPDP Rules 2025 | Rule 8(2) | Deletion within 30 days |
-| RBI DLG 2022 | Para 10.2, 11.1, 11.2 | Data deletion in lending |
-
-Read [docs/REGULATORY_FRAMEWORK.md](docs/REGULATORY_FRAMEWORK.md) for full details.
+| RBI DLG 2022 | Para 10.2, 11.1 | Data deletion in lending |
 
 ---
 
-## What CAN Be Deleted
+## ✅ What Can Be Deleted
 
 ```
 ✓ Marketing and promotional data
@@ -796,7 +310,7 @@ Read [docs/REGULATORY_FRAMEWORK.md](docs/REGULATORY_FRAMEWORK.md) for full detai
 ✓ App activity and preferences
 ```
 
-## What CANNOT Be Deleted
+## ❌ What Cannot Be Deleted
 
 ```
 ✗ KYC documents (PMLA: 10 years post-closure)
@@ -807,109 +321,51 @@ Read [docs/REGULATORY_FRAMEWORK.md](docs/REGULATORY_FRAMEWORK.md) for full detai
 
 ---
 
-## Architecture
+## 📁 Data Location
 
+All data stays local at `~/.finwipe/`:
 ```
 ~/.finwipe/
-├── config.yaml          # Profile + SMTP credentials
-├── history.db           # SQLite WAL — full audit trail
-├── inbox               # FinWipe cloud inbox address
-├── cloud_api_key       # Cloud API key
-├── letters/            # Generated PDF letters
-│   ├── Deletion_[nbfc]_[date].pdf
-│   ├── DPBB_complaint_[nbfc]_[date].pdf
-│   └── Portability_[nbfc]_[date].pdf
-├── evidence/           # Screenshots, acknowledgments
-└── forwarded/         # Local forwarded emails
-```
-
-**Database Schema:**
-```sql
-requests: DPR-ID, NBFC, channel, state, timeline
-escalations: DPR-ID, level, channel, details
-evidence: DPR-ID, type, file, notes, timestamp
+├── config.yaml          # Profile + SMTP
+├── history.db           # SQLite (WAL) — full audit trail
+├── nbfcs.yaml           # Entity registry
+├── letters/             # Generated PDFs
+└── evidence/            # Screenshots, acknowledgments
 ```
 
 ---
 
-## Registry
-
-The NBFC registry is at `data/nbfcs.yaml`. Add new entities:
-
-```yaml
-- id: my-company
-  name: My Finance Company Ltd
-  short_name: MyFin
-  category: nbfc          # bank | nbfc | fintech | hfc
-  grievance_email: grievance@myfin.com
-  grievance_phone: "18001234567"
-  address: "MyFin, Mumbai, MH"
-  active: true
-```
-
----
-
-## Cloud Deployment
-
-Deploy FinWipe Cloud for passive email forwarding:
-
-```bash
-cd apps/finwipe-cloud
-./deploy.sh
-```
-
-**Free tier:**
-- Cloudflare Workers: 100K requests/day
-- Cloudflare KV: 1M reads/day
-- Mailgun: 5K emails/month
-
----
-
-## GitHub Actions Automation
-
-Fork and add secrets for monthly automation:
-
-```bash
-# Secrets needed:
-SMTP_HOST, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORD
-```
-
-Workflow runs `./finwipe send --rate-limit 2000` monthly.
-
----
-
-## The Honest Limitation
-
-FinWipe cannot guarantee NBFCs will respond within 30 days.
