Security

The short version

• —We never connect to your bank. There are no bank credentials, transactions, or balances in CapKin — ever.
• —Voice audio is transcribed and immediately deleted. We store no audio and create no voiceprints.
• —Your data is encrypted in transit (TLS) and at rest.
• —Each household's data is isolated, and every action is permission-checked on the server.
• —You can export your data or delete your account at any time.

No bank connection, no money movement

CapKin never connects to a bank or card account. There are no bank credentials, imported transactions, or balances in the system — every expense exists only because a household member typed or spoke it in. CapKin also moves no money: there are no payments, transfers, or bill-pay features. There is no financial account to drain and no banking connection to compromise.

Encryption

All data is encrypted in transit using TLS, and encrypted at rest in our database.

Household isolation and server-side permissions

Each household's data is isolated by household ID on every query — one household can never read another's data. Role checks (owner, member, and capture-only child) are enforced on the server on every request, not just hidden in the interface.

A child's entry is saved as pending and counts toward nothing until the household owner approves it. Only the owner can approve or reject entries and manage members, and the server enforces that on every call — the interface is never the only thing standing in the way.

Voice and audio

When you use voice input, the audio is used for one purpose: producing a text transcript. It is held in transient storage only while transcription runs and is deleted the moment it completes. There is no audio table in our database and no audio archive. We create no voiceprints and never use voice to identify anyone. Only the text and the expense items you confirm are saved.

Third parties we rely on

Transcription and expense parsing use the OpenAI API on a tier with data-retention and model-training turned off: content sent for transcription and parsing is not retained by OpenAI or used to train its models. Only the entered text and your household's category names are sent — never account credentials or unrelated personal data. The app and website are hosted on Vercel.

Children

Children's accounts follow the same protections, plus parental control. Only the household owner can create a child account, and we record when and by whom. Voice input is off by default for children, and only the owner can turn it on. The owner can review, export, or delete a child's data at any time. Full detail is on our children's privacy page.

Your data, your control

You can export your household's data from the app at any time. The household owner can delete the household and all of its data, with an explicit confirmation step. See our privacy policy for the full picture of what we collect and why.

Reporting a security issue

If you believe you have found a security problem, email getcapkin@proton.me and we will respond. Please give us a reasonable chance to fix an issue before disclosing it publicly.