Kaioro Privacy Policy
Last updated: 7 August 2026 App version: 0.1.0
This translation is provided for convenience. The binding version is the Spanish text at getkaioro.com/privacidad.
1. Who processes your data
Controller:
Stephen Jorg Messing Darchinger Sole trader registered with RUC 7360149 Av. Mariscal Estigarribia 57, 2000 Areguá Paraguay
Privacy enquiries: privacy@getkaioro.com General contact: support@getkaioro.com WhatsApp: +595 976 610546
Kaioro is operated entirely from Paraguay.
2. The core principle: your data stays on your phone
Kaioro is built as a local-first application. This is not a marketing claim but the architecture of the program: all your transactions, accounts, categories, budgets and goals are created and stored in a database on your device (IndexedDB).
There is no Kaioro server. There is no central database accumulating users' financial data. If you never sign in, your financial data never leaves your phone — apart from what is described in section 5.
The app is fully usable without an account. An account only unlocks cloud backup and synchronisation between devices.
3. What data is processed
3.1 Data you create yourself (on your device only)
| Category | Content |
|---|---|
| Transactions | amount, date, account, category, currency, merchant, note |
| Accounts | name, type, currency, balance |
| Categories | name, icon, colour and optionally a photo you choose |
| Budgets, goals, financings, recurring rules | the values you enter |
| CSV imports | the imported statement rows and a checksum of the source file |
| Merchant → category rules | the mapping the app learns from your decisions |
| Activity log and notifications | local change history and in-app notices |
| Settings | language, theme, currency, app lock, capture allowance |
About category photos: if you assign an image to a category, it is scaled down to a maximum of 128 pixels and 40 KB and stored inside the local database. It is the only kind of image Kaioro stores permanently. Selection happens through the operating system's file picker; the app does not access your gallery on its own.
3.2 Account data (only if you sign in)
When you sign in with Google, Kaioro receives and stores locally your user identifier, display name and email address. A password is never collected or stored — Google performs the authentication.
Your Google profile picture is not downloaded and not used. The avatar you see in the app is a locally generated initial.
3.3 Technical data in the event of an error
If the app crashes, an error report is transmitted containing the app version, the type of fault and the technical device context. Before it is sent, it passes through the redaction layer described in section 8. In addition, each app start transmits an anonymous session record to measure release stability, as explained in that section.
3.4 What Kaioro does not process
Never collected under any circumstances: location · contacts · advertising identifier · banking credentials · credit card data · phone number · receipt photos · voice recordings · push tokens.
Kaioro does not connect to banks or financial institutions. No aggregators such as Plaid or Belvo are used. Bank data only enters the app if you import a CSV file yourself.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the app | the data you enter | performance of contract, Art. 6(1)(b) |
| Account, backup and synchronisation | identifier, name, email, encrypted content | performance of contract, Art. 6(1)(b) |
| Camera and text recognition | the image, in memory only | consent, Art. 6(1)(a) (system permission) |
| Voice input | the audio, processed by the operating system | consent, Art. 6(1)(a) (system permission) |
| Error reports and stability measurement | redacted technical data | legitimate interest, Art. 6(1)(f) — with right to object, see section 8 |
| Exchange and crypto rates | the currency code only | legitimate interest, Art. 6(1)(f) |
5. When data leaves your device
Kaioro connects to exactly eight destinations. The app's content security policy protects the app interface from contacting other destinations. Sign-in also uses operating-system services (Google), which contact their own infrastructure; Kaioro sends no user data to unnamed destinations.
| Destination | Purpose | What is transmitted | Personal reference |
|---|---|---|---|
open.er-api.com | exchange rates | the currency code only | none |
dolarapi.com | Argentine dollar rate | nothing | none |
api.coingecko.com | crypto rates | a fixed coin list only | none |
identitytoolkit.googleapis.com | Google sign-in | the authentication process | yes, when signed in |
securetoken.googleapis.com | session renewal | the session token | yes, when signed in |
firebasestorage.googleapis.com | backup and sync | encrypted blocks | yes, when used |
ingest.de.sentry.io | error reports and stability measurement | redacted technical data | pseudonymous |
kaioro-dist-2026.web.app | feature switches (kill switches) | no personal data | no account |
The three rate services are queried without sign-in and without any data about you. As with any internet request, they see your device's IP address.
6. Backup and sync: end-to-end encryption
Cloud backup and device synchronisation are optional and require signing in.
Before any data leaves your device it is encrypted on your phone:
- The key is derived from a passphrase you choose, using PBKDF2-SHA-256 with 210,000 iterations.
- The encryption is AES-GCM with 256 bits.
- The passphrase never leaves the device. On Android it is held in the operating system's secure storage; in the browser it exists only in memory for the duration of the session.
The server therefore holds ciphertext only. Neither Google nor Kaioro's operator can read the contents of your backup. What the storage provider can see is the metadata: the path associated with your user identifier, the size of the block and the timestamp.
An important and honest warning: if you lose your passphrase, your backup is unrecoverable. There is no reset mechanism. This is not an oversight but the direct consequence of end-to-end encryption. Keep it somewhere safe.
The storage access rules permit reading and writing only within the path belonging to your own identifier; every other access is denied by default.
7. Camera, text recognition and voice input
7.1 Receipt photos and text recognition (OCR) — on device
When you photograph a receipt, text recognition runs entirely on your phone, using a model bundled with the app (Google ML Kit, packaged model).
- The image is processed in memory only.
- It is not saved to the gallery, to storage or to the database.
- It is not transmitted to any server.
The browser version has no text recognition at all; the app says so openly rather than faking a result.