-
-It CAN guarantee:
-- ✅ Every request is timestamped
-- ✅ You have evidence of what was sent
-- ✅ You have legal documentation
-- ✅ You can escalate: DPO → DPDP Board → RBI Ombudsman
-
----
-
-## Tech Stack
+## 🛠️ Tech Stack
 
 - **Go 1.21+** — single binary, no runtime deps
 - **Cobra** — CLI framework
-- **SQLite (WAL mode)** — request history
-- **gofpdf** — PDF letter generation
-- **Viper** — config management
+- **SQLite (WAL)** — request history
+- **gofpdf** — PDF generation
+- **Viper** — configuration
 
 ---
 
-## Contributing
+## 🤝 Contributing
 
-PRs welcome. Especially:
-- Adding NBFCs to `data/nbfcs.yaml`
-- New email templates
+PRs welcome — especially:
+- New NBFCs/fintechs in `data/nbfcs.yaml`
+- Email/letter templates in `templates/`
 - Better PDF parsing
 - CIC dispute form improvements
 
 ---
 
+## 📦 Installation Links
+
+| Platform | Command / Link |
+|----------|---------------|
+| **npm** | `npm install -g finwipe` |
+| **Homebrew** | `brew tap das-rebel/finwipe && brew install finwipe` |
+| **GitHub Releases** | [latest](https://github.com/Das-rebel/finwipe/releases/latest) |
+| **Source** | `git clone https://github.com/das-rebel/finwipe` |
+
+---
+
 ## License
 
 MIT — Use it. Modify it. Distribute it. Delete your data.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "finwipe",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "DIY Financial Data Deletion tool for India under DPDP Act 2023. Exercise your right to erasure against NBFCs, banks, and fintechs.",
   "main": "index.js",
   "bin": {
@@ -34,7 +34,11 @@
   "engines": {
     "node": ">=14.0.0"
   },
-  "os": ["darwin", "linux", "win32"],
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
   "files": [
     "finwipe",
     "README.md",

package/templates/emails/deletion_request.txt

@@ -0,0 +1,43 @@
+Subject: Request for Erasure of Personal Data under Section 8(6), DPDP Act 2023 — {{.NBFCName}}
+
+To,
+The Grievance Officer / Data Protection Officer
+{{.NBFCName}}
+{{.NBFCCategory}}
+
+Subject: Request for Erasure of Personal Data under Section 8(6) of the Digital Personal Data Protection Act, 2023 (DPDP Act)
+
+Dear Sir/Madam,
+
+I, {{.FullName}}, residing at {{.Address}}, am writing to exercise my right to erasure of personal data as provided under Section 8(6) of the Digital Personal Data Protection Act, 2023 (DPDP Act).
+
+My details:
+- Name: {{.FullName}}
+- Email: {{.Email}}
+- Phone: {{.Phone}}
+- Request Reference: {{.RequestID}}
+
+I request that {{.NBFCName}} erase all personal data held by your organization relating to me, except such data as may be necessary to retain under any law for the time being in force.
+
+Specifically, I request deletion of:
+{{range .Categories}}- {{.}}
+{{end}}
+
+This request is made under Section 8(6) of the DPDP Act, 2023 and Rule 8 of the DPDP Rules, 2025.
+
+Please confirm receipt of this request within 48 hours as mandated under Rule 8(1) and proceed with the erasure within 30 days of this request.
+
+If you fail to comply with this request within the stipulated timeframe, I reserve the right to escalate this matter to the Data Protection Board of India under Section 27(3) of the DPDP Act, 2023.
+
+Please direct all future correspondence regarding this matter to:
+- Email: {{.Email}}
+- Address: {{.Address}}
+
+Yours faithfully,
+{{.FullName}}
+{{.Email}}
+{{.Phone}}
+
+---
+Request ID: {{.RequestID}}
+Date: {{.Date}}

package/templates/emails/escalation_dpo.txt

@@ -0,0 +1,23 @@
+Subject: Escalation to Data Protection Officer — {{.RequestID}} — No Response to Deletion Request
+
+To: The Data Protection Officer
+{{.NBFCName}}
+
+Dear DPO,
+
+I am escalating my data deletion request (Reference: {{.RequestID}}) as I have not received any acknowledgment or response from {{.NBFCName}} despite multiple follow-ups.
+
+Request Details:
+- Request ID: {{.RequestID}}
+- Original Request Date: {{.RequestDate}}
+- Categories Requested for Deletion: {{range .Categories}} {{.}} {{end}}
+- Nature of Non-Compliance: No acknowledgment within 48 hours under Rule 8(1), no deletion within 30 days under Rule 8(2)
+
+I request your immediate intervention to ensure compliance with Section 8(6) of the DPDP Act, 2023.
+
+I reserve the right to escalate to the Data Protection Board of India if this matter is not resolved within 7 days.
