Privacy Policy

This policy explains how Phlorin LLC (“Kemback”, “we”, “us”) handles personal information when you use the Kemback website, web app and mobile apps (the “Service”).

The short version: we collect what we need to run Kemback for you. We don’t sell your data, we don’t use it for advertising, and we don’t track you around the web. You can export everything at any time, and delete your account yourself, in the app (here’s how).

What we collect

Account information. Your email address, and your password, which we store only as a one-way Argon2id hash so that no one, including us, can read it. If you turn on two-step verification or add a passkey, we store what’s needed to check them. Two-step secrets are encrypted.

Signing in with Google, Apple, LinkedIn or Facebook. If you choose to sign in with one of these, it tells us your name, your email address and the id it uses for you. We keep that id and the email it reported, to sign you in and to show you the link. An account created this way has no password until you set one. We never receive your password for that account, never post to it, and never read your contacts, friends or anything else in it. Apple also gives us a token, which we keep encrypted only so we can tell Apple to forget the link when you remove it or delete your account. We keep no other token from these providers. You can unlink any of them under Security, and removing Kemback in your Facebook settings removes that link too.

Your financial data. Accounts, balances, transactions, categories, budgets, bills, goals, rules, tags, notes and files you import (such as OFX, QFX, QIF, CSV or Mint exports). This is the information you choose to put into Kemback.

Documents. If you use Paper Trail, our add-on for documents: the receipts, bills and other files you scan, upload or email to your Kemback documents address; the text of emails sent to that address; and what we read from them, such as the vendor, the date, the total and the due date. We encrypt every file before we store it. Of any account, card or reference number we read, we keep only the last four characters.

Rental Houses. If your household uses Rental Houses, our add-on for rental homes (how it works): the homes and rooms you add (their names, addresses, purchase dates and prices, beds and rental prices), bookings, mortgages, lease templates and leases, the rent, fees and deposits you record, and your tenants’ names, email addresses, phone numbers, language and notes, as you enter them. This is household data: only that household’s members can see it, apart from what each tenant sees of their own booking in the tenant portal (below). It’s included in the household’s data export, and it’s deleted when the household is deleted. We use it only to provide the feature, never for marketing. We email your tenants only the messages the feature sends: their invitation to the tenant portal, a lease to sign, the signed lease, and rent reminders, which are sent only if you turn them on for that booking. Kemback doesn’t process rent or deposit payments: tenants pay their landlord directly, and the landlord records the payment. Your household is responsible for having a basis to keep its tenants’ details.

Tenants and e-signatures. If a landlord invites you to their tenant portal, you use a normal, free Kemback account. There you see only your own bookings, your leases, what you owe and the landlord’s payment instructions, and the payments the landlord has recorded for you; the landlord sees your booking, never your own finances in Kemback. When you sign a lease in Kemback, we keep an e-signature record: the name you typed, the time, your IP address, your browser (its user agent), your user id, and the document’s fingerprint (a SHA-256 hash of its exact text). The signature records and the signed PDFs are kept with the landlord’s household, as part of its data, and are included in its export. They’re kept until the landlord deletes the booking or the household. If you delete your Kemback account, your login goes, but the landlord keeps the booking, the details they entered about you, and the signed lease with its signature records (with your user id cleared), because it’s the record of an agreement you’re a party to. Download your own copy of a signed lease before you delete your account.

Household information. The households you belong to, your role in each, and the email addresses of people you invite.

Bank connection data. If you connect a bank through an aggregator such as Plaid, we receive account and transaction data from it. The aggregator gives us an access token, which we store encrypted. We never receive or store your bank username or password.

Device and security information. When you sign in, we record your IP address, browser or device type, and when the session was last used, so you can see and sign out your devices and so we can detect abuse. We keep a tamper-evident log of security-relevant actions in your account and households. If you turn on notifications in the iPhone or Android app, we store the phone’s push token, encrypted.

Widgets and Siri on your iPhone. If you add Kemback’s widgets to your Home Screen or Lock Screen, or ask Siri about your money, the iPhone app keeps a small summary on the phone, in an App Group (storage on the phone that only the Kemback app and its widgets can read): safe to spend, your next bills and what’s left in this month’s budget, for each of your households. The widgets show it on the Home Screen and Lock Screen as you set them up, and hide the amounts while the phone is locked. The summary stays on the phone: the widgets never connect to our servers and hold no sign-in. It’s deleted when you sign out or delete your account.

