Privacy Policy

1. Information Koa collects

Account and profile information

Koa uses Sign in with Apple. We may receive an Apple-provided user identifier, your name, and your email address or Apple relay email, depending on what you choose to share. Koa also stores the display name you choose and authentication information needed to keep you signed in. If you choose or take a profile photo in Settings, Koa strips embedded metadata, resizes and compresses the image, stores it in private Supabase storage, and keeps an account-scoped device cache so the photo can appear across your devices and while offline. A pending upload or removal may remain on your device and retry after relaunch. Koa does not receive your Apple ID password.

Financial information you provide

Koa stores information you enter or import, including transactions, amounts, dates, descriptions, merchant names, longer notes, category names, selected icons and colors, payment methods, tags, recurring schedules, manual accounts and balances, investment holdings, one or more BTC or ETH quantities in a manual crypto account, historical balance and net-worth records, and related preferences, such as how transaction amounts are split. Imported files are normalized for use in Koa; raw CSV files are not retained after processing.

Koa suggests merchant names from transactions you can view in Koa, including connected-account activity and visible Group activity. Choosing a saved merchant may fill an empty category or payment method with that merchant's most common choice in visible transaction history. You can edit or replace every suggestion. Koa also keeps a protected, account- and ledger-scoped merchant suggestion list on your device so it is ready after relaunch. Koa updates this list from activity you can view and removes it during normal sign-out.

To show a transaction edit timeline across your devices, Koa stores prior and replacement transaction values, an optional note explaining the edit, edit times, and the editor's internal account identifier in Supabase and downloads all edit history you are currently authorized to view into the on-device cache during ledger synchronization. The timeline may also record a visible transaction change caused by renaming, replacing, merging, or deleting an assigned category, payment method, or tag. Edit history is not included in exports.

Financial institutions connected through Plaid

If you connect an institution, Plaid collects your authorization and institution credentials and provides Koa the information you consent to share. When account selection is available, you may choose one or more eligible accounts and Koa receives and stores only the accounts you select. For some OAuth institutions, that choice may appear on the institution's site instead of in Plaid. Depending on the selected account and available Plaid products, Koa may receive institution names and optional institution branding, account names and types, masked account numbers, balances, transactions, credit or loan details, investment holdings, securities information, and investment activity. Koa does not receive or store the username and password you use with your financial institution. Plaid processes information under its own End User Privacy Policy.

If Plaid does not provide an institution image, Koa may display a reviewed public institution mark hosted in Koa's own Supabase storage. This shared image library contains no user or account data.

Koa may retrieve merchant logos supplied by Plaid to help you recognize account transactions. Koa keeps a shared server cache of these generic brand images and saves images with authorized account transactions on your device for offline viewing. Koa also keeps a device-local merchant image catalog to show matching images on manually entered transactions and recurring schedules. These generic images can remain available for your visible manual activity after an institution is disconnected or Group membership ends. This local image catalog is not synchronized between devices or included in device backups. The shared image cache contains no user or account identity. Normal sign-out removes device copies, and disconnecting an institution removes its transaction-to-image associations. Generic brand images may remain in the shared cache for reuse after an institution is disconnected or a Koa account is deleted.

Plaid may also notify Koa when an authorized connection needs attention or when authorized account, transaction, holding, or investment-activity data has changed. Koa uses these notices to offer connection repair, request renewed or additional permission, and refresh the information you authorized. For security, duplicate protection, and troubleshooting, Koa may retain a redacted webhook receipt for up to 90 days. A receipt may include the delivery time, limited event and error codes, an internal connection reference, and a cryptographic hash of the exact delivery body. Koa does not retain the webhook body, institution credentials, access tokens, account balances, or transaction content in these receipts.

If Plaid authorization succeeds but Koa cannot finish the first import, Koa keeps the authorized connection and protected access token so you can retry setup without reconnecting. Account names, balances, and other details already returned by Plaid may appear while setup is incomplete. You can remove the institution at any time to revoke Koa's Plaid access and stop future connection use.

