Privacy Policy

Last updated: 17 October 2026

1. Introduction

This Privacy Policy explains what personal data Kippu collects, why we collect it, how we use it, and the rights you have over it. We’ve written it in plain language. Where a technical or legal term matters, we explain what it means.

If anything here is unclear, email support@kippu.co.

2. Who is responsible for your data

The data controller — the entity that decides how and why your data is processed — is Sigitur, operator of Kippu.

Sigitur does not have a formal Data Protection Officer (we’re small enough that GDPR doesn’t require one). The privacy contact is Luis Tenorio, reachable at support@kippu.co.

3. What we collect, and why

We try to collect the minimum data needed to run Kippu. Here’s the complete list:

Account data (required):

• Email address — used to sign you in, send service emails, and contact you about your account. New accounts confirm their email address by clicking a link we send before using the app.
• Name — shown in the app and used to personalize emails
• Age confirmation — at signup you confirm you’re 16 or older; we store only the date and time of that confirmation. We don’t collect your date of birth.
• Password hash — we use bcrypt, a modern password-hashing algorithm. We never store or see your plaintext password.

Financial data you enter:

• Wallets, transactions, categories, budgets, and any notes or attachments you add
• This is your data. We process it to give you the app’s features back — balances, summaries, charts. We don’t analyze it for any other purpose.

Payment data:

• Handled by Stripe. We never see or store your card numbers. Stripe shares with us only what we need to show you your subscription in Kippu: subscription status, billing history metadata, and partial card details (last four digits, card brand).

What we log:

Besides what you record yourself, these are the records our servers and Mailgun keep about your use of Kippu. Kippu needs all of them to run, so none can be switched off. Section 9 says how long each is kept.

• The server’s log — when something fails, our server notes what failed, when, and your account’s ID. An entry can include data the failing request carried, such as a description, an amount or an email address, and IDs like your Stripe customer number.
• Visits — for each page you load, our web server notes your IP address, the page’s address, your browser and the time, for security and troubleshooting.
• Sessions — a random identifier in a cookie keeps you logged in (section 7). Each session record on our server holds your IP address and your browser’s name, whether you’re logged in or not.
• Background tasks that fail — if a task like an import or an email fails, its details are kept so we can look into it, including the address an email was going to.
• Limits against abuse — to slow down password guessing and repeated emails, we count attempts by email address and IP address.
• Your exports — when you prepare an export, we note when, and keep the file for 7 days.
• Emails we send you — Mailgun, which delivers them, keeps a record of each delivery: the address, the subject and the time.
• Counts across all accounts — we count totals over everyone’s stored records and plan status, such as how many accounts use recurring transactions or are in a trial, to run Kippu. They’re worked out from what’s already stored; nothing new is kept.

These records stay on our own servers and with Mailgun. None of them is sent to Google, Meta, Mixpanel, or any other analytics or advertising company.

Support communications:

• If you email us, we keep the thread so we can help you and refer back to it if you reach out again. Retained for up to two years after last contact.

4. What we don’t collect or do

We think it’s worth being explicit about what Kippu doesn’t do, because these absences are part of why we exist:

• No Google Analytics, Facebook Pixel, or third-party analytics of any kind. Kippu ships with zero third-party trackers.
• No record of which features or screens you use, and no recordings or replays of your sessions. If we ever start recording how features or screens are used, we’ll email you 30 days before we do.
• No advertising networks. We don’t run ads and we don’t send your data to ad platforms.
• No profiling for advertising or marketing. We don’t build profiles of users to target ads, sell segments, or market to you based on your behavior — internally or externally.
• No selling or sharing your data. Not to data brokers, not to marketers, not to anyone. This is a standing commitment, not a policy we reserve the right to change.
• No training AI models on your data. Your financial data is not used to train or fine-tune any machine learning model.

The open- and click-tracking that Mailgun would normally add to transactional emails is disabled on our account.

5. Legal bases for processing (GDPR)

Under the GDPR, we rely on the following legal bases:

• Contract performance — for account data, financial data you enter, and payment processing. We can’t deliver the service without this.
• Legitimate interests — for the logs and records in section 3, fraud prevention, and counts across all accounts. Our interest is running a safe, working service; we’ve balanced it against your rights and we use minimal data, never shared with third parties for analytics or advertising.
• Legal obligation — for retaining billing records required by tax law.
• Consent — if we ever send non-essential marketing communications (we currently don’t). You can withdraw consent at any time.

6. Who we share data with (subprocessors)

We use a small number of service providers to run Kippu. Each one processes only the data needed for their specific function. Here’s the complete list:

This list last changed on 17 October 2026.

If you turn on the local currency guess, we work out your country from your IP address with a database file on our own server (MaxMind’s GeoLite2). Your address isn’t sent to MaxMind or anyone else.

