Privacy Policy

Last updated 27 October 2026

Who we are

Kaciin is a personal expense and debt tracker, available at https://kaciin.com and run by Kaciin in Malaysia. In this policy, "we" and "us" mean Kaciin. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. You can reach us at [email protected].

The short version

• We collect only what we need to run your account and save your expenses and debts.
• We do not sell your data, show ads, or use advertising trackers. We only count visits with a cookie-free statistics tool.
• Your expenses and debts are private to your account. Not even the Kaciin admin can read them.
• You can export your data or delete your account at any time.

Information we collect

Account details: your email address and username. If you sign up with email, your password is stored in scrambled (hashed) form by our sign-in provider, so nobody, including us, can read it.

Information from Google: if you choose Sign in with Google, see the section "Google user data" below.

Your Kaciin data: the expenses, debts, instalment payments, budget, income, currency, starting month and other settings you enter.

Usage details: the date you joined and the last time you opened the app.

Feedback and requests: messages you send with the Send feedback button, and account deletion requests (with your email and username).

Technical details: like most websites, our hosting and database providers automatically record basic technical information when you use the app, such as your IP address, browser type and the time of each request. These records are used for security and to keep the service running.

Visit statistics: we use Cloudflare Web Analytics to count visits to our website, such as how many people opened a page and which kind of browser or country they came from. It does not use cookies, does not follow you across other websites, and does not build a profile of you.

Google user data

If you choose Sign in with Google, we ask Google only for basic sign-in permissions ("openid", "email" and "profile"). With your permission, Google shares with us:

• your name
• your email address
• your Google account ID
• a link to your Google profile picture

How we use it: we use your email address and Google account ID to create your Kaciin account and sign you in, your name to set your starting username, and your email address to contact you about your account (for example, about a deletion request). Your profile picture link is stored with your sign-in record by our sign-in provider, but Kaciin does not display or use it.

What we do not do: we do not ask for or access your Gmail, contacts, calendar, Google Drive, or any other Google data. We do not use Google user data for advertising, we do not sell it, and we do not use it to build profiles of you.

Sharing: Google user data is stored only with Supabase, our database and sign-in provider, so the app can work. We do not transfer it to anyone else, except if required by law or to protect the security of the service.

Keeping and deleting it: we keep this data while your account is open and delete it when your account is deleted. You can also remove Kaciin's access to your Google account at any time at https://myaccount.google.com/permissions.

Kaciin's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

• To create and run your account and sign you in.
• To save your data so you can see it on any device you sign in on.
• To show your totals, budget, history and debt progress.
• To keep the service working and secure, and to stop misuse.
• To answer your feedback and handle deletion requests.
• To send important service emails, such as sign-up confirmation and password resets.

We do not use your expenses or debts for advertising, and we do not make automated decisions about you.

Who can see your data

Your expenses and debts are private to your account. They are protected by access rules in our database, and the Kaciin admin cannot read them.

The admin can see your account details (username, email, plan, join date, last seen), your feedback and your deletion requests, so we can run and support the service.

We do not sell, rent or trade your personal data.

Service providers we use

We use a few trusted companies to run Kaciin. They process data only on our behalf, to provide their service:

• Supabase: database, sign-in and account emails. Stores your account and Kaciin data.
• Cloudflare: hosts the Kaciin website, protects it from attacks, and provides cookie-free visit statistics.
• Google: provides Sign in with Google, if you choose it.

We may also share information if the law requires it, or to protect the rights and safety of our users or the service.

Stored on your device

Kaciin saves some information in your browser's storage (or the app's storage on your phone) so the app works quickly and keeps you signed in:

• your sign-in session
• a copy of your data and settings
• your profile photo, if you add one. Your photo stays only on your device and is never uploaded to us.
• a count of failed sign-in attempts, to protect your account

We do not use advertising or tracking cookies.

Guest mode

You can use Kaciin as a guest without an account. In guest mode your data stays only on your own device and is not sent to us. We cannot see it or recover it, so it can be lost if you clear your browser data, uninstall the app or lose your device. If you create an account later, your guest data can be saved to your account.

Where your data is stored

Your data is stored with Supabase on servers that may be located outside Malaysia. By using Kaciin, you understand that your data may be transferred to and stored in those countries, where we rely on our providers' security measures to protect it. When paid plans start, payments will be handled by a payment provider, and we will not see or store your full card details.

How long we keep it

We keep your account and Kaciin data while your account is open. You can ask us to delete your account in the app (Profile, then Delete account). We process requests within 3 to 7 working days. We then permanently delete your account and its data, including Google user data, and it cannot be recovered. Some copies may remain in our providers' secure backups for a short time before they are removed. Feedback you sent may be kept after your account is deleted, without being linked to your account.

Your rights and choices

• See and change your data in the app at any time.
• Export your data from Profile.
• Delete your account from Profile, then Delete account.
• Ask us what personal data we hold about you, or ask us to correct it, by emailing [email protected].
• Withdraw your consent by deleting your account, or remove Google access at https://myaccount.google.com/permissions.

We will reply to requests within a reasonable time, as required by Malaysia's Personal Data Protection Act 2010.

Security

We use encrypted connections (HTTPS), hashed passwords and database access rules to protect your data. No online service is perfectly secure, so please choose a strong password and do not share it. If we learn of a security problem that affects your data, we will tell you as required by law.

Children

Kaciin is not meant for children under 13, and we do not knowingly collect their data. If you believe a child has given us information, contact us and we will remove it.

Changes to this policy

We may update this policy. When we make an important change, we will tell you in the app before it takes effect. The date at the top shows the latest version.

Contact

Questions or requests about your privacy: [email protected]