Privacy Notice
Effective: 23 August 2026
Kirabajet is a development preview. Do not enter irreplaceable financial information until the real-device security testing described in the application is complete.
Information used for sign-in
When you choose Google Sign-In, Google provides Kirabajet with an identity token containing account information such as your Google account identifier, email address, display name, and optional profile picture. The service verifies that token to authenticate you. It stores a keyed, non-reversible lookup value for the provider identity and a hash of the Kirabajet session token instead of the raw Google account identifier or email address.
Financial information
Income, balances, bills, savings, shopping plans, item names, prices, and notes are encrypted on your device before synchronization. The server stores ciphertext, opaque identifiers, revisions, public keys, and encrypted key bundles. Kirabajet operators do not receive the vault passphrase, recovery code, or private decryption keys.
Device and service information
The service may process security and operational metadata such as request identifiers, route names, response status, timing, device public keys, session expiry, and coarse error codes. Request bodies, authentication tokens, vault secrets, and decrypted financial fields must not be written to application logs.
Sharing and service providers
Kirabajet uses Google for optional account authentication and a privately operated PostgreSQL service for encrypted synchronization. Financial plaintext is not sent to Google. Household sharing, analytics, advertising, payment processing, and email notifications are not enabled in the current preview.
Retention and control
Encrypted records and account metadata are retained while the development account exists or as required for security and backup integrity. Signing out removes the local session but does not yet delete the server account. For access or deletion requests during the preview, contact support.
Security limits
End-to-end encryption cannot protect information visible on an unlocked, compromised, rooted, or jailbroken device, or information deliberately shared, exported, or captured in a screenshot. Losing every trusted device and the recovery code can make encrypted data permanently unrecoverable.
Contact
Questions and privacy requests: support@flowtrack.pro.