Privacy Policy

Last updated October 28, 2026. In force from the same day.

Kerabat is a private planner for people who share money: one household keeps its spending, receipts, events and due dates in one place, and can see them in a Google Calendar of its own.

1. Who we are

Kerabat is run by Yahor Karabelnikau, a private person, in Poland; for the purposes of the GDPR he is the data controller. Write to privacy@kerabat.app with any question about this policy or about your data.

In this policy a household means the people who share one set of records in the app — whatever they are to each other. In the app it goes by the name you gave it, and by the word “household” where a noun is needed.

2. What Kerabat stores

2.1 How you sign in

There are two ways in. With Google: from your Google profile the app takes your email address, your display name and the account identifier Google gives it — and nothing else. With a code sent to your email: the app emails an eight-digit code to the address you type, and that address becomes your account; nothing about you comes with it, so the app asks you for a name separately. Either way, your email address is how the rest of your household recognizes you, and how the shared calendar is shared with you.

2.2 What your household writes into the app

Spending — the amount, the date, the category, a note, who paid, and the currency and rate you entered.
Receipts — the photograph you take, or the document in an email you forward (§5.2), and what was read from it: the total, the date, the store, the lines and their categories.
Income — the amount, the date, where it came from, who received it, and a note; for income added from a pay stub, the note holds the employer and the pay period.
Events — the name of an event (a child’s class, a birthday, a trip), its schedule, where it takes place and who it is for.
Bills and payments — what is due, when, how much, what has been paid, by whom, and whose card is charged for autopay.
Bank statements — the transactions you add from your bank’s file become ordinary spending, income and bill payments; §5.3 explains how the file is read and what is kept.
Household settings — the household’s name, its time zone, its home currency, its list of categories, and any monthly budgets set on them, each with its amount, the month it starts, and who set it.
Notifications — your notification settings, and, while you keep notifications on for a device, one record of that device: the token Firebase Cloud Messaging delivers to, whether it is an iPhone, an Android or a desktop, and when that token was last refreshed. Turning notifications off, or taking the permission away in the browser, deletes that record. Where notifications cannot be delivered at all, the app says so and asks for nothing.

2.3 Technical records

A monthly count, one per household, of the receipts sent for recognition, so that the service stays inside its budget.
When you sign in with a code, one record is kept for that address while the code is in play: the address, a keyed hash of the code (never the code itself), when the last codes were sent, and how many attempts have been made. It is what the sending and attempt limits are counted by, and it deletes itself 48 hours after the last email.
Signing in by a code is also counted against the connection and the browser it comes from, one record each: a keyed hash of the connection’s IP address and of the browser’s installation identifier — never the address or the identifier as they are — with the times of recent requests for a code and of failed attempts, and the time of the last sign-in by a code that worked. Nothing in it names you: not your email address, not your account. It is there to protect signing in from guessing and from floods of code emails — without it, one address could be guessed at from a thousand browsers, and somebody else’s flood could shut out a person who has signed in here before. Each record deletes itself 30 days after it was last written. We keep it on the basis of our legitimate interest in keeping the way in safe (§8); you may object (§11).
Three small logs of what the reading got wrong: a purchase moved to another category, a line corrected or taken out of a receipt, and the answer to “Is this the payment for ‘…’?” An entry holds the name of the purchase, the store, the sums in question and who made the change. They exist so that we can see what the automatic reading gets wrong and make it better; we keep them on the basis of our legitimate interest in that, you may object (§11), and they delete themselves after 12 months.
If your household connects the shared Google Calendar (§4): the key Google issues for that calendar — encrypted, never stored as it came (§4.4) — with the address of the Google account the calendar is in, the permissions it was given and when; and the calendar’s current state — when it was last updated and, if Google refused, Google’s own error code, never the text of the error. Every member of the household can read that state and that address.
Where you came from — one short word, written once, when you first sign in: the tag on the link you followed (such as “saashub”), or the name of the site you came from, not the page (such as “habr.com”), or nothing if there was neither. Nothing is kept on your device for it. It stays with your account, never changes, and is erased with the account (§10.1). It tells us which places bring people who stay; we keep it on the basis of our legitimate interest in that (§8), and you may object (§11).
Ordinary Google Cloud server logs — requests and errors — kept by Google under Google Cloud’s own retention.
Kerabat uses Firebase App Check with reCAPTCHA Enterprise to tell a request made by the real app from one made by a script. reCAPTCHA is a Google service and processes technical signals from your browser for that check alone.

