Privacy Policy

What KinPiggy holds

Who you are. The email address you sign in with, a display name, your language, and your family's base currency. The email is needed to send you a sign-in link and to attach you to the right family.

Your family and its permissions. Who belongs to the family, each person's role, and which buckets and categories each person may reach.

The records you create. Buckets, categories, budgets, expenses and their splits, descriptions and notes, shopping lists, reminders and tasks, projects, and the recurring charges the app has spotted.

What you write to us. Anything you send from the suggestion box, together with the app version and language you were using. Nobody in your family sees it, and it holds nothing about your money unless you write it there yourself.

Bank data, only if you connect a bank. The account name, a masked IBAN, the currency, and the transactions themselves — date, amount, description and counterparty.

A record of changes. An audit log of who changed what and when, so that a family can see how a figure came to be what it is.

What KinPiggy deliberately does not collect

This list is not aspiration. Each item is a decision visible in the code.

No analytics, advertising or tracking. The app contains no third-party analytics, attribution or advertising SDK. Nothing profiles you and nothing about you is sold or shared for advertising.

No bank credentials. You authenticate with your bank. Your credentials never reach us.

No raw provider data. The column that would have held the untouched payload from the open banking provider was removed on purpose. Merchant identifiers, category codes, the payee's registered company name and card fragments are the most revealing thing such a database could contain, and they buy nothing.

No receipt photos. When you photograph a receipt, the text is read on your phone by iOS itself. The image is not uploaded and we never receive it — there is no field on our servers that could hold one.

Receipt text, when you split a bill. To turn that text into a list of items, we may send it — the text, never the image — to a language model run by Anthropic, our processor for this one purpose. It is used to answer that request and is not kept, by us or by them, to train anything. This happens for at most twenty receipts per family per month; beyond that, and with no signal, your phone reads the receipt on its own.

No biometrics. If you lock the app with Face ID, iOS answers yes or no. We never see your face or fingerprint.

Why we hold it

To provide the service you asked for — your account, your family, your records, and the sync between your devices. Legal basis: performance of our contract with you.

To read your bank account, where you have connected one. Legal basis: your explicit consent, given to your bank under PSD2, which you can withdraw at any time.

To keep the service secure and working — the audit log, protection against abuse, diagnosing faults. Legal basis: our legitimate interest in a service that is safe and does not lose your data.

To take payment, where a paid plan applies. Legal basis: performance of our contract, and our legal obligations for tax and accounting records.

We do not use your financial records to make automated decisions about you, and we do not profile you.

Connecting a bank

Bank access goes through Salt Edge, a regulated open banking provider, under PSD2. It is read-only — transactions can be read, money cannot be moved.

Consent lasts 90 days, which is the maximum the law allows without re-authenticating. KinPiggy tracks the date and warns you before it lapses. You can withdraw consent at any time in the app or with your bank; importing then stops.

Transactions already imported are kept when consent expires. That is deliberate: they are part of your budget, and deleting a family's history for an administrative reason would be indefensible. You can still delete them yourself.

Who can see it

Inside your family, only as far as their scope reaches. A member sees the buckets and categories they were given, and no others. Only admins and the owner see the full bank statement. Only the owner can connect a bank or manage members.

These rules are enforced in the database itself, not merely hidden in the app: a member's device cannot fetch data outside its scope even if the app were modified to ask for it.

Outside your family: nobody, except the processors below, and anyone we are legally required to disclose to — which we would resist where we lawfully can, and tell you about unless prohibited.

The processors we use

Supabase — hosting, the database and sign-in links. Your data is held in the West Europe (London) region.

Salt Edge — the regulated open banking provider that reads your bank account, only where you have connected one.

Apple — App Store distribution, and iCloud Keychain if your device stores KinPiggy's key material there under your own Apple account.

Our payment provider — where a paid plan applies, for billing. Card details go to them, not to us.

Each is bound to process data only on our instructions. Where any transfer leaves the European Economic Area it is covered by an adequacy decision or standard contractual clauses.

How long it is kept

Your records are kept for as long as your family uses KinPiggy. We do not expire your history on our own initiative.

When you ask us to delete your account, the family data it owns is deleted with it, and cascades through every table that hangs off it. Backups roll off within 30 days. Records we must keep for tax or accounting are kept for the period the law requires and for nothing else.

Deleting an individual expense, category or bank connection takes effect immediately, and the app tells you what will move before you confirm anything that affects other records.

Children and teenagers

KinPiggy is built so that a young person can record their own spending without seeing the rest of the household's finances. That is a feature, and it carries an obligation.

A child does not sign themselves up: they are invited by the owner of a family, who is expected to be a parent or guardian, and who chooses exactly what that child can see. By inviting a minor, the owner confirms they have the authority to consent on that child's behalf.

We do not knowingly let a person under 16 create a family of their own. If you believe a child has been given an account without the right authority, write to us and we will remove it.

Your rights

Under the GDPR you may ask for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable form. You may withdraw consent for bank access at any time without affecting what came before.

Write to privacy@kinpiggy.com and we will answer within one month. We will not charge you for it and will not make the service worse because you asked.

If you think we have handled your data badly, you may complain to your local data protection authority, or to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), which supervises Quadrazais OÜ.

Security

Traffic is encrypted in transit and data is encrypted at rest by our hosting provider. Access between families, and between members of the same family, is enforced by row-level security in the database rather than by the app being polite about it.

Sign-in is by one-time link, so there is no password of yours for us to lose. You can additionally lock the app with Face ID on your device.

No system is perfect. If a breach affects your data and is likely to put your rights at risk, we will tell you and the supervisory authority within the time the law requires.

Changes to this policy

Any change is posted here with the date at the top updated. If a change materially affects how your data is used, we will tell you in the app or by email before it takes effect.

Questions, or to exercise any right above: privacy@kinpiggy.com.