Privacy Policy

This policy applies to anyone who creates a Kosha account, whether through the website (kosha.adyantrix.com) or the Android app distributed via Google Play. Both experiences run on the same backend and are covered identically by this policy.

2.1 Account & identity information

• Full name (as provided at registration)
• Email address (used as your login identifier and for account-related communication)
• Password — never stored in plain text. It is passed through a one-way salted hash before being saved; we cannot see or recover your actual password.

2.2 Financial data you enter

Everything below is entered manually by you. Kosha does not connect to banks, card networks, or any financial institution, and does not import data automatically from any outside source.

• Financial accounts you create — name, type (bank/cash/card/etc.), currency, and balance
• Transactions — amount, date/time, title, category, account, and any notes you add
• Budgets — amount, period (monthly/yearly), and which accounts/categories they track
• Categories — including any custom categories you create
• Receipt images you choose to attach to a transaction

2.3 Squad (shared group) data

If you create or join a "squad" — a shared group with other Kosha users — we store:

• The squad's name, join code, and membership list
• Which of your accounts, budgets, or categories you've chosen to share with that squad
• Expense-splitting records: who paid, the split method and amounts, and settlement history between squad members

Squad members can only see what you explicitly choose to share into that squad — your other, unshared accounts, budgets, and transactions remain private to you.

2.4 Technical & usage information

• A session/authentication cookie that keeps you signed in. This is strictly necessary for the app to function and is not used for tracking or advertising.
• Standard web server logs collected automatically by our hosting provider (Vercel) — IP address, browser/device type, and request timestamps — used only for security, abuse prevention, and diagnosing outages.
• If you install the Android or web app (PWA), a small amount of data is cached locally on your device by a service worker so the app can show recently-viewed pages while offline. This cache stays on your device and is not transmitted to us.

2.5 What we do NOT collect

• We do not use third-party analytics, advertising, or cross-app tracking SDKs.
• We do not access your contacts, location, camera, or microphone.
• We do not link or import data from your bank, card issuer, or any other financial institution.

• To create and authenticate your account, and keep you signed in
• To store, display, and let you manage your transactions, accounts, budgets, and categories
• To calculate budget progress, balances, and analytics/insights within the app
• To operate squad features you opt into: shared accounts/budgets, expense splitting, and settle-up
• To detect, prevent, and respond to fraud, abuse, or security incidents
• To respond to you if you contact us for support

We do not use your data to build advertising profiles, and we do not sell it.

We do not sell, rent, or share your personal or financial data with advertisers or data brokers. Your data is only ever visible to:

• You, when logged into your own account
• Other members of a squad you've joined — and only for the specific accounts, budgets, categories, or expenses you've chosen to share with that squad
• Infrastructure providers who process data on our behalf, under their own security and confidentiality obligations, strictly to operate the service:

• Vercel — application hosting and web server logs
• Neon — hosted PostgreSQL database where your data is stored
• UploadThing — storage for receipt images you upload

None of these providers are permitted to use your data for their own purposes, such as advertising.

We may also disclose information if required by law, court order, or governmental request, or to protect the rights, property, or safety of Kosha, our users, or the public.

Our infrastructure providers (Vercel, Neon, UploadThing) may process and store data in data centers located in different countries than where you live. By using Kosha, you acknowledge that your information may be transferred to and processed in such locations, which will always be operated under contractual data-protection safeguards with our providers.

We retain your account and financial data for as long as your account remains active. You can delete individual transactions, accounts, budgets, or categories at any time directly within the app. If you'd like your entire account and all associated data permanently deleted, contact us using the email below and we will process the request, subject to any data we're legally required to retain.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (most fields are editable directly within the app)
• Request deletion of your account and associated data
• Request a copy of your data in a portable format
• Withdraw from squad sharing at any time by unsharing a resource or leaving a squad

To exercise any of these rights, contact us at the email below. We will respond within a reasonable timeframe.

Passwords are hashed with a one-way, salted algorithm and are never stored or logged in plain text. All traffic between your device and Kosha is encrypted in transit via HTTPS/TLS. Access to production data is restricted to what's necessary to operate the service. No method of storage or transmission is 100% secure, but we work to protect your information using industry-standard practices.

Kosha is not directed at, and is not knowingly used by, children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the app evolves. Material changes will be reflected by updating the "Last updated" date above. We encourage you to review this page periodically.

Questions, concerns, or requests regarding this policy or your data can be sent to info@adyantrix.com.