Apple Wallet information through FinanceKit

If FinanceKit is available and you choose to connect Apple Wallet accounts, you select the eligible accounts and history Koa may read from the on-device FinanceKit store. Koa may copy selected Apple Cash, Savings, and Apple Card account details, balances, and transactions into your member-owned Koa account so they can appear in Accounts, history, and net-worth features across your devices. FinanceKit authorization and reads happen on your device, including when iOS delivers authorized changes to Koa in the background. Koa does not receive Apple Wallet credentials or provider tokens.

To prepare an update before you open Koa, the app may temporarily stage a bounded, normalized copy of the selected Apple Wallet data and a display-ready Koa account snapshot in private app-group storage on your iPhone. Koa then sends the selected Wallet copy to your private Koa account and replaces the staged files after processing. iOS decides whether and when background work runs, so Koa does not promise that balances are current when you open the app. Signing in from Koa's signed-out state or pulling to refresh on Home or Accounts requests an update while you use Koa.

Groups and shared ledgers

If you join a Koa Group, other active members can see your display name, optional profile photo, role, and the transactions or recurring activity made available to that shared ledger. Profile-photo access ends when active membership ends. Transactions you mark private are visible only to you. Joining a Group may make your existing personal transaction history visible to the Group after you confirm that action. Edit history follows the transaction's current visibility. Other members cannot read a private transaction's timeline; if you later make it shared, active members can read its complete retained timeline, including edits made while it was private.

Active Group membership also automatically shares your complete sanitized Accounts view with every other active member. This includes selected Plaid and Apple Wallet accounts, manual accounts, account names and masked digits, balances, holdings, bank transactions, investment activity, imported account balances, per-account balance history, and all retained or imported net-worth history. This applies to existing Groups when the feature becomes available and does not have a separate per-account or per-member opt-out. The Personal/Group control changes only what you are viewing. You continue to own and manage your accounts; neither the Group owner nor another member can edit, repair, import into, or remove them.

Joining exposes your complete retained Accounts history. Leaving, removal, disbandment, or account deletion stops future access through the former Group. Another member's device may keep the last authorized sanitized Group view for offline use until that device reconnects or signs out, and copies such as screenshots or exports cannot be recalled. Pulling to refresh from Home or Accounts may ask Koa's server to refresh every active member's Plaid connections, even while the Personal view is selected. Apple Wallet reads remain device-local, so another member's Wallet data stays at its latest saved Koa value until their own device updates it.

Push notification information

If you enable Group transaction notifications, Koa stores an installation identifier, the Apple Push Notification service device token and environment for that installation, and your preference for your exact current Group membership. An eligible alert contains the transaction author's display name, transaction description, and amount. Koa does not send private transactions, transaction notes, splits, imports, recurring transactions, or connected-account activity in these alerts. The member who records the transaction does not receive an alert for it.

Application diagnostics

Koa records sanitized troubleshooting events on your device for synchronization, connected-account refreshes, background work, profile operations, and optional Google Sheets delivery. These may include event times, app version and build, random operation and technical record identifiers, fixed triggers and outcomes, queue operations, bounded counts, request duration, HTTP status, and limited error classifications. They exclude financial values, transaction descriptions and notes, category and payment names, email and display names, credentials, full URLs, request and response bodies, raw provider or database errors, and localized error text.

Diagnostic files are excluded from device backups. Koa removes old files during diagnostic activity and export, retaining up to 14 days within a 5 MB storage limit; older files may be removed sooner when that limit is reached. Files can remain while the app is not running. Explicit sign-out removes the local logs; unexpected authentication loss preserves them. You may export or clear the local journal from Settings and choose where to save or share an export. Copies you save outside Koa are under your control.