Your bills in your own calendar. If you turn on a calendar link on the Bills screen, Kemback makes a private web address for your household’s bills that you can add to Google Calendar, Apple Calendar, Outlook or another calendar app. That calendar’s provider then fetches, every few hours, the bills you can see in Kemback: each bill’s payee, amount and due dates, never account names or numbers. It keeps them under its own terms. We store only a one-way hash of the address, so we can’t show it to you again. Anyone you give it to can see those bills until you make a new link or turn it off on the Bills screen, which stops it at once. Leaving the household or deleting your account turns it off too.

Text-message and WhatsApp alerts. Plus members can choose to get alerts by text message (SMS) or WhatsApp. If you do, we collect your mobile number, which we store encrypted, together with a keyed hash of it so that we can match your replies (such as STOP) to your account. We also keep the time zone you use it in, so we don’t text you at night, a record of your consent (the exact text you agreed to, when, from which IP address, and for which channel), and any opt-outs. Alert messages say only what kind of alert it is and link to Kemback. They never contain amounts, payees, account names or account numbers. We never share or sell your mobile number or your consent to texts, and never use them for marketing. How text message alerts work, with the exact consent text and sample messages.

Purchases in the iPhone app. If you subscribe to Plus in the iPhone app, Apple takes the payment. Apple sends us a signed record of the subscription: the plan, its price and currency, its dates, whether it will renew, and identifiers for the purchase, together with a random identifier we give your account so that the purchase reaches it. We never receive your card details or your Apple ID. We keep this record while you have an account, so we know what you’ve paid for.

The Mac app. The Mac app collects nothing the iPhone app doesn’t, and what this policy says about the iPhone app applies to it in the same way: its push token if you turn on notifications, which Apple delivers; the summary its widgets show, kept on the Mac in an App Group and deleted when you sign out; and Plus bought in it, which Apple takes the payment for.

Messages. If you email us, we keep the conversation.

Marketing email. We send occasional product news and tips by email, but only if you opt in: with the checkbox at sign-up, which starts unticked, or with the switch on your Profile page in the web app, the iPhone app or the Android app. It’s off unless you turn it on. If you gave us your consent another way, such as on a signed form, we may record it with that evidence, but never if you’ve told us no. We keep a record of your choice: when you made it, how (for example at sign-up, on your Profile page, or with a link in an email), which version of the wording you saw, and in which language. Each change also goes in your account’s audit log. The record is included in your data export, and deleted with your account.

The public website. Our public pages don’t use analytics or advertising cookies. We count how many times each blog post is read, without cookies and without recording who read it. When you create an account, we note which page of our website you came from (for example, a blog post), so we know which pages help people. We keep only the page’s address and any campaign tag in the link, not anything about the site you were on before. Our servers keep standard technical logs (such as IP address and request path) for a short time for security and troubleshooting.

How we use it

• To provide the Service: show your register, budgets and reports, sync your devices, import your files, and share what you choose with your household.
• To send the email and notifications you ask for, such as verification links, invitations, alerts and the weekly summary, and essential account messages.
• To send product news and tips by email, only if you’ve opted in. We choose who gets each email from account details only (your plan, whether you pay, your language, when you signed up and which page of our website you came from, and when you last used Kemback), never from your financial data. In the EU and UK, the legal basis for this is your consent, which you can withdraw at any time.
• To keep the Service and your account secure, for example by limiting repeated sign-in attempts and spotting suspicious activity.
• To fix problems and improve Kemback. Where we study how features are used, we use aggregated information, not the contents of your accounts.
• To meet legal obligations and enforce our Terms of Use.

We don’t sell or rent personal information, we don’t share it for advertising, and we don’t use your financial data to market financial products to you.

Who processes it for us

We use a small number of service providers, each bound to use your information only to provide their service to us:

For text messages and WhatsApp, we send these providers only your phone number and the message itself, and the message never includes amounts, payees, account names or account numbers.

How marketing email is sent. Every marketing email shows our legal name and postal address, and has an unsubscribe link at the bottom. If an address bounces permanently, or someone marks one of our messages as spam, Postmark tells us and we stop sending marketing email to that address; a spam complaint also unsubscribes you. Open and click tracking is off. If we ever turn it on, we’ll update this policy first: Postmark would then record whether a campaign email was opened and which of its links were clicked, only so we can count how the campaign did.