If we add any new subprocessor, we’ll update this list and notify you by email at least 30 days in advance.

7. Cookies

Kippu sets two cookies, both strictly necessary:

• kippu-session — a session identifier that keeps you logged in. Expires after 120 minutes of inactivity. HttpOnly, SameSite=Lax, Secure in production.
• XSRF-TOKEN — a security token that prevents cross-site request forgery. Required for forms to work safely.

We don’t set analytics, advertising, or tracking cookies of any kind, which is why we don’t show a cookie consent banner — there’s nothing to consent to beyond what’s strictly necessary for the service to function.

When you pay, Stripe’s hosted checkout page (not ours) sets its own cookies for fraud prevention. We don’t control those; Stripe’s cookie notice explains them.

8. International data transfers

Our servers are in Singapore, and our backups are in the United States. If you’re in the European Economic Area, United Kingdom, or another region with data protection laws, your data is transferred outside your region when you use Kippu.

We rely on Standard Contractual Clauses with our subprocessors where required. Singapore’s Personal Data Protection Act (PDPA) also provides meaningful safeguards.

9. How long we keep your data

• Live account data — retained for as long as your account exists. Deleted within 30 days of account closure.
• Encrypted backups — rotated out within 90 days. They also hold copies of the database records in section 3. Deleted data may persist in an encrypted backup for up to 90 days after you close your account, then is permanently destroyed.
• Billing and tax records — retained for the period required by tax law (typically up to seven years for US records), then deleted.
• What we log (section 3):
  • The server’s log — 30 days.
  • Visits — up to 15 days.
  • Sessions — deleted within 3 hours of your last activity.
  • Background tasks that fail — 30 days.
  • Limits against abuse — each count lasts between a minute and a day.
  • Your exports — the file is deleted after 7 days, and we keep only the note of your latest export.
  • Emails we send you — Mailgun keeps its record of each delivery for up to 30 days.
  • Counts across all accounts — worked out from what’s already stored; nothing new is kept.
• Support emails — up to two years after our last exchange.

10. Your rights

Under the GDPR and similar laws, you have the following rights:

• Access — ask us what data we hold about you
• Rectification — correct inaccurate data; most fields you can edit yourself in your account
• Erasure (“right to be forgotten”) — ask us to delete your data; see the Retention section for how this works with backups and legal records
• Restriction — ask us to stop processing while we resolve a dispute
• Portability — receive your data in a structured, machine-readable format (you can do this yourself via the export feature; we provide CSV + JSON)
• Objection — object to processing based on legitimate interests, including the logs in section 3
• Withdraw consent — where we rely on consent, you can withdraw it any time

If you’re in the EEA or UK, you also have the right to complain to your national data protection authority.

11. How to exercise your rights

Email support@kippu.co with your request. We respond within 30 days — usually sooner. For identity verification, we’ll typically need the request to come from the email address on your account.

There’s no charge for a reasonable request. If a request is clearly excessive or repetitive, we may decline or charge a reasonable fee; we’ll explain why if we do.

12. Children

Kippu is not for children under 16. At signup we ask you to confirm you’re 16 or older, and we keep only the date and time of that confirmation. We don’t collect a date of birth.

If you believe a child under 16 has created an account, email support@kippu.co and we’ll delete it. We don’t knowingly collect data from children under 16, and if we discover we have, we remove it.

If you’re 16 or 17, we ask that you have your parent or guardian’s permission before signing up, as our Terms require.

13. Security

We take practical, reasonable measures to protect your data:

• All traffic is served over HTTPS (TLS 1.2 or higher)
• Passwords are hashed using bcrypt — we never store them in plaintext
• Backups are encrypted at rest
• Database credentials, API keys, and secrets are stored in environment configuration, not in code
• We limit access to production systems to a small number of people with a legitimate need
• We keep our dependencies up to date

No system is perfectly secure, but we take this seriously and work to keep current with good practice.

Who at Kippu can see your data

Today one person can see account data: Luis Tenorio, who runs Kippu. He has full access to the server and the database, which hold everything in section 3, and uses it only to run Kippu, fix it, or act on a request from you. He never copies the database off the server; the only copies elsewhere are the backups in section 9.

14. Data breach notification

If we discover a data breach that’s likely to pose a meaningful risk to you, we will:

• Notify you by email without undue delay
• Notify the relevant supervisory authority within 72 hours where GDPR applies
• Explain what happened, what data was affected, what we’re doing about it, and what you should do

15. Changes to this policy

If we make material changes — for example, adding a new subprocessor or changing how we use data — we’ll email you at least 30 days before the changes take effect. Smaller clarifications are made with just a “Last updated” date change.

16. Contact

Privacy questions or requests: support@kippu.co