Privacy Policy

What we collect

• Your account. When you sign in with Google we receive your name, email address and Google account ID. We don't receive your Google password and don't store your profile photo. We also keep your time zone, currency and language, and when you agreed to the Terms of Service and to which version.
• Your data password. We never receive your password or your recovery code. We keep a locked copy of your data's key that only they can open, the settings your browser uses to turn your password into a key, your privacy level, and how many wrong passwords were tried in a row, to slow down guessing.
• What you put in. Your accounts (where you keep money) and their balances, planned income and your split, subcategories, transactions and their notes, labels, bills and reminders, and debts, including the names of the people you lend to or borrow from. Notes and names are whatever you type, so record only what you need.
• Receipts. Photos and PDFs you attach to transactions. Photos are saved again without their hidden metadata, including location. PDFs are stored as you uploaded them.
• Devices for reminders. If you turn on reminders (for bills, goals or income): your browser's push address and keys, and a device name such as "Chrome on macOS".
• Raku, the assistant. What you write or say to Raku, the photos you send it and the cards it prepares for you to confirm. Voice notes are turned into text and the recording isn't kept. Conversations are kept for 30 days after their last message, and Settings → Raku → Clear history deletes them sooner. They aren't part of backups.
• Connections you create. For AI assistants (MCP): each token's name, access level and dates; the token itself is stored only as a one-way hash. For Telegram: your Telegram user ID, username, display name and chat ID.
• Technical data. A sign-in cookie, and server logs of errors and AI-assistant actions, which record internal account and token IDs. Our logs don't record IP addresses, amounts or notes. For receipt scans and Raku we record the AI model used, its token count and cost, not what you sent.
• Usage analytics. PostHog counts visits to the public pages and which features are used in the app: the pages you open and what you do there, such as adding a bill or turning on reminders, and, if something breaks, an error report with addresses, numbers and IDs removed from the message. It gets only the kind of page (for example "a goal") and the kind of action (for example "a bill added"), plus your browser and device type, screen size, language and time zone: never amounts, names, notes, record IDs or your email. For everyone, this is anonymous: no cookies and nothing stored in your browser. To tell visits apart, PostHog makes a hash of the day, your browser, your IP address and our site, then discards the IP address, so it can't recognise you on another day or another device. Our server passes your IP address to PostHog for that, never your cookies, and we've set PostHog to discard IP addresses and not to look up your location. Linked to your account, only if you turn it on in Settings → Privacy: PostHog then knows you by your random account ID, so what you do on your devices and through Telegram, Raku, the iPhone Shortcut and connected AI assistants counts as one person's, along with your app language and currency. It then also learns things such as which tool was used, how a receipt scan ended, which kind of reminder arrived and when you opened a push reminder; and for Raku, receipt scans and voice notes, the AI model used, its token count, cost and timing, and whether the call failed: never what you typed, said or photographed, or the answers. The setting is saved to your account, so it applies on every device you sign in on.

Why we use it

We process your data only to run Bendaharaku and keep it safe, on these bases (UU PDP Article 20):

• To provide the service you signed up for (performing our agreement with you): your account, budgets, transactions, receipts, history, insights, exports and reminders.
• Features you turn on (performing the agreement, at your request): reading a receipt when you tap scan, Raku answering you when you write to it, the Telegram bot once you connect it, and AI assistants once you create a token for one. You can stop any of them at any time.
• Anonymous usage counts (our legitimate interest in knowing which parts of Bendaharaku are used, so we can improve it): nothing that identifies you and nothing stored in your browser; your IP address is used only for a daily hash, then discarded. Usage linked to your account (your consent): only if you turn it on in Settings → Privacy. Turning it off stops it from then on and removes PostHog's storage from your browser; signing out does the same in that browser.
• Security and fixing problems (our legitimate interest): rate limits, error logs and preventing abuse.

We don't sell your data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

Who helps us run it

These providers process data on our behalf, only for the purpose shown:

Each of them also handles data under its own terms and privacy policy. Beyond them, we share data only when the law requires it.