7.2 Voice input — processed by the operating system
Here we must be precise, because the convenient wording would be inaccurate:
Kaioro does not perform speech recognition itself and transmits no audio to any server of its own. It uses the speech recognition service of the operating system.
On Android that service is typically Google. If your device has no offline language pack installed, the operating system may transmit the audio to Google's servers for processing. This happens outside Kaioro's control, at the system layer.
What we can guarantee: Kaioro receives only the recognised text, never stores the audio, and the text remains in memory until you choose to record it as a transaction.
If you want to avoid that transmission entirely, install the offline language pack in your device settings, or do not use voice input.
8. Error reports
Kaioro uses Sentry to detect program faults. This is the only form of telemetry in the program.
In addition to error reports, every app start transmits an anonymous session record. Its sole purpose is to measure how stable a program version runs (the share of fault-free starts); it contains no content — no transactions, amounts, categories or notes. The same switch as error reports disables it, and it is not a session recording (there is no Session Replay).
What Kaioro does not do, verified in the source code: no behavioural analytics, no tracking, no advertising, no advertising identifier, no marketing profiles, no session recording, no Google Analytics, Firebase Analytics, Crashlytics, Meta SDK, Mixpanel, Amplitude or equivalent.
Before being sent, every report passes through a redaction layer that removes:
amounts in any format (including Latin American formats) · IBAN numbers · card numbers · email addresses · passphrases · and every field whose name indicates sensitive content, such as amount, balance, merchant, note, title, description, token or secret.
The Sentry server is located in the EU region (Germany).
Your right to object: you can switch off the transmission of error reports in the app settings. No data is then sent to Sentry.
9. International transfers
| Service | Location | What is transferred |
|---|---|---|
| Firebase Storage (backup and sync) | United States (us-east1) | encrypted blocks + metadata |
| Firebase Authentication | Google infrastructure | sign-in process |
| Sentry | Germany (EU region) | redacted error reports |
| Rate services | depending on provider | no personal data |
For users in the European Economic Area, the transfer to the United States constitutes a transfer to a third country. Google LLC relies on the European Commission's Standard Contractual Clauses and on the EU-US Data Privacy Framework.
The practical effect of the encryption described in section 6 deserves emphasis here: the transferred content is unreadable to the storage provider. Only the metadata — path, size, timestamp — is visible.
10. Retention periods
| Data | Period |
|---|---|
| Data on your device | until you delete it or uninstall the app |
| Cloud backup | until you overwrite it or delete your account; only the most recent version is kept |
| Sync segments | until account deletion |
| User account (identifier, name, email) | until account deletion |
| Error reports | per Sentry's retention period, at most 90 days |
| Receipt image and audio | not retained — they exist only in memory during processing |
11. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, write to privacy@getkaioro.com.
Two characteristics of a local-first app deserve a clear explanation:
- Access and portability are yours immediately and without going through us. All your data is on your device, and the export function hands it to you as CSV, JSON, PDF or XLSX whenever you want. You do not need to request it from us.
- We cannot hand you the contents of your cloud backup, because it is encrypted with your passphrase and we have no access to it.
If you believe the processing infringes applicable law, you may lodge a complaint with the supervisory authority of your country of residence.
12. Deleting your account and your data
In the account settings of the app you will find the option to delete your account. Confirming it deletes:
- the local database on your device,
- the encrypted backup in the cloud,
- the sync segments of all your devices,
- your user account in the authentication system.
Files you exported yourself are not deleted, nor are error reports already transmitted — those expire on their own after no more than 90 days.
You can also request deletion without having the app installed, via https://getkaioro.com/en/delete-account or by writing to privacy@getkaioro.com.
13. Minors
Kaioro is intended for people aged 16 and over. The app is not designed for children and does not knowingly collect data from anyone below that age.
Please note that paid features require legal adulthood or the consent of a parent or guardian; details are set out in the Terms of Use.
14. Regional provisions
14.1 European Economic Area and United Kingdom (GDPR)
This policy is written to the GDPR, which sets the strictest standard and applies in full to users in the EEA. Legal bases are in section 4, rights in section 11, international transfers in section 9.
There is no automated decision-making producing legal effects within the meaning of Art. 22 GDPR. The analyses, forecasts and suggestions Kaioro displays are computed by deterministic rules on your device, have no effect towards third parties, and use no artificial intelligence.
As the controller is established outside the European Union and processing is occasional and limited in scope, no representative under Art. 27 GDPR has been designated.
14.2 Brazil (LGPD)
For data subjects in Brazil, the Lei Geral de Proteção de Dados (Law 13.709/2018) applies. The legal bases in section 4 correspond to Art. 7 LGPD: performance of contract (item V) and legitimate interest (item IX). The rights under Art. 18 LGPD — confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and withdrawal of consent — are exercised through the channel named in section 11.
The point of contact is the controller identified in section 1.
14.3 United States and California
Kaioro does not sell personal information and does not share it for cross-context behavioural advertising within the meaning of the California Consumer Privacy Act. There is no advertising mechanism in the app and no advertising identifier.
California residents have the rights to know, delete and correct their information, as well as the right not to be discriminated against for exercising them. The route is the same as in section 11.
15. Changes to this policy
We publish any changes at this same address and always state the date of the last update. If a change materially affects the processing of your data, we will inform you in the app before it takes effect.
16. Contact
Privacy: privacy@getkaioro.com General enquiries: support@getkaioro.com WhatsApp: +595 976 610546
Stephen Jorg Messing Darchinger · Av. Mariscal Estigarribia 57, 2000 Areguá · Paraguay · RUC 7360149