Privacy Policy

Effective 22 October 2026

Kasaku is built and run by the developer of Kasaku, an individual developer in Indonesia, not a company. I made it to fix my own money tracking and opened it so others can use it too. Your financial data is personal, so this policy explains plainly what is stored, who can see it and how it is deleted.

What is stored

• Account: your name, email address, password (stored only as a secure hash), timezone, language, notification preferences, two-factor and passkey settings, and when you were last active.
• Your records: books, wallets, categories, transactions, transfers, budgets, recurring transactions, debts, contacts, Salary Planner data and the attachments you upload.
• Technical data: your IP address and browser type for your login sessions, and short-lived server logs used to fix errors and stop abuse.

Contacts you record for debts (a name and optionally a phone number) are information about other people. Only add what you need to keep track of your own debts.

How your data is used

Only to run Kasaku for you and the people you share a book with: showing balances and reports, sending the reminders and alerts you turned on, and keeping your account secure. There are no ads, no analytics or tracking tools, and your data is never sold or shared for marketing.

Who can see your data

• You, and the members of a shared book, according to their role (owner, member or viewer). Your personal book is only visible to you.
• The admin pages of Kasaku only show counts (for example how many books an account owns or how much storage it uses), never your transactions, balances or notes.
• Honestly: whoever runs the server can technically read the database, and that is me. I commit not to look at your financial records, except when you ask me for help with a technical problem or when Indonesian law requires it.

Services that help run Kasaku

• Hosting: your data is stored on a rented server (VPS).
• Email delivery (Brevo): receives your email address and the content of emails sent to you, such as verification, password reset, invitations and the reminders you opted in to.
• Exchange rates (Frankfurter, based on European Central Bank data): only currency codes and dates are requested, never your amounts or personal data.

A Telegram bot and receipt scanning with AI are planned. Both will be optional; this policy will be updated and receipt scanning will ask for your consent before any image is sent to an AI provider.

Cookies

Only the cookies needed to sign you in and protect forms (session, "remember me" and security tokens). Your theme choice is kept in your browser. There are no tracking or advertising cookies.

How long data is kept

• Transactions and transfers in the Trash are deleted permanently after 30 days.
• A deleted shared book can be restored for 30 days, then it is deleted permanently with its attachments.
• The activity log of shared books keeps 12 months of history.
• Backups are kept for at most 30 days.

Deleting your account

You can delete your account at any time in Settings. When you do:

• Your account and your personal book, with all its records and attachments, are deleted permanently right away.
• Shared books you own are deleted too unless you hand them to another member first. Their members are told by email and have 30 days before the book is gone for good.
• Records you added to books owned by someone else stay in those books, because they belong to that book. They are shown as made by "Deleted user".
• Copies in backups disappear as old backups are removed, so within 30 days nothing of your deleted data remains.

Security

Connections use HTTPS, passwords are hashed, two-factor authentication and passkeys are available, attachments are private files only members of the book can open, and backups are encrypted and stored in a separate location. No system is perfectly secure; if a breach ever affects your data, I will tell you by email as soon as I know, together with what happened and what to do.

Your rights

In line with Indonesia's Personal Data Protection Law (UU PDP), you can see and correct your data in the app, export your transactions as CSV from Reports, delete your account, and ask me any question about your data at no-reply@emtwnty.my.id.

Age

Kasaku is meant for people aged 17 or older.

Changes to this policy

If this policy changes in a way that matters, you will be told by email or in the app before the change takes effect. The date at the top always shows the current version.

Contact

Questions or requests about your data: no-reply@emtwnty.my.id.