How documents are read. When you add a document, we send that document, and nothing else from your account, to Anthropic’s API, which reads it and sends back its details. Under Anthropic’s commercial terms, it doesn’t use what we send to train its models, and it deletes it within 30 days.

For notifications, Apple and Google receive only your phone’s push token and the notification itself. A notification says only that something is waiting, such as how many new alerts you have; it never includes amounts, account names or transactions.

We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business (in which case this policy will continue to apply to your information, or we’ll tell you).

AI assistants you connect

On plans that include it (currently Plus), you can connect an AI assistant, such as Claude (Anthropic), ChatGPT (OpenAI) or Microsoft Copilot, to your Kemback account through our MCP server (how it works). Nothing is shared until you approve it on Kemback’s own consent page, where you see which app is asking and choose which of your households it may read.

• Read-only. A connected assistant can read the accounts, balances, transactions, budget, bills, net worth and reports of the households you chose. It can’t change anything or move money, and it never sees your password, your bank sign-in or other members’ private accounts.
• Only what it asks for. We send the assistant only the answer to each question it asks, when it asks. We don’t send it your data in bulk or in the background.
• The provider’s terms apply. What the assistant receives is handled by its provider under that provider’s own terms and privacy policy, not this one. Check them, in particular whether they use your conversations to train their models.
• Recorded and revocable. Each request an assistant makes is recorded in your account’s activity log (what it asked for, not what we answered). You can see every connection, and disconnect any of them at once, in Security → Connected apps on the web, iPhone or Android app. Resetting your password or deleting your account disconnects them too.
• Tokens are hashed. We store the tokens an assistant uses only as one-way hashes.

Other members of your household

Information in a shared household is visible to its members, according to their roles. Accounts you mark as private are visible only to you. Members can see the household’s activity log.

Cookies

The web app uses two cookies, both necessary for it to work: kb_session keeps you signed in, and kb_csrf protects your account against cross-site request forgery. We don’t use advertising or third-party tracking cookies.

If you sign in with Google, Apple, LinkedIn or Facebook, two short-lived cookies are also used during that sign-in: kb_oauth ties it to your browser, so no one else can complete it, and kb_mfa holds a pending two-step check for up to five minutes.

How long we keep it

We keep your account and financial data while you have an account. Expired sign-in challenges and rate-limit records are removed automatically.

Documents stay while their household keeps them. If nobody in a household has Paper Trail any more, its documents stay readable and downloadable for 90 days, and are then deleted, files included. When you delete a document, a household or your account, its stored files are deleted from storage within minutes.

When you delete your account in the app, it happens straight away (how to delete your account):

• Your sign-in goes. That means your password, passkeys, two-step verification, push tokens and every signed-in device.
• Linked sign-ins are removed. If you signed in with Apple, we also tell Apple to forget the link.
• Households only you belong to go, with everything in them, including their activity log.
• In households you share, you’re removed. Your private accounts there are deleted with their transactions. The shared accounts, transactions and budgets stay with the other members, and that household’s activity log keeps a record of what you did there and that you left, because it is tamper-evident and can’t be rewritten.
• Bank connections you made are disconnected at the bank’s provider.
• Your place on the Plus waitlist goes, if you joined it.
• We send a last email to confirm the deletion.

If you ask us by email instead, we do the same within 30 days, apart from what we must keep by law. Either way, copies in our backups are overwritten within a further 30 days.

Your mobile number. When you remove your number, or delete your account, we delete the number and its consent records. There is one exception: if you opted out by replying STOP, we keep a keyed hash of the number and the date of the opt-out for 4 years, so that your STOP stays honoured. That hash can’t be turned back into your number without our secret key. Texts you send to Kemback’s number are kept encrypted for up to 30 days so our staff can answer them, and then deleted.

Your choices and rights

• Export: download all your data as JSON or CSV at any time, from Your data in the app.
• Correct: change your information in the app, or ask us.
• Delete: delete your account yourself at any time, under Security in the web app, the iPhone app or the Android app; you’ll be asked for your password (and your two-step code, if it’s on). Or ask us to delete it by writing to hello@kemback.com from the email address on the account. If your account has no password, you confirm it’s you by signing in again with a linked account instead. Delete your account explains each way, step by step.
• Email: turn off alerts and the weekly summary in Settings, or with the unsubscribe link in each email. We’ll still send essential account messages. Marketing email is off unless you turn it on. You can turn it off at any time with the link at the bottom of any marketing email (no sign-in needed), your mail app’s own Unsubscribe button, or the switch on your