Privacy Policy

Last updated: 8 October 2026

1. What data we process

• Account: email and name, to authenticate you (through Supabase).
• Financial data you enter: transactions (amount, category, date, note), budget, goals and shared expense groups. We use them only to provide the service: never for advertising or to build profiles for commercial purposes.
• Subscription: your subscription status, through RevenueCat and Apple. We do not process your card details: payment is handled entirely by Apple.
• Notifications: your device’s push token, only if you turn on notifications.
• App usage: product events linked to your account —which screens you open or whether you complete a purchase— to understand what works and what doesn’t. These events do not include amounts, notes, account names or any other financial data.
• Usage before you have an account: the welcome screens happen before you sign up, so to see where people get stuck we use a random identifier that your own app generates and stores only on your device. It does not come from any system identifier, is not shared with other apps, disappears if you uninstall Kpital and cannot be used to track you anywhere else. If you go on to create an account, those events become linked to it; if you don’t, nothing identifies you.
• Visits to this website: we count visits to kpital.app with Vercel Web Analytics —which pages are viewed, which site you came from, country, browser and device type— in aggregate. It uses no cookies, does not store your IP address and cannot identify you or track you across websites.

2. Why we use it and on what legal basis (GDPR)

• Providing the service and its features — performance of a contract.
• Sending the notifications you turn on — consent, which you can withdraw at any time in the system settings.
• Security, abuse prevention and compliance with legal obligations — legitimate interest and legal obligation.
• Understanding how the app is used in order to improve it — legitimate interest. It is our own, minimal, ad-free measurement: we do not combine this data with third parties or build commercial profiles. You can object by emailing us.

3. Who we share it with

Only with providers acting as data processors on our behalf:

• Supabase — database and authentication.
• Render — API hosting.
• Vercel — hosting of this website and aggregate visit statistics.
• RevenueCat and Apple — subscription and payment management. We share your email and name with RevenueCat so we can identify your subscription and help you if something goes wrong with a charge. We do not process your card details. If you request a refund from Apple, Apple may ask us about how your account has been used; in that case we share, through RevenueCat, data such as your account age, your app usage and previous purchases or refunds. Never your amounts or transactions.
• Expo — push notification delivery.

We do not sell your personal data or share it for advertising purposes.

4. Retention

We keep your data while your account is open. If you delete it, we delete your personal data, except for anything the law requires us to keep. To prevent abuse of the free trial, we keep for up to 365 days a pseudonymised proof (HMAC) that an email address has already used the trial; it does not store the email in plain text or any financial data.

Usage events from before sign-up are the exception, because there is no account to close: if you never create one, they are deleted automatically after 90 days.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability. For erasure you don’t need to write to anyone: you can delete your account and all your data from within the app, in More → Delete account and data.

For everything else, write to support@kpital.app. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

6. Security

Connections are encrypted, data is encrypted at rest and access is restricted at the database level so that nobody can read another person’s data. The app also lets you lock access with Face ID. No system is infallible, but we apply reasonable, up-to-date industry measures.

7. Children

Kpital is not intended for children under 16 and we do not knowingly collect data from people below that age.

8. Changes

If we update this policy, we will publish the current version here and change the date at the top.

9. Contact

support@kpital.app

This is a translation of the Spanish version. If the two differ, the Spanish version prevails.