Privacy Policy

The short version

• —We collect only what the app needs to work: your account details and the budget data your household enters.
• —We never connect to your bank. There are no bank credentials, transactions, or balances in CapKin — ever.
• —Voice recordings and receipt photos are deleted immediately after transcription or reading. We do not store audio or photos, and we have no audio or photo database.
• —We do not sell your data, and we do not show ads.
• —You can export your data or delete your account at any time.

What we collect

Account data. Your email address, a password (stored only as a hash) or your Google/Apple sign-in, and your language/locale setting.

Household data. What your household sets up and enters in the app: household name, timezone, currency, budget caps, categories, expenses (with the shop and quantity, when you say or scan them), the weekly insights CapKin writes from them and your feedback on those insights, income entries, bills, savings goals, and the display names of household members. This data exists only because a member of your household typed or spoke it in.

Kids' learning activity. If your household uses the kids features, we store the child's entries, savings goals, and activity in the built-in lessons and quizzes. See "Children" below.

Notifications. If you turn on push notifications, we store the browser subscription needed to deliver them. Push is off by default. Email notifications can be switched off in settings.

Product usage events. First-party product analytics, no third-party vendor. We record which parts of the app are used — for example, that a setup step was completed, that an expense was confirmed by voice, or that an invite link was shared — so we can see where CapKin works and where it gets in the way. These events hold counts, settings and internal IDs only: never your email, names, amounts, or what you said or typed. In a child's space we record only that a lesson was completed, a goal was created or an entry was confirmed. Usage events are deleted with your household and included in your data export.

Grocery calculator emails. The grocery budget calculator works in your browser and needs no account. What you spend, your income and your benefits answer stay in your browser: they are never sent to us or emailed. If you ask it to email you the plan, we send one email with the result and keep the household ages, the level and the optional answers that shape the advice (such as region, shopping habits or goal), plus a one-way hash of your address so the same address can't be sent more than a few plans a day. We keep the email address itself only if you tick the box to receive budgeting tips; the unsubscribe link in every tips email deletes it.

Cookies. We use cookies to keep you signed in, plus first-party cookies of our own: a random visitor ID; only when you arrive from a link with a campaign tag or from another website, a note of where you came from (the campaign tags, the referring site's name and the first page you saw); and, only when you choose "Make this your grocery cap" on the grocery calculator, the currency and monthly amounts (groceries, and eating out if you choose to set that cap too) to prefill during setup, kept for up to 7 days. None of them contains your name, email or anything you enter in the app. No advertising or cross-site tracking cookies.

What we do not collect. No bank or card credentials, no bank transactions, no location data, no contacts, no advertising identifiers. CapKin uses no third-party analytics or tracking tools.

Voice input and audio

Voice entry is optional — everything you can do by voice you can also do by typing.

When you use voice input, your browser records audio and sends it to us for transcription. The audio is used for exactly one purpose: producing a text transcript that you see and can edit before anything is saved. The audio is held in memory only while transcription runs and is deleted as soon as it completes. It is never written to our database — there is no audio table. Only the text and the expense items you confirm are kept.

We do not use voice to identify anyone. No voiceprints are created or stored.

Receipt photos

Adults can add spending by photographing a paper receipt. The photo is sent to us once, only to read the items on it, which you then check and edit before anything is saved. It is held in memory only while it is being read and is deleted as soon as reading completes. It is never written to our database — there is no photo table. While you review the items, the photo stays on your device so you can compare. Only the expense items you confirm are kept. Children cannot scan receipts.

How we use your data

We use your data to run the app: showing your household its budget, totals, and history; sending the notifications you asked for; and keeping your account secure. That is the full list. We do not sell data, share it for advertising, or use it to build profiles.

AI processing

Transcription, receipt reading and expense parsing use the OpenAI API (Whisper for speech-to-text, a GPT model for splitting a sentence or a receipt photo into expense items). Only the spoken/typed text or the receipt photo and your household's category names are sent — never your credentials or unrelated personal data. To group the same product across entries and to write the weekly insights, item names, shop names and the household's totals per item and category are also sent — never member names or email addresses. We use OpenAI on an API tier where content is not retained by OpenAI and is not used to train its models.

Children

CapKin includes a "capture-only child" role designed for kids. Here is exactly how it works:

• —Only a parent can create a child account. A child account can only be created by the household owner — an adult who already has a CapKin account. The child cannot sign up on their own. We keep a record of when and by whom each child account was created.
• —What a child account stores: a display name, the expenses the child enters, their savings goals, and their activity in the built-in money lessons and quizzes. We do not ask children for their full name, age, address, or any other personal details.
• —Nothing a child enters counts until a parent approves it. Every child entry is saved as pending and reviewed by the household owner.
• —Voice input is off by default for children. Only the household owner can turn it on for a child, and this deletion policy is shown at that moment. When enabled, it works the same way as for adults: the audio is transcribed and immediately deleted, and no voiceprint is created. Voice never asks for personal information — it is only used to log expenses, as a substitute for typing.
• —No advertising. We show no ads to anyone, and we will never use children's data for advertising of any kind.
• —Parents stay in control. The household owner can review everything a child has entered, turn voice input off at any time, remove the child from the household, and export or delete the child's data (see "Your rights").

Questions about children's data: getcapkin@proton.me.

Who we share data with

We share data only with the services we need to run CapKin:

We will update this list before adding any new provider. We do not share data with anyone else, except if required by law.

Security

Data is encrypted in transit (TLS) and at rest. Each household's data is isolated by household ID on every query, and role checks (owner / member / child) are enforced on the server on every request.

Data retention

Your data is kept while your account is active. When a household is deleted, its data is deleted. Voice audio and receipt photos are deleted immediately after transcription or reading, as described above. An email address given to the grocery calculator for tips is kept until you unsubscribe.

Your rights

• —Export. You can export your household's data from the app.
• —Deletion. The household owner can delete the household and its data; deletion requires an explicit confirmation step. Individual members can leave a household.
• —Children's data. The household owner can review, export, and delete a child's data.
• —Questions and requests. Email getcapkin@proton.me and we will help.

Changes to this policy

If we change this policy, we will update the effective date and, for meaningful changes, tell you in the app.

Contact

getcapkin@proton.me