Privacy Policy
Last updated:
Kachá is a personal budget, habits, tasks and shared-expenses app for iPhone. This policy explains what we store, why, who handles it, and what control you have.
Who is responsible
Camilo Aguilar León, an individual in Colombia, develops Kachá and is responsible for the data described here ("we"). Contact: team@wearekacha.com.
What we collect
When you create an account and use Kachá we store:
- Your email address, first and last name, phone number (with country code) and account ID, to sign you in, reset your password, show your name to the people you share expenses with in Split, and keep your data separate from everyone else's. We ask for the phone number when you create your account; it is stored as you typed it and is not verified, and we do not use it to contact you or for anything else today. If you sign in with Apple or Google, they tell us your email address and, the first time, your name. We never receive your Apple or Google password.
- Financial information you type in: accounts, transactions, categories, labels, templates, scheduled payments, saved filters, dashboard widgets and the currencies you enable. Kachá does not connect to your bank.
- Other content you create: habits and their entries, notes and reminders, task lists, tasks with checklists and reminders, and your preferences.
- Shared expenses (Split): the groups you create or join, their expenses, payments, currencies and activity, and the names of the people in them, including names you type for people who have no account. Enter only what the person would expect.
All of this is linked to your account.
Why
One purpose: making the app work, which means signing you in and keeping your data in step across the devices where you sign in.
Where it lives and who handles it
- Supabase runs the database and the sign-in system, in Amazon Web Services' US East (Ohio) region.
- Kachá's own server, which runs on Amazon Web Services in the same region, sits between the app and the database. It sees each request and keeps technical logs (such as the IP address and a hashed account identifier, never the content of your data) for 30 days.
- Resend delivers the 6-digit code we email you when you create an account.
- Apple or Google handle your sign-in if you choose them.
- Cloudflare provides the DNS for wearekacha.com and, when we turn it on to protect sign-up from automated abuse, a CAPTCHA check (Turnstile) that may process technical information from your device, such as its IP address.
- When you refresh a currency rate, the app sends only the three-letter code of your main currency to a public exchange-rate service (open.er-api.com).
Each provider acts only for the purpose above. Your data is therefore processed in the United States. Kachá contains no analytics, advertising or tracking software, this website uses no cookies, and we do not sell your data.
Shared expenses
The other members of a Split group can see that group's expenses, payments, activity, the names in it and the display name you set there. They do not see the rest of your account.
Friends
Kachá has a list of friends that you use to choose the people you share a joint account or a Split group with. A friend is someone who accepted you, or whom you accepted, in the app, and either of you can end it at any time. Your friends see your display name. Your email address is shown only to your accepted friends, in the lists where you choose people. It is not shown to someone who only shares a Split group or a shared account with you, to someone whose request you have not accepted, or to anyone you blocked or removed. Your phone number is never shown to anyone. When you join a Split group or a shared account through someone's invitation, you and the person who invited you become friends at once, and the app tells you so.
People you invite
You can add someone who has not accepted you yet to your people, with a name you choose and their email address (for example from your phone's contacts, which you pick one at a time: Kachá never reads your address book). The address is personal data of that person, and it is kept only for you: it is stored on our server so that, when they join with the same verified email, what you recorded with them moves to their account; it is visible only to you, never to the other members of your groups (who see the name you gave and that the person has not accepted yet), never in notifications, exports or activity, and never matched against anybody who has not accepted an invitation from you. It is deleted as soon as the person joins and is claimed, when you merge or delete them, when you cancel it, or when you delete your account. Kachá does not send them any email: you share a link or a code yourself. Kachá no longer lets anyone look up or find an account by email address. If you hold an address that someone did not give you and they want it removed, they can write to the contact below and we will delete it.
Security
Data is encrypted in transit (TLS) and at rest on the servers. Access rules let each account read only its own data and, in a Split group, only that group's data and only while a member.
On your phone, the app keeps its working copy of your data in storage protected by iOS data protection: it is encrypted on the device and cannot be read until you unlock the phone for the first time after it restarts. That copy is not included in iCloud or computer backups of your phone, so a new phone downloads your data from our server when you sign in. If you turn on App Lock, Kachá asks for Face ID, Touch ID or your passcode. Widgets and the app switcher hide amounts while the phone is locked or the screen is being recorded, and Split notifications hide names and amounts while App Lock is on.
Retention and deletion
Your data is kept while your account exists. Items you delete stay on the server, marked as deleted, so your other devices remove them too, until you delete your account.
You can delete your account in Settings, Delete Account (see how to delete your account). That permanently deletes your account and the data stored with it on the server and erases it from that device; if you signed in with Apple, we also revoke Kachá's access in your Apple ID; your email address and phone number become free for a new account. What you shared with other people in Split stays in their groups so their balances remain correct, under the name "Former member"; nothing else of your account remains. We keep only a record that an account with a given internal ID was deleted, and when.
We keep daily backup copies of the database for disaster recovery, on the developer's encrypted computer. Old copies are rotated out, but one copy per month is kept longer, so a deleted account can remain in a backup copy until it is rotated out. We never restore a deleted account into the service.
Your choices and rights
You can view, correct and delete your data in the app at any time, and export it from Settings, Your data. To ask for anything else, write to team@wearekacha.com; we answer within 15 business days.
Under Colombian data-protection law (Ley 1581 de 2012 and its regulations) you have the right to know, update and rectify your personal data, to ask for proof of your authorization, to be told how your data is used, to revoke your authorization and ask for deletion, and to complain to the Superintendencia de Industria y Comercio. If you live elsewhere and your local law gives you more rights, write to the same address and we will answer.
Children
Kachá is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes we will update this page and its date.