When a ledger synchronization or Accounts refresh finishes, Koa automatically sends Supabase one content-free operational summary. It contains a random operation identifier, fixed component, trigger, outcome and error classifications, timing, bounded work counts, bootstrap status, and app version/build. It does not contain your user or ledger identifier, financial information, transaction or account content, provider identifiers, credentials, URLs, or request and response bodies. These summaries are private to Koa operations, cannot be read directly by the app, and are deleted after 30 days.

Technical and support information

Koa and its infrastructure providers may process IP address, browser or device type, request times, authentication events, and limited diagnostic information needed to deliver, secure, and troubleshoot the app and website. If you contact support, Koa receives the information in your message. Koa does not currently use advertising or behavioral-analytics SDKs. The public website does not use analytics or advertising cookies.

2. How Koa uses information

Koa uses information to:

• authenticate you and operate your Koa account;
• record, organize, search, report on, and synchronize your financial information;
• connect accounts you authorize and maintain their current data;
• calculate balances, spending information, account history, and net worth;
• provide Group collaboration and privacy controls you choose;
• send optional alerts when another Group member records an eligible shared transaction;
• complete imports, backups, exports, and recurring activity you request;
• secure, maintain, diagnose, and improve Koa; and
• comply with law and protect Koa, its users, and others.

Koa does not use connected financial information to make lending, insurance, employment, housing, or other eligibility decisions.

3. When information is shared

Koa does not sell personal information and does not share it for cross-context behavioral advertising. Information may be disclosed in these limited circumstances:

• A Plaid connection whose first Koa import is incomplete remains stored and authorized so setup can be retried with the same protected token. Any account details already returned may also remain stored. This information is kept until setup succeeds, you remove the institution, or you delete your Koa account.
• Service providers. Supabase provides authentication, database, synchronization, and server functions. OpenAI Sites and Cloudflare help host and deliver the website and domain services. Apple provides Sign in with Apple, FinanceKit, and Apple Push Notification service. If you enable notifications, Apple processes the device token and alert payload to deliver them. Plaid provides financial-account connectivity. These providers process information to supply their services and under their own contractual and privacy obligations.
• At your direction. If you enable the optional Google Sheets export, Koa sends the transactions you choose to the Apps Script and spreadsheet configuration on that device. If you add longer transaction notes, those notes remain in Koa and are not included in Google Sheets exports or transaction share images. If you join a Group, Koa shares ledger and complete sanitized Accounts information as described above. Koa may request shared BTC or ETH market prices from CoinGecko, without sending your account, quantity, or transaction data.
• Legal and safety reasons. Information may be disclosed when reasonably necessary to comply with law, respond to valid legal process, prevent fraud or abuse, protect rights or safety, or investigate a security incident.
• Business transfer. If Koa is involved in a sale, merger, reorganization, or transfer, information may transfer as part of that transaction subject to this policy and applicable law.

4. Storage and security

Koa stores its canonical synchronized records with Supabase and keeps an on-device cache and pending-change queue for offline use. Plaid access tokens and Koa's provider credentials remain in protected server-side storage and are not included in the app or exposed to authenticated clients. Koa uses access controls, encryption in transit, device security facilities, and data minimization intended to protect your information. No system can guarantee absolute security.

Koa and its providers may process information in the United States and other locations where they operate. Their data-protection laws may differ from those where you live.

5. Retention and deletion

Koa generally keeps account and financial records while your account is active or until you delete them. Specific lifecycle rules include:

