Keavi ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").
Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
1.1 Information You Provide
Account Information
- Email address
- Password (encrypted)
- First and last name
Financial Transaction Data
- Transaction amounts and descriptions
- Merchant names
- Categories you assign to transactions
- Notes and tags you add
- Budget allocations and envelope assignments
Voice Input
When you use voice input to record transactions:
- Audio is temporarily transmitted to our servers
- Audio is processed by AI services to convert speech to text and extract transaction details
- Audio recordings are not stored after processing is complete
- Only the extracted text and transaction data are retained
Receipt Images
When you scan receipts:
- Images are transmitted to our servers
- Images are processed by AI services to extract transaction details
- Receipt images may be retained to allow you to view them later
- You can delete receipt images at any time
1.2 Information Collected Automatically
Device Information
- Device type and model
- Operating system version
- Unique device identifiers (for push notifications only)
Usage Information
- App feature usage patterns
- Error logs and crash reports
- Performance metrics
1.3 Information from Third-Party Services
If you connect third-party services (such as linked bank accounts or bank statement imports), we receive:
- Account names and balances
- Transaction data from those services
- Only data necessary to provide the budgeting features you request
2. How We Use Your Information
We use the information we collect to:
- Provide the Service: Process your transactions, manage budgets, and deliver core app functionality
- Process Voice Input: Convert your speech to text and extract transaction details using AI
- Process Receipt Images: Extract line items and transaction details from receipt photos
- Send Notifications: Alert you about transaction confirmations, budget status, and app updates
- Improve the Service: Analyze usage patterns to enhance features and fix issues
- Provide Support: Respond to your inquiries and resolve issues
- Ensure Security: Detect and prevent fraud, abuse, and security incidents
3. AI and Third-Party Data Processing
3.1 AI Service Providers
We use third-party AI services to power features like voice input, receipt scanning, and natural language processing. Our current AI service providers are:
- Anthropic (Claude)
- Deepgram (Speech-to-Text)
- DeepInfra (hosted open models, used for the daily journal)
- Google (Gemini)
- OpenAI (GPT, Whisper)
We may change AI providers or add new ones to improve our services. When we do, we will update this list. The specific provider used for any given feature may vary based on performance, cost, or availability.
3.2 How AI Processes Your Data
Voice Processing
- Your audio is sent to our servers and processed using AI services
- AI extracts transaction details (amount, merchant, category) from your speech
- Audio is processed in real-time and is not retained after processing
Receipt Processing
- Receipt images are processed using AI services to extract text and transaction details
- AI extracts line items, totals, and merchant information
- Images are processed on our AI providers' servers under their data processing terms
Text Processing
- Transaction descriptions and natural language input are processed using AI services
- This helps categorize transactions and understand your intent
3.3 Other Service Providers
We also use the following service providers, each only for the purpose listed:
- Amazon Web Services (AWS): hosting, data storage, backups and sign-in
- PlanetScale: database hosting and backups
- Cloudflare: routing requests to our AI providers
- OpenRouter: routing some receipt-processing requests to Claude. OpenRouter sends them only to servers in the United States run by Amazon Web Services or Google Cloud, under zero-data-retention terms
- Plaid: connecting bank accounts you choose to link, and receiving their transactions
- Stripe: processing payments. We never see or store your full card number.
- Apple: in-app purchases made through the App Store
- Firebase Cloud Messaging (Google): delivering push notifications
- Sentry: error reports, which can include technical details about the request that failed
- Grafana Labs: operational logs and performance metrics
- GitHub: tracking feedback you send us
- Google: signing in with your Google account, if you choose to
- Buttondown: holding the email address you give us to subscribe to our blog, and sending you new posts. This subscription is separate from your Keavi account, so deleting your account does not end it: use the unsubscribe link in any email
We use usage analytics to improve the Service. Analytics are linked to your account, so they can be deleted with it. They are never sold or shared for advertising.
All service providers are contractually obligated to protect your information and use it only for the purposes we specify.
4. Data Retention
- Account Data: Retained while your account is active and for a reasonable period afterward
- Transaction Data: Retained while your account is active; you can delete individual transactions at any time
- Voice Audio: Not retained after processing (typically seconds)
- Receipt Images: Retained until you delete them or close your account
- Usage Analytics: Retained while your account is active
- Security & Audit Logs: Records of security-relevant events (such as authentication and authorization activity) are retained for about two (2) years; a copy we keep to detect tampering can last up to three months longer
- Backups: We keep encrypted backups of our database so we can recover from a failure. Data you delete, including a deleted account, can remain in these backups until they expire. Under our current schedule, nightly backups expire after about two weeks, weekly backups after about five weeks, and monthly backups after about a year. We may change this schedule, and if we do we will update this section.
You can request deletion of your account and associated data at any time by contacting us. Please note that we retain certain limited records — in particular security and audit logs — for the period described above even after account deletion, where we have a legitimate interest or legal obligation to do so for security, fraud prevention, and abuse detection. These records are minimized and are not used for any other purpose. Backups are used only to keep the Service recoverable, including testing that a restore works, and are deleted when they expire.
5. Data Security
We implement appropriate technical and organizational measures to protect your information:
- All data transmitted between your device and our servers is encrypted using TLS/SSL
- Passwords are hashed using industry-standard algorithms
- Sensitive data is stored in encrypted databases
- Access to user data is restricted to authorized personnel only
- We regularly review and update our security practices
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
6. Your Rights and Choices
6.1 Access and Portability
You can access your transaction data within the app at any time. You may request a copy of your data by contacting us.
6.2 Correction
You can update your account information and correct transaction data directly in the app.
6.3 Deletion
You can:
- Delete individual transactions, receipts, and notes within the app
- Disable voice input in Settings (which removes stored consent)
- Request complete account deletion by contacting us
When you delete your account, we remove your personal data from our live systems except for limited security and audit-log records, which we retain for the period described in Section 4 (Data Retention) under our legitimate interest in security and fraud prevention. Copies of your data can also remain in our backups until those backups expire, as described in Section 4 (Data Retention). A blog subscription is separate from your account and ends when you unsubscribe (see Section 3.3).
6.4 Voice Input Controls
- You can enable or disable voice input in Settings
- The first time you use voice input, we will ask for your explicit consent
- Disabling voice input revokes your consent and prevents audio collection
6.5 Push Notifications
You can disable push notifications through your device settings or within the app.
7. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete that information promptly.
8. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws. By using the Service, you consent to such transfers.
We ensure appropriate safeguards are in place when transferring data internationally, including standard contractual clauses where applicable.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by:
- Posting the new Privacy Policy in the app
- Updating the "Last Updated" date at the top
- Sending you a notification for material changes
Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.
10. California Privacy Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to Know: You can request information about the categories and specific pieces of personal information we have collected
- Right to Delete: You can request deletion of your personal information, subject to the limited security and audit-log retention and the backup retention described in Section 4 (Data Retention)
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To exercise these rights, contact us using the information below.
11. Contact Us
If you have questions about this Privacy Policy or our privacy practices, please contact us at:
Email: privacy@keavi.app