2.4 What Kerabat does not collect

There is no analytics service, no advertising and no third-party tracker of any kind in the app: no Google Analytics, no advertising SDK, no session recorder, no measurement library. We build no profile of you and do not follow you anywhere else. The only thing the app keeps about how you found it is the one word in §2.3.

2.5 Counting visits to kerabat.app

The site kerabat.app — not the app, and not this policy or the terms — counts its visits with Cloudflare Web Analytics: which pages are opened, which site people arrive from, and their country, browser and kind of device. By Cloudflare’s own description it uses no cookies and no local storage, and does not fingerprint your browser. We see totals, not people. We do this on the basis of our legitimate interest in knowing which places bring visitors to Kerabat (§8); you may object (§11).

3. What is kept in your browser

Some of what the app remembers never leaves your device. It is kept in the browser on that device alone:

The language you chose.
The Google access token for “My calendars” on the Day screen (§4.2, §4.4), and the address of the Google account it belongs to.
The name of the household you last had open, so that a screen can still name it once access has gone.
This browser’s push token and when it was last refreshed, while notifications are on.
Small conveniences, such as which tab of “Bills” you were on.

Clearing your browser data removes all of it. None of it is used to recognize you anywhere else.

4. Google Calendar

Kerabat asks for access to your Google Calendar. Here is exactly what it does with it.

4.1 What the app writes

Kerabat creates one new, separate calendar for your household, and names it after your household — you can rename it in Google Calendar. It only ever writes to a calendar it created itself: if it finds itself linked to an ordinary calendar it did not create, it stops syncing rather than write into it.
Into that shared calendar it writes the events and the due dates from the app and keeps them up to date. The writing is done by our server (§4.4), so the calendar stays up to date even while nobody has the app open. Every event it creates carries a private mark of its own; events without that mark are never changed and never deleted by the app.
The app never sends invitations or notification emails on your behalf: every call is made with notifications switched off.

4.2 What the app reads

From the shared calendar — our server reads the events in it, deleted ones included, so that an event you move in Google Calendar itself is picked up by the app rather than silently overwritten.
From your own calendars — only on your phone, only if you ask for it (“Show my calendars”), and only the ones you check in Settings, to show those events beside the shared ones on the Day screen. They are held in the app’s memory while that screen is open and are never written to our database. The server’s key cannot read them at all: it has no permission to. The app never changes or deletes anything in them.
Your list of calendars — on your phone, for the same screen, to show you the list you pick from.

4.3 Sharing that calendar

The calendar belongs to the Google account that created it, and only its owner may change who it’s shared with. The app acts for them: the owner shares it with someone by hand, one person at a time, from that person’s card; and when someone leaves the household, or is removed, our server removes their access straight away, while the calendar is connected — nobody has to open the app for it. Access granted before the app began keeping track of its own grants is the one thing it cannot remove: it says so, and shows the owner where in Google to take that access away.

4.4 Where the Google keys live

The shared calendar is kept up to date by our server, so the server holds a key from Google for that one calendar, issued when its owner connects it. The key carries two permissions and no more: to manage the calendars the app itself created, and to change who a calendar is shared with, which the app does only for the calendar it created. It cannot see the list of your calendars, and it cannot read the events of any calendar the app did not create. It is stored encrypted with AES-256, under a key kept in Google Cloud Secret Manager and never in the database, and no phone can read it — not even its owner’s. It is used for nothing else.