• Marking a tag inactive keeps its label on existing transactions and available in filters, while removing it from recurring schedules. You can reactivate it for future use or permanently delete it to remove its transaction assignments. Choosing to keep a tag on existing transactions during deletion marks it inactive.
• Disconnecting a Plaid institution revokes Koa's Plaid access and deletes that institution's imported accounts, transactions, balances, holdings, connection-specific cached institution branding, and account history from Koa. Shared public institution marks are not connected to your account and remain in Koa's general image library. Previously saved aggregate daily net-worth facts remain, but no longer include account-level details that identify the disconnected institution.
• Removing Apple Accounts deletes the FinanceKit accounts, balances, and transactions saved by Koa. It does not change Wallet access in iOS Settings. Any staged Apple Wallet background file is also removed. Previously saved aggregate daily net-worth facts remain.
• Deleted transaction tombstones are generally retained for 90 days to resolve changes from offline devices. Private mutation receipts may be retained for 180 days to prevent duplicate retries. A non-content identifier for a deleted manual account may remain to prevent a stale device from recreating it.
• Redacted Plaid webhook receipts are retained for up to 90 days to verify and deduplicate provider deliveries and investigate connection issues. The underlying webhook body and financial payload are not retained in those receipts.
• A push token is cleared when you sign out, when it is replaced, or when Apple reports that it is no longer valid. Group notification consent is tied to the exact membership where you enabled it, so a later membership does not inherit that choice. Terminal notification event and delivery history may be retained for up to 30 days; pending delivery work remains until it reaches a terminal outcome.
• Incomplete import staging data is generally removed after seven days. Completed provenance and daily net-worth facts remain for the life of the Koa account unless replaced or the Koa account is deleted.
• Normal sign-out first attempts to synchronize pending work, then removes the signed-in account's cache, outboxes, preferences, and account-scoped secrets and background-staged account files from that device. If authentication is lost unexpectedly, local data may be preserved so unsynchronized work can be recovered, but staged data is matched to the signed-in account before Koa can display it.
• Replacing a profile photo overwrites the prior stored image, and removing it deletes the private stored image after pending work can synchronize. Koa removes locally cached member photos when Group access ends on a connected device. An offline device may retain its last authorized cache until it reconnects. Deleting the Koa account removes its stored profile photo.
• Transaction edit history remains with its transaction through soft deletion and restoration. It is permanently removed when Koa purges the transaction tombstone after its retention period, during an applicable bulk erasure, or when the account is deleted. Normal sign-out removes the on-device history cache after pending work is synchronized; the canonical history remains available after a later sign-in unless the underlying transaction has been permanently removed.
• Koa may keep the last sanitized Group Accounts view on a member's device for offline use. A confirmed departure from the Group or normal sign-out removes that cache on a connected device, but an offline device cannot receive the revocation until it reconnects.

Backups, CSV or JSON exports, Google Sheets copies, screenshots, and data you shared with other people are outside Koa's control after they leave Koa. Service providers may retain limited information as required by law or for security, fraud prevention, and backup integrity.

6. Your choices and rights

• Choose which eligible accounts and history to connect.
• Remove a Plaid institution or Apple Accounts from within Koa.
• Manage FinanceKit authorization separately in iOS Settings.
• Manage or delete a Plaid connection through Koa and, where available, Plaid Portal.
• Leave or disband a Group to stop future Group access to your Accounts data; Koa does not provide a separate Accounts-sharing opt-out while you remain an active member.
• Turn Group transaction notifications off in Koa or disable Koa notifications in iOS Settings.
• Disable optional Google Sheets export and manage exported copies in your Google account.
• Edit or delete supported records and privacy settings in Koa.
• Request access, correction, export, or deletion of your Koa account data by contacting Koa.

Rights vary by location. Koa may need to verify your identity before completing a request and may retain information where legally permitted or required. Koa will not discriminate against you for exercising an applicable privacy right.

7. Children's privacy

Koa is not directed to children under 13, and Koa does not knowingly collect personal information from children under 13. If you believe a child provided information to Koa, contact us so it can be reviewed and deleted where appropriate.

8. Third-party services

Third-party services have their own privacy practices. Review their policies and consent screens before connecting or exporting data. Koa's policy does not control information those services collect directly, including information Plaid receives during Link or Apple processes under its platform services.

9. Changes to this policy

This policy may change as Koa develops. The effective date above will be updated when the policy changes. If a change materially affects how existing personal information is used, Koa will provide notice appropriate to the change before it takes effect.

10. Contact

Koa is operated by Matt Lichtenstein in Florida, United States. For privacy questions or requests, email privacy@koamoney.app. For general support, email support@koamoney.app.