Privacy Policy

Who we are

Keptify is provided by [LEGAL NAME], [ADDRESS/COUNTRY] ("we", "us"). We are the controller of the personal data described in this policy. You can contact us about privacy at [CONTACT EMAIL]. Our data protection officer is the owner of Keptify, reachable at the same address.

This policy covers the Keptify website, the Keptify web app and the Keptify iPhone and Android apps.

What Keptify is

Keptify is a personal record-keeping tool. It never connects to your bank, never reads your bank accounts and never holds or moves money. Every balance in Keptify is a number you entered yourself.

What we collect

• Account details: your email address and a password. Passwords are stored only as a secure hash by our authentication provider; we can't see them. If you choose Google or Apple sign-in, we receive your email address, your name and profile picture (if shared) and an account identifier from that provider.
• Records you enter: accounts, balances, transactions, categories, budgets, bills, goals, contributions, payday plans, balance checks, rollover history, notes and payee names, and your settings (such as currency and appearance). This is financial information about you, so we treat it with extra care.
• Subscription details: your plan, trial dates, renewal and end dates, and payment events (for example "subscription started" or "payment failed") sent to us by Paddle, Apple, Google or RevenueCat. We never receive or store your full card details.
• Technical data: like any online service, our hosting and database providers process technical information such as IP addresses, device and browser type, and request logs, so they can deliver the service and keep it secure.

We don't ask for, and you shouldn't enter, bank login details, card numbers or other credentials in Keptify.

What we don't do

• No analytics, advertising or tracker scripts.
• No selling or renting of your personal data, and no sharing for advertising.
• No profiling or automated decisions that have legal or similar effects on you.
• No access to your bank accounts.

Why we use your data and our legal basis

• To provide Keptify: create your account, store and sync your records across your devices, and show your totals and reports. Legal basis: performance of our contract with you.
• To manage your plan: start trials, check whether you have Keptify Plus, and handle subscriptions. Legal basis: performance of our contract with you.
• To send service emails: account confirmation, password reset, email-change confirmation and important notices about the service or these terms. Legal basis: performance of our contract with you. We don't send marketing emails.
• To keep Keptify secure and working: prevent abuse, investigate problems and protect accounts. Legal basis: our legitimate interest in running a secure service.
• To keep a record of payment events for accounting and to resolve disputes. Legal basis: our legitimate interests and, where it applies, a legal obligation.
• For users in Egypt: we process your financial records with your explicit consent, which you give when you create an account. You can withdraw it at any time by deleting your account.

Storage on your device

The web app keeps a read cache of your records in your browser (IndexedDB) so screens open quickly, and stores your sign-in session. A service worker caches the app's own files, fonts and images so it can open offline. These are strictly necessary for the service. The cache is cleared when you sign out. We don't use advertising or analytics cookies.

We don't track you across sites, so browser Do Not Track signals don't change anything.

Who we share data with

Some providers process data for us, on our instructions (processors): Supabase, Cloudflare, RevenueCat and Resend. Others receive data as independent controllers under their own privacy policies: Paddle (as merchant of record), Apple and Google (app stores and optional sign-in).

• Supabase: database, sign-in and live sync. Data is stored in the Frankfurt (EU) region.
• Cloudflare: website and app hosting and content delivery.
• Paddle: web checkout and subscriptions. Paddle is the merchant of record for web purchases, so it collects your payment details and billing information under its own privacy notice.
• Apple and Google: in-app subscriptions in the iPhone and Android apps, under their own privacy policies. RevenueCat validates those subscriptions for us.
• Resend: sending account and service emails.
• Google and Apple: sign-in, only if you choose to use them.

Households: if you start or join a household, the other people in it can see and change the household's records, and see your name, your email address and which transactions you added. Your records in My money stay private to you. If you leave or are removed, what you added stays in the household; if the household is deleted, its records are deleted for everyone.

We may also disclose data if the law requires it, to protect people's rights or safety, or as part of a sale or reorganisation of the business, in which case this policy would continue to protect your data.

International transfers

We are based in Egypt, and your data may be accessed from Egypt to run and support Keptify. Your records are stored with Supabase in Frankfurt (EU).

Some of our providers may process data outside your country, including outside the UK and European Economic Area. Where that happens we rely on appropriate safeguards, such as adequacy decisions or Standard Contractual Clauses (with the UK Addendum where relevant), and on the providers' own security commitments.

How long we keep data

• Your records: for as long as your account exists. When you delete a record, it is deleted from your account. When you delete your account, your account and every record are permanently deleted.
• Our database provider doesn't keep separate backups of your records on our current plan, so deleted data is gone straight away.
• Payment-event log: 7 years, so we can meet tax and accounting obligations and resolve disputes.
• Technical logs: our database provider keeps them for 1 day. Our hosting provider keeps its own logs under its own retention terms.
• Paddle, Apple and Google keep their own payment records under their own policies.

Security

Data is encrypted in transit. Row-level security in our database means each signed-in person can read and change only their own records. We use security headers and keep secrets out of our code. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach where the law requires it.

We don't look at your records except when you ask us for help, to fix a problem affecting your account, or where the law requires it.

Backups you export from Keptify are unencrypted JSON files. Keep them somewhere private.

Your rights

Depending on where you live, including under the UK GDPR, the EU GDPR and Egypt's Personal Data Protection Law (Law No. 151 of 2020), you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent where we rely on it; and
• complain to a data protection authority, such as the UK Information Commissioner's Office, your local EU authority or Egypt's Personal Data Protection Center.

Many of these you can do yourself: edit any record, export a full JSON backup or CSV from Settings, and delete your account and every record from Settings → Account. For anything else, email [CONTACT EMAIL]. We'll reply within one month and may need to confirm your identity first.

Children

Keptify is not intended for children. You must be at least 18 to create an account.

Changes to this policy

If we make a material change, we'll tell you in the app or by email before it takes effect. The date at the top shows when this policy last changed.

Contact

[LEGAL NAME], [ADDRESS/COUNTRY]. Email: [CONTACT EMAIL].