What we hold, and what we do with it

Four kinds of thing, and nothing else:

• Your account. Your name, your email address, a one-way hash of your password (never the password), and — if you switch it on — your two-factor secret and recovery codes.
• Your financial records. The accounts, transactions, budgets, bills, goals, debts, assets and income you enter or import, together with any receipt images or documents you attach to them.
• How the household works. Who is in it, what the two of you agreed about sharing costs, invitations you have sent, and an activity log of changes made to shared records — so that a figure that moved can be explained rather than argued about.
• How your account is used. Sign-in events with the IP address and browser they came from, so you can see and end sessions you do not recognise, and your plan and payment history.

We do not hold your banking credentials, because Inkece never connects to your bank. It reads the statement file you upload. We do not hold your card number either — see below.

Every account, budget and transaction sits in a lane, chosen when you create it. Anything in your private lane is never loaded for the other person — not hidden in the interface, not filtered out on the way to the screen. There is no screen, no export and no report in Inkece where one partner reads the other’s private money.

A shared total is the sum of the lines you are allowed to see, rather than the real total with the private lines subtracted. That distinction matters: the second kind leaves a difference somebody can work backwards from, and this one does not.

If your household ends, the shared records stay with the household so that the other person’s settled months are not silently rewritten. Your private records leave with you.

Our own support and administration tools can reach your name, your email address, your plan and subscription state, whether your imports succeeded, and the shape of your household — how many people are in it and how far through setup they are.

They cannot reach a transaction, an allocation, an account balance, a budget line, a goal, a debt or a report. That is a property of the tools rather than a rule staff are asked to follow: the administration queries do not select those columns.

It follows that we cannot answer a question about what you or your partner spent, and cannot tell one of you anything about the other. The privacy model does not have a support exception.

Three services, each doing one job. We do not sell your information, we do not share it for advertising, and there is no analytics or tracking script on the signed-in side of this app.

• Payments — Paystack. When you subscribe, your card details are entered on Paystack’s own checkout and never reach us. We keep their reference for your subscription and what they tell us about a charge succeeding or failing.
• Email. Password resets, partner invitations, billing letters and any alerts you have asked for are delivered through our email provider, which sees the address and the message.
• Tidying merchant names, and the Ask box — Anthropic. Three features can send text to a language model. Merchant learning sends the description line from a statement row, on its own, to work out what the shop is called. After an import, or after a payment alert from your bank, a shop we could not place is sent by name, one at a time and with the list of your category headings, to suggest where it belongs; the suggestion is shown beside the row and nothing is filed by it. The alert itself, and its amount, stay on our own server. Ask sends your question and the list of your category headings.
• The opening of your monthly check-in — Anthropic, only if you turn it on. If you switch it on, the two paragraphs at the top of the check-in are written by a language model, and to write them your household’s totals for the month are sent to Anthropic: income, spending, what went to goals, what is left in the budget, the largest heading and its amount, and any large bills coming up with their names, dates and amounts. No names, account numbers, transactions or email addresses go with them, and nothing it writes is kept. It is off until you turn it on, it is per person, and the check-in page says so beside the switch.
• Reading a PDF statement — Anthropic, only if you turn it on. If you email in a PDF statement, or upload one on the Import page, and have switched this on, the whole PDF is sent to Anthropic to be read. That is an exception to the next paragraph: it contains your name, the account number, every balance and every transaction. It is off until you turn it on, it is per person, and the Import page says so beside the switch. We check that the lines add up to the statement’s own balances before anything is imported. A PDF is kept for 14 days, then deleted, only when we could not finish with it: it was not read yet, we could not tell which account it belongs to, or the lines did not add up. One that is imported is not kept. What is kept, for each statement read, is the days it covers, its opening and closing balance and what its lines add up to: that is how we tell you when an account does not match the bank’s own figures, and it stays in your account and goes nowhere.

What is never sent to a language model: amounts, balances, dates, account numbers, your name, your email address, or anything from a lane the asking person cannot see — except in the two cases above, each of which you must switch on yourself. Merchant learning and Ask fall back to a calculation on our own server when no model is available, so neither is required for the app to work.

Your records are kept for as long as your account exists. Nothing is deleted on a schedule — a household reconciling last February needs last February — so the practical answer is that you decide, by deleting what you no longer want or by closing the account.

The database is backed up nightly and the last fourteen snapshots are kept, each one encrypted. So a record you delete today is gone from the app immediately and disappears from the last backup that contains it within about two weeks.

Two things outlive an account deliberately. Shared household records stay with the household while another member remains, for the reason given above. And where an operator has performed an action on an account — a refund, a manual erasure — the audit record of that action is kept, because a record that can be deleted by the person it holds accountable is not an audit record.

Export. A complete JSON export of everything you can see is available from your settings, on every plan including the free one. It is not a summary and it is not gated — the exit is deliberately as good as the entrance.

Correction. Everything you entered can be edited or deleted in the app. Anything you cannot reach yourself, we will correct on request.

Deletion. Closing your account removes your private records, your files and your sign-in history. If a partner is still in the household, the shared records stay and your user record is emptied rather than removed, so their history still resolves; if nobody remains, everything belonging to the household is removed with it. The owner of a household that still has a partner in it has to separate first — someone has to stay accountable for the shared records.

If you would rather we did it, or you cannot sign in, write to admin@inkece.co.za from the address on the account. We will confirm what will go before anything is removed, and we will not act on a deletion request that comes from anybody but the account holder — including somebody claiming to act for them. The steps, for the website and the Android app alike, are on their own page.

Four, all of them ours, none of them for advertising or tracking, and there is nothing here to consent to because none of them is optional in the sense a banner means.

• inkece_session — signs you in and keeps you signed in. The app does not work without it.
• inkece_dark — whether you chose the dark theme, so the first paint is the right one.
• inkece_sidebar and inkece_roomy — how wide you left the navigation, and how much room your screen has.
• inkece_app — whether you are using the Android app or the website, so the plan is shown the way that place allows.

Sessions are encrypted and cookies are restricted to HTTPS. Passwords are stored as one-way hashes. Two-factor authentication, recovery codes, sign-in history, device alerts and sign-out-everywhere are on every plan, free, permanently.

The security page sets out what is in place today and, just as importantly, what is not yet.

Write to admin@inkece.co.za first — most things are a misunderstanding we can clear up the same day, and we would rather hear it from you.

If that does not resolve it, you have the right to complain to the Information Regulator of South Africa, which supervises compliance with POPIA.

When something here changes materially — a new service receiving your data, a change to what is kept or for how long — we will say so by email before it takes effect rather than quietly moving the date at the top.