When the key goes. It is revoked with Google and erased when the owner taps “Disconnect calendar”, when the owner leaves the household, and on the day the owner’s account or the household is deleted; it is erased at once if Google stops accepting it. While a deletion is waiting (§10), the calendar stops updating, and the key stays only so that calling the deletion off brings the calendar back without connecting it again.

“My calendars” on the Day screen are separate. For them your phone asks Google for a short-lived token of its own, good for about an hour and kept in your browser on your device only; it lets the phone read the list of your calendars and the events in them, and nothing else.

You can withdraw either access at any time at myaccount.google.com/permissions. The owner of the shared calendar can also switch it off with “Disconnect calendar” in Settings → Calendar; the shared calendar then stops updating. Events already written into your calendar stay there, and you can delete them, or the whole calendar, in Google Calendar.

4.5 Limited Use

Kerabat’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: what comes from your Google Calendar is used to show you your day in Kerabat and to keep the shared calendar up to date, and for nothing else. It is not sold, not passed on, not used for advertising and not used to train any model. Inside Kerabat, what is read from the shared calendar is seen by the members of your household; what your phone reads from your own calendars is seen by you alone.

4.6 How your data is protected

In transit. Every connection — between the app and our servers, and between our servers and Google — is encrypted with HTTPS (TLS). The app and the site are served over HTTPS only.
At rest. Your household’s records in Cloud Firestore and the receipt photographs in Cloud Storage are encrypted at rest by Google Cloud.
The shared calendar’s key is encrypted once more by us, with AES-256-GCM, under a separate key kept in Google Cloud Secret Manager and never in the database (§4.4). The database’s security rules keep it from every phone and browser — even its owner’s; only our server reads it, to update and share the calendar and to revoke the key with Google.
Access control. The database’s own security rules check every request from the app: only a signed-in member of your household can read or change its records (§6).
Your own calendars are read on your device only. Their events are not sent to our server and not stored; the token that reads them stays on that device, is gone when you close the app or the tab, and lasts about an hour (§4.4).
Two permissions, no more. The server’s key can manage the calendars the app created and change who a calendar is shared with — the app uses that only for the calendar it created (§4.3); it cannot list your calendars or read events in any calendar it did not create.
Who on our side can reach the data. Only the person who runs Kerabat (§1) has access to the Google Cloud project that holds it, and opens a household’s data only as §5 describes.

5. Receipt photographs and automatic reading

When you photograph a receipt, the picture is uploaded to our storage and sent to Google Vertex AI (Google’s Gemini models) to read the total, the date, the store and the lines.

Where it is kept, and where it is read. The photograph is stored in the EU (Belgium, europe-west1). Reading it is another matter: the model the app uses is not served in that region, so the picture goes to Vertex AI’s global endpoint and the reading may happen outside the EU — every receipt photograph, every time. The transfer is covered by Google’s data-processing terms; the photograph itself stays stored in the EU either way.
It is not used to train models. Under Google Cloud’s terms, what is sent to Vertex AI is not used to train Google’s models, and Kerabat trains no model of its own on your data either.
Nobody at Kerabat reads your receipts as part of running the service. Technically, whoever runs the app can open a household’s data through the Firebase console — that is true of any service, and saying otherwise would be a lie — but it is done only while a failure is being looked into, and only at the household’s own request.
You always confirm what was read. A receipt is never saved silently: the app shows what it read and you correct it. Nothing is decided about you automatically.

5.1 How long a receipt photograph is kept

Receipt photographs are deleted automatically 24 months after upload — a lifecycle rule on the storage bucket, not somebody remembering to do it. You can also delete one yourself at any time, from the receipt’s screen.

The expense stays, and so does everything that was read off the photograph. Only the picture goes. The amount, the date, the store, the categories — and every line of the receipt, each purchase by name and price — stay in your household’s history for as long as the household does. The app shows such an expense as usual, just without a picture.