Data outside Indonesia

Our server and most of the providers above are outside Indonesia, so your data is transferred abroad. As UU PDP Article 56 requires, we use providers whose protection is at least equal to Indonesian law, or that commit to adequate safeguards. Using Bendaharaku after reading this policy means you've been told about these transfers.

How long we keep it

We keep your data while your account exists. When you delete your account, your account and budget data are deleted right away, and receipt files are removed from storage within minutes.

A few copies last a little longer:

• Telegram: unsaved drafts in the bot for up to 24 hours, and the bot's record of your connection until you next message it. Messages already in your Telegram chat stay in Telegram.
• Reminders already handed to a push service can still arrive for up to 12 hours.
• Server logs and database backups: no longer than 30 days.
• Raku: conversations for 30 days after their last message; photos that don't become a receipt for about a day.
• Our AI provider and the model providers it uses keep data under their own policies.
• Usage analytics: kept by PostHog for up to a year. Deleting your account doesn't remove what was already sent, but once the account is gone nothing links its random ID to you.

Resetting your data (Settings → Reset data) deletes your budget data but keeps your account. So does starting over when you've lost both your password and your recovery code, which also disconnects your apps and signs out your other devices.

Backups you download are yours to keep or delete. They aren't locked with your password: anyone who has the file can read it, so keep it somewhere safe.

How we protect it

• Connections to Bendaharaku use HTTPS.
• Sign-in sessions, access tokens and Telegram link codes are stored only as one-way hashes. The Telegram bot's access to your account is stored encrypted.
• Every amount (balances, transactions, bills, debts, planned income, limits and goals), your conversations with Raku, your receipt files and the photos you send Raku are stored encrypted. Once you set a password for your data, they're locked with a key of your own that only your password or your recovery code unlocks, so a copy of the database, even with the server's own keys, shows none of them. Your password never leaves your browser.
• At the Fully locked privacy level, the notes, names and labels you type are locked the same way. At Locked they're stored readable, so reminders can say what's due. Reminders never contain amounts.
• While you're signed in, the server unlocks your data to show it to you, work out your budget and answer through Raku. AI assistants and the iPhone Shortcut unlock it with the key you give them, which only they hold. If you connect the Telegram bot, the bot keeps its own key, encrypted, so it can answer you at any time, even when you're not signed in; anyone in control of our servers could use it to open your data. Disconnecting Telegram deletes that key. If you lose both your password and your recovery code, nobody can recover your data, us included.
• Wrong passwords are counted: after five in a row, each next try has to wait longer, up to an hour.
• Receipt files sit in a private bucket, locked like the rest of your data, and can only be opened through your account.
• Every request is checked against your account, so no one else can read your data.

No system is perfectly secure. If you think your account is at risk, revoke your tokens and disconnect Telegram in Settings, then contact us.

Your rights

Under UU PDP you have the right to:

• know who processes your data and why (this policy);
• access your data and get a copy: Settings → Back up your data downloads it as a JSON file;
• correct or complete it: edit anything in the app;
• take it elsewhere in a common format (that JSON file);
• have it deleted: Settings → Delete account, or Reset data to keep the account;
• withdraw your consent: disconnect Telegram, revoke AI-assistant tokens, turn off reminders, or turn off account analytics in Settings → Privacy;
• ask us to pause or limit processing;
• object to automated decisions (we don't make any);
• complain to us, and to Indonesia's personal data protection authority.

For anything you can't do in the app, email elianrichards@gmail.com. We reply within 3 × 24 hours and may ask you to confirm the account is yours.

Children

Bendaharaku is meant for adults. If you're under 18, use it only with the consent of a parent or guardian (UU PDP Article 25). If we learn we hold a child's data without that consent, we'll delete it.

Cookies and browser storage

We use only what the site needs to work, plus analytics storage if you turn on account analytics (anonymous counting stores nothing):

If something goes wrong

If a breach affects your personal data, we'll tell you and the authority in writing within 3 × 24 hours of finding out: what happened, which data is involved and what we're doing about it (UU PDP Article 46).

Changes to this policy

When this policy changes we update the date at the top. If a change affects how we use your data, we tell you in the app or by email before it takes effect.

Contact

Elian Richard: elianrichards@gmail.com.