Privacy Policy — Kinto

Last updated: April 8, 2026

Welcome to Kinto. We take the protection of your personal data very seriously. This policy explains how we collect, use and protect your information.

1. Data We Collect

Account (optional): email and full name if you create an account. The app works entirely without an account.
Financial transactions: amounts, categories, descriptions, dates — entered manually or via receipt scan. This data belongs entirely to you.
Receipt photos: receipt images and their associated transaction metadata (amount, merchant, date) are securely transmitted for analysis. No image is stored permanently on our servers.
Budget and goal data: set up by you, stored locally (guest mode) or in our secure database (account).
Preferences: language, currency, theme — stored locally on your device.

2. Guest Mode — 100% Local Data

If you use Kinto without an account, all your data stays exclusively on your device. No information is transmitted to our servers. Uninstalling the app permanently deletes local data.

3. User Account — Secure Storage

If you create an account, your data is stored in our secure database (Supabase / PostgreSQL) with encryption at rest and in transit (TLS 1.3). Your financial data is never shared, sold or used for advertising purposes.

4. AI Receipt Scanner (Google Gemini)

Kinto uses artificial intelligence to automate expense entry. When you use the scanner, your receipt images are securely transmitted to Google (Gemini AI) for information extraction. Processing is instantaneous: Google does not retain these images for persistent purposes and does not use them to train its AI models or for advertising. We ensure our partners offer a level of data protection equivalent to our own.

5. Premium Subscription

Payments are managed exclusively via the Apple App Store or Google Play. We do not collect or store your banking or credit card information. Subscription receipts are provided by Apple/Google.

6. Data Sharing

We never sell, rent or share your personal data with third parties for commercial purposes. The only third-party access is:

Supabase: database hosting (EU servers)
Google (Gemini AI): receipt analysis and data extraction (no persistent storage or training)
Apple / Google: in-app purchase management

7. Security

TLS 1.3 encryption for all communications
Secure authentication via Supabase Auth
No employee access to personal financial data
Regular encrypted backups

8. Your Rights (GDPR)

You have the following rights:

Access: view all your data via in-app export
Rectification: edit your data directly in the app
Deletion: delete your account and all your data from Profile → Delete Account
Portability: export your data as CSV (Premium)

9. Data Retention

Your data is retained as long as your account is active. After account deletion, all data is erased within 30 days. Local data (guest mode) is deleted immediately upon uninstallation.

10. Minors

Kinto is not intended for individuals under 13 years old. We do not knowingly collect data from minors.

11. Contact

For any question about your data: kinto@nourgroupe.com

Kinto is published by Nour Groupe.