+
+Yours faithfully,
+{{.FullName}}
+{{.Email}}
+{{.Phone}}

package/templates/emails/followup.txt

@@ -0,0 +1,19 @@
+Subject: Follow-up: Erasure of Personal Data — {{.RequestID}} — No Response Received
+
+Dear Grievance Officer / Data Protection Officer,
+
+I am writing to follow up on my earlier request (Reference: {{.RequestID}}) dated {{.RequestDate}} for erasure of my personal data under Section 8(6) of the Digital Personal Data Protection Act, 2023.
+
+As of today, I have not received:
+1. An acknowledgment of my deletion request, or
+2. Confirmation of data erasure
+
+This is a second follow-up. If I do not receive a response within 7 days, I will escalate this matter to the Data Protection Board of India under Section 27(3) of the DPDP Act, 2023.
+
+My original request reference: {{.RequestID}}
+
+Please treat this as urgent.
+
+Yours faithfully,
+{{.FullName}}
+{{.Email}}

package/templates/letters/deletion_request.html

@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+  body { font-family: Arial, sans-serif; margin: 40px; line-height: 1.6; }
+  .header { text-align: center; margin-bottom: 30px; }
+  .title { font-size: 20px; font-weight: bold; text-decoration: underline; }
+  .section { margin: 20px 0; }
+  .section-title { font-weight: bold; text-decoration: underline; }
+  .field { margin: 10px 0; }
+  .field-label { font-weight: bold; }
+  .signature { margin-top: 40px; }
+  .footer { margin-top: 30px; font-size: 12px; border-top: 1px solid #ccc; padding-top: 10px; }
+</style>
+</head>
+<body>
+  <div class="header">
+    <div class="title">APPLICATION FOR ERASURE OF PERSONAL DATA</div>
+    <p>Under Section 8(6) of the Digital Personal Data Protection Act, 2023 (DPDP Act)</p>
+  </div>
+
+  <div class="section">
+    <div class="section-title">To,</div>
+    <p>The Grievance Officer / Data Protection Officer<br/>
+    {{.NBFCName}}<br/>
+    {{.NBFCAddress}}</p>
+  </div>
+
+  <div class="section">
+    <div class="section-title">Applicant Details:</div>
+    <div class="field"><span class="field-label">Name:</span> {{.FullName}}</div>
+    <div class="field"><span class="field-label">Email:</span> {{.Email}}</div>
+    <div class="field"><span class="field-label">Phone:</span> {{.Phone}}</div>
+    <div class="field"><span class="field-label">Address:</span> {{.Address}}</div>
+  </div>
+
+  <div class="section">
+    <div class="section-title">Request Details:</div>
+    <div class="field"><span class="field-label">Request ID:</span> {{.RequestID}}</div>
+    <div class="field"><span class="field-label">Date:</span> {{.Date}}</div>
+    <div class="field"><span class="field-label">Categories for Deletion:</div>
+    <ul>
+    {{range .Categories}}<li>{{.}}</li>{{end}}
+    </ul>
+  </div>
+
+  <div class="section">
+    <p>I hereby request that {{.NBFCName}} erase all personal data held by your organization relating to me, except such data as may be necessary to retain under any law for the time being in force, in accordance with Section 8(6) of the Digital Personal Data Protection Act, 2023.</p>
+  </div>
+
+  <div class="section">
+    <div class="section-title">Legal Basis:</div>
+    <ul>
+      <li>Section 8(6), DPDP Act 2023 — Right to Erasure</li>
+      <li>Rule 8(1), DPDP Rules 2025 — 48-hour acknowledgment requirement</li>
+      <li>Rule 8(2), DPDP Rules 2025 — 30-day deletion requirement</li>
+    </ul>
+  </div>
+
+  <div class="section">
+    <p>Please confirm receipt of this request within 48 hours and proceed with erasure within 30 days. Failure to comply will result in escalation to the Data Protection Board of India under Section 27(3) of the DPDP Act, 2023.</p>
+  </div>
+
+  <div class="signature">
+    <p>Yours faithfully,</p>
+    <p><strong>{{.FullName}}</strong></p>
+    <p>{{.Email}}</p>
+    <p>{{.Phone}}</p>
+    <p>{{.Address}}</p>
+  </div>
+
+  <div class="footer">
+    <p><strong>Request ID:</strong> {{.RequestID}} | <strong>Date:</strong> {{.Date}}</p>
+    <p>Generated by FinWipe — DIY Financial Data Deletion Tool for India</p>
+  </div>
+</body>
+</html>