Photographs of income documents are kept only until you answer. A photograph of a transfer you received, or of a pay stub, is read the same way as a receipt (§5): the model sees the whole picture. Once you answer — add it as income, or choose not to — the picture is deleted as soon as the “Undo” panel closes, or within two days of upload if the app was closed first. If nobody answers, it is deleted 30 days after upload. If you say the transfer was a payment you made, it becomes an ordinary receipt photograph and is kept as above.

From a pay stub the app takes only the net pay, the pay date, the employer, the pay period, and the currency. It does not take the gross pay, taxes or contributions, ID numbers (such as a Social Security number or a PESEL number), names, or account numbers, even though they are in the picture. The record our server keeps of each reading holds only the net pay, the pay date, the employer, and the pay period. The income you add stays in your household’s history, like an expense, without a picture.

5.2 Receipts you forward by email

Each member of a household can get their own address for receipts (it ends in “@in.kerabat.app”). We receive only what you, or a filter you set up in your mail, forward to that address. We never sign in to your mailbox and cannot see anything you don’t forward.

Who receives it. Forwarded emails arrive at Mailgun (Sinch Mailgun, EU region), which passes them to our server code in the EU (europe-west1, Belgium; §6).
How it is read. The text of the email and its attachments are sent to Google Vertex AI to read the store, the date, the total, the currency and the lines — the same way as a receipt photograph, through the same global endpoint, so the reading may happen outside the EU (§5). What is sent is not used to train models.
What we keep. We do not keep the text of the email. We keep what was read — as a receipt waiting for review, which every member of your household can see — and the receipt document itself if it is a PDF or a picture in JPEG, PNG or WebP, stored with your household’s receipt photographs and deleted on the same schedule (§5.1). Other attachments, and pictures in HEIC, are not kept. If one email carries two documents of the same purchase — an order confirmation and an invoice, say — we keep one of them and note that there was another.
The log of emails is yours alone. For each email we keep the date, the sender’s domain, the mailbox it was forwarded from if the forwarding shows it, the store and amount if one was read, what happened to it, and, if it repeated a receipt already in your household, who forwarded that one. Only you see it; it is deleted after 90 days.
A repeat is set aside, not added. If an email turns out to be a purchase your household already has, what was read and its document are set aside instead, so that you can still add them from the log with “Add it anyway”. Only you can do that, and whatever is set aside is deleted after 90 days, like the log. To tell a repeat, we keep for 90 days a fingerprint of each email, of each document in it and of each order — a one-way hash rather than the thing itself — with the receipt it became and who forwarded it. For an order we also keep its amount and currency, to tell another part of the same order from a repeat.
Forwarding confirmations. If you set up forwarding, your mail provider sends a confirmation code or link to your address. We show it only to you, and also email the code — once for each mailbox — to the address you sign in with. The code and the link are deleted from the app after 7 days; the email we sent stays in your mailbox until you delete it. The log keeps a line saying that a confirmation came, from which provider and for which mailbox, for 90 days, like every other line.
Confirmed mailboxes. A mailbox becomes confirmed when an email reaches your address through Gmail forwarding set up in it. A mailbox outside gmail.com — on a work or family domain, say — is confirmed this way only if the address you sign in with, or a mailbox you have already confirmed, is on the same domain. Forwarding from any other mail service works, but does not confirm the mailbox. We keep the list of confirmed mailboxes so that we know where replies may go. For each mailbox we have already emailed you a code about, we keep a hash instead of its address, so that you get only one such email for it.
Replies. When you forward an email by hand from a confirmed mailbox, or from the address you sign in with, we reply to that address — for example, “got your Amazon receipt · $27.24.” These replies are sent by Resend (§6) and say what became of the email: the store and the amount when a receipt was read, or that there was no receipt in it, that your household already has it, that it could not be read, or why it was not accepted.
Anyone who knows your address can send to it. What arrives comes in as paid by you, so keep the address to yourself. You can change it up to three times a day; the old one stops working immediately, and the mailboxes confirmed for it are forgotten.
When you leave the household or delete your account. Your address stops working — at once when you leave, on the day of the deletion when you delete your account (§10.1) — and what is yours alone goes with it: your log of emails, whatever was set aside for you, and your confirmed mailboxes. Receipts that have already come in by email belong to the household, like any other receipt (§6). From then on — and, for an old address, from the moment you change it — all we keep of an address is its random part, marked as used so that it is never given to anyone else, and the date it stopped working; nothing in it leads to you or to the household. The fingerprints of repeats (above) stay with the household until their 90 days run out, but no longer say who forwarded the email. Turn off forwarding in your mail as well: until you do, your mail keeps sending to the closed address, and we refuse those emails without reading them.

