Privacy Policy

1. Who we are

KoinKount (“we,” “us”) is a personal and social finance web app (including installable PWA) that helps friends track shared expenses, balances, and settlement status. We do not move money between bank accounts or process card payments for settlements. This Privacy Policy explains what personal information we collect, why, and your choices.

Contact: privacy@koinkount.com

2. Information we collect

• Account data — name, email address, password hash (email signup), profile image/avatar, preferred currency, locale, timezone, and privacy settings.
• Authentication data — if you sign in with Google, we receive identifiers and profile information from Google under their policies, and may store OAuth tokens needed to keep you signed in.
• Expense & group data — expenses, splits, categories, notes, group membership, and receipt images you upload.
• Settlements & ledger — amounts, currencies, status, optional method labels (e.g. “venmo” as a bookkeeping label only), notes, and optional proof URLs. Personal ledger, budgets, and goals you create.
• Social graph — friend requests, friendships, and related notifications.
• Communications — transactional emails (e.g. settlement requests, reminders, friend requests, password reset) and, if you enable them, web-push notification endpoints.
• Technical data — IP address and basic request metadata as processed by our hosting and security systems; session cookies and similar storage required to authenticate you; optional local preference storage (e.g. cookie-banner choice).
• Audit records — limited logs of sensitive actions (such as settlement create/confirm and friend requests) for security and abuse prevention.

We do not collect bank account numbers, card numbers, government IDs, or precise GPS location. We do not operate advertising trackers or sell personal information.

3. How we use information

• Provide and operate the Service (accounts, splits, balances, settlements, friends, goals).
• Authenticate you and keep sessions secure (including PWA/JWT refresh where used).
• Send transactional email and optional push notifications you enable.
• Convert display currencies using third-party exchange-rate data (approximate; for display only).
• Prevent fraud, abuse, and security incidents; comply with law.
• Respond to support requests and improve reliability.

We do not use your data for third-party advertising. We do not send marketing emails unless we later offer an explicit opt-in and update this Policy.

4. Legal bases (EEA/UK users)

Where GDPR/UK GDPR applies, we process data based on: contract (to provide the Service you request); legitimate interests (security, abuse prevention, product reliability — balanced against your rights); consent (optional push notifications; any future marketing); and legal obligation when required.

5. Cookies & similar technologies

We use essential cookies and similar storage for authentication and to remember your cookie-banner choice. These are required for the logged-in app to work. We do not currently use non-essential analytics or marketing cookies. If we add them later, we will update this Policy and the banner and obtain any required consent.

6. Sharing & processors

We share personal information only as needed to run the Service:

• Hosting / infrastructure — e.g. Vercel and our database provider (PostgreSQL).
• Auth — Google (if you choose Google sign-in); NextAuth session infrastructure.
• Email — Resend for transactional messages.
• File storage — Cloudinary (or equivalent) for receipt uploads in production.
• Exchange rates — third-party FX APIs for display conversion (not linked to settle money movement).
• Other users — friends and group members see information you share in context (e.g. expenses, balances, settlement status, profile name/avatar as configured).
• Legal — if required by law, valid legal process, or to protect rights, safety, and the Service.

A future Premium subscription may use a payment processor (e.g. Stripe) for subscription billing only — not for friend-to-friend settlement rails. That processor’s terms and privacy notice would apply to payment details they collect.

7. Retention

We retain account and financial bookkeeping data while your account is active and as needed for legitimate business, security, and legal purposes. You may request export or deletion (see below). Some records may remain in backups or audit logs for a limited period after deletion. Settlement and group constraints may delay full deletion until pending obligations are resolved, as disclosed in-product.

8. Your rights & choices

• Access / export — request a copy of your data via in-app settings or privacy@koinkount.com.
• Deletion — request account deletion in settings (subject to unsettled balances / pending settlements where applicable).
• Correction — update profile and preferences in the app, or contact us.
• Push / email — disable push in browser/device settings; transactional emails are necessary for core features (e.g. password reset). You can leave groups and unfriend to reduce social sharing.
• California / similar US state laws — we do not sell or “share” personal information for cross-context behavioral advertising. You may exercise access, deletion, and non-discrimination rights by contacting us.
• EEA/UK — you may have rights to access, rectify, erase, restrict, port, and object, and to lodge a complaint with a supervisory authority.

9. Security

We use industry-standard measures appropriate to a consumer web app (encryption in transit, hashed passwords, session controls, rate limits). No method of transmission or storage is 100% secure. Report suspected incidents to privacy@koinkount.com.

10. Children

The Service is for users who are at least 18 years old. We do not knowingly collect personal information from children under 13. If you believe we have, contact us and we will delete it promptly.

11. International transfers

We may process data in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards (such as standard contractual clauses) offered by our processors.

12. Changes

We may update this Policy. We will post the revised version with a new effective date. Material changes may also be communicated in-app or by email when appropriate. Continued use after the effective date means you accept the updated Policy.