5.3 Bank statements

You can add spending, bill payments and income from your bank’s statement file in one go. What happens to the file depends on its format, and nothing is added until you tap “Add”.

CSV, XLSX and OFX files are read on your phone. The file is not uploaded, and the draft — the transactions before you add them — stays on that phone.
Columns the app doesn’t recognize. If the app can’t tell which column holds the date, which holds the amount and so on, it asks Google Vertex AI through the same global endpoint used for receipts, so this may happen outside the EU (§5). Only the layout of the file is sent: the column names and the shape of a few rows, with every letter and digit replaced (“-45.20” becomes “-99.99”). Your household’s country and the language your app is set to go with it, to help tell how dates and amounts are written. No amounts, descriptions, people’s names or store names are sent.
PDF statements are read by Vertex AI. Your phone takes the text out of the PDF and sends all of it — every transaction, the bank account number and the names printed on it — to Google Vertex AI through the global endpoint, so the reading may happen outside the EU (§5). The PDF file itself is not uploaded. What is sent is not used to train models.
The draft of a PDF statement — what was read, before you add it — is kept on our servers in the EU (§7) for up to 30 days, and only the person who added the file can see it. It is deleted when you add the statement or delete it, when you leave the household, and when you delete your account (§10.1).
Remembered layouts. When you confirm how a file’s columns were read, your household keeps that layout — which column holds what — so that the next file in the same layout is read without asking. A layout holds no amounts and no transactions — only which column holds what, who confirmed it and when. When you confirm that a transaction is a bill payment, your household also remembers which bill it goes with, so that the same payment on your next statement is recognized without asking. What is kept is not the text of the line but a fingerprint of the name on it — a one-way code mixed with your household’s identifier — along with who confirmed it and when. It is kept for as long as the household exists.
How the app avoids duplicates. For each statement you add, the household keeps a short record: the bank’s name, the period, who added it, how many entries of each kind were added, and until when it can be deleted as a whole. It also keeps a fingerprint of the bank account or card number — a one-way code mixed with your household’s identifier, not the number itself — and a fingerprint of every transaction line, so that the same line isn’t added twice. Nothing can be read back from a fingerprint. These are kept for as long as the household exists, unless you delete the statement. When you delete a statement, its record is deleted, along with the entries it added and their fingerprints. An entry that someone has since edited or attached a receipt to stays, and so do its fingerprints, so the same line can’t be added again.
What you add belongs to the household. The transactions you add become ordinary shared spending, income and bill payments (§2.2, §6), like the ones you enter by hand.

6. Who can see your data

Only the members of your household. This is held up by the database’s own security rules and not merely by which screens the app draws: a request from someone who is not a member at that moment is refused by the server. Someone joins through an invitation link that a member makes.

When a person leaves, or is removed, their access goes at once — their device can no longer read the household’s data. Their access to the shared calendar in Google is closed too, automatically — by our server, at once, as long as the calendar is connected; an older grant has to be taken away in Google by hand (§4.3).
Someone who has left keeps their name on the records they made: an expense they paid for last year still says who paid it. Erasing it would rewrite the history everybody else still reads. Nothing else of theirs stays: their address for receipts stops working, their log of emails, anything set aside for them and the drafts of bank statements they added are deleted, and the fingerprints of repeated emails no longer say who forwarded them (§5.2).

We have four processors and no others. Google Firebase / Google Cloud holds the data. Mailgun (Sinch Mailgun, EU region) receives the emails you forward to your address for receipts (§5.2) and passes them straight on to our server code: it holds an email only while passing it on, keeps no copy of it for us, and deletes its own record of each delivery after 1 day. Mailgun’s Article 28 agreement is part of the terms our account is on, and as Mailgun Technologies, Inc. is a US company, any transfer outside the EU rests on its certification under the EU-US Data Privacy Framework. Resend sends the emails — the sign-in code, the ones about deleting an account, the codes your mail provider sends to confirm forwarding, and the replies to emails you forward by hand, which may include the store and the amount (§5.2) — and is given only the recipient’s address and the text of the email, nothing else of the spending, the receipts or the events. Resend keeps that on servers in the United States; the transfer rests on its certification under the EU-US Data Privacy Framework, and the Article 28 agreement has been in force since our account was opened. Cloudflare counts the visits to the site (§2.5) and forwards the emails sent to our kerabat.app addresses to our mailbox; its Article 28 agreement is part of the terms our account is on, and the transfer outside the EU rests on its certification under the EU-US Data Privacy Framework.

7. Where your data is kept

What	Service	Where
Household data — spending, events, bills, settings, the addresses for receipts and the logs of forwarded emails	Cloud Firestore	eur3 — a multi-region in the EU (Belgium and the Netherlands)
Receipt photographs, and documents from forwarded emails, including those set aside for “Add it anyway”	Cloud Storage	europe-west1 (Belgium)
Server code — reading receipts, receiving forwarded emails, reminders, deletion, keeping the shared calendar up to date	Cloud Functions	europe-west1 (Belgium)
The shared calendar’s key, encrypted, and its state	Cloud Firestore	eur3 — a multi-region in the EU (Belgium and the Netherlands)
The key that encrypts it	Google Cloud Secret Manager	Google’s own infrastructure
Reading receipts and forwarded emails	Vertex AI	the global endpoint — the reading may happen outside the EU (§5)
Reading bank statements	Vertex AI	the global endpoint — the reading may happen outside the EU (§5.3)
Drafts of PDF bank statements and remembered file layouts	Cloud Firestore	eur3 — a multi-region in the EU (Belgium and the Netherlands)
Sign-in, push notifications	Firebase Authentication, Firebase Cloud Messaging	Google’s own infrastructure
Receiving forwarded emails	Mailgun	EU region (§6)
Sending emails — the sign-in code, the ones about deleting an account, forwarding confirmation codes and replies to forwarded emails	Resend	the United States (§6)
Counting visits to the site; forwarding emails sent to our kerabat.app addresses	Cloudflare	Cloudflare’s own network — may be outside the EU (§6)

8. Why we are allowed to hold this data

Performance of a contract (art. 6(1)(b)) — to give you the service you asked for: keeping your household’s spending, events and bills, and syncing them to your calendar.
Consent (art. 6(1)(a)) — for access to your Google Calendar, which you give on Google’s own screen, and for notifications, which you switch on yourself. Either can be withdrawn at any time — the calendar with “Disconnect calendar” in Settings — and withdrawing it stops that part and nothing else (§4.4).
Legitimate interest (art. 6(1)(f)) — three things, all described in §2. Keeping the way in from being guessed at and flooded: the sign-in records (kept 48 hours for an address, 30 days for a connection or a browser) and App Check. Seeing what the automatic reading of a receipt gets wrong: the three logs, kept 12 months. Knowing which places bring people to Kerabat, and which of them stay: the one word about where an account came from (§2.3) and the count of visits to the site (§2.5). You may object to any of them (§11).

9. Taking your data with you

Write to privacy@kerabat.app and we will send you your records in a machine-readable form — within one month at the latest.

10. Deleting your data

Leave the household. You lose access to its data at once (§6).
Delete the household. Its last remaining member can ask for it to be deleted. It goes after 30 days, not at once: for all of those days the app works as usual and shows the day it will disappear, with a button to call it off.
What deletion removes. On that day a server job erases the household’s records: spending, receipts, events, bills, settings, the receipt photographs and documents in storage, every member’s address for receipts and log of emails (of an address, only its random part stays, marked as used — §5.2), the pointers from members’ profiles, and the shared calendar’s key, revoked with Google first.

10.1 Deleting your account

The button is in the app: Settings → Account → “Delete my account”, and on the welcome screen if you are in no household. Tapping it erases nothing on the spot: your account goes after 30 days, and until then every screen carries one line — “Your account will be deleted on [date]” — with a tap that calls it off. Two emails go to the address of the account as well, the moment you ask and three days before the day; they are an addition to that line, not a replacement, because delivery is not ours to promise.

What is erased. Your profile — your settings, your notification choices, the language you picked, the word about where you came from, the tokens of the phones you allowed notifications on — your address for receipts (except its random part, which is kept so that it is never given out again), your log of forwarded emails and anything set aside for you (§5.2), the drafts of bank statements you added (§5.3), the key to any shared calendar you connected, revoked with Google first, and the account itself in Firebase Authentication: your email address, your name and the identifier it was given. Nothing is left to sign in with.

What stays, and we would rather say it than promise otherwise. The spending and payments you recorded belong to the household, not to you, so they are not deleted with your account and the member list keeps your name — it is what stands under every record you made. Your email address is erased with the account; it never stood under anything. If you were the household’s only member, it goes on the same day and through the same job; if anybody else is in it, or joins before the day comes, only your account goes.

What no deletion can remove. The app cannot delete the events it has written into your Google Calendar, because once the household or the account is gone, the key goes with it and nothing is left to reach the calendar with. Kerabat says so at the moment you ask — for the household or for your own account — and names the calendar: deleting that calendar in Google Calendar takes everything the app wrote into it with it. Do it while you still remember.

10.2 A household nobody opens

One deletion is not asked for. Kerabat deletes a household that nobody has opened for 24 months — keeping a household’s money and a child’s schedule forever because nobody got around to pressing anything is not something we want to do, and the law asks the same (GDPR art. 5(1)(e), storage limitation).

Nothing happens silently, and opening the app is enough to stop it. Any current member opening it counts — reading is using it — and the day comes from what Firebase Authentication already knows, so nothing new about anybody is collected for this. When the 24 months are up there is the same mark, and the same 30 days, as when somebody asks: the day on every screen, an email to each member when the mark goes on and again three days before, and the same server job at the end. Opening the app takes the mark off by itself.

11. Your rights

If you are in the EU, the EEA or the UK you have the right to see your data, to correct it, to have it erased, to restrict or object to its processing, and to take it with you (§9). One of those you do not have to ask us for: erasure is the button (§10.1) — it is in the app and does not wait on us. For anything else write to privacy@kerabat.app and we answer within one month. Where a request is complicated, or where several arrive at once, that month may be extended by two more — we will tell you inside the first month, and why (art. 12(3) GDPR). You may also complain to a supervisory authority — in Poland that is the President of the Personal Data Protection Office (UODO).

12. Children

Kerabat is written for adults: it is made for running a household’s money. Children have no account of their own and do not sign in; a parent records a child’s events and payments, so the records may hold a child’s name and their schedule. A child’s data is protected here exactly as anybody else’s — the law asks for more care with it, not less. If you believe a child holds an account of their own, write to privacy@kerabat.app and we will delete it.

13. Selling and sharing

We do not sell your data, and we do not share it with advertisers, data brokers or resellers of information. We do not use it for advertising, for credit scoring, or to train models.

14. Changes to this policy

If we change this policy in a way that changes how your data is used, we will say so in the app before the change takes effect, and change the date at the top. A change that only describes a new feature takes effect for your household when someone in it turns that feature on — until then, nothing about your household’s data changes. Contact: privacy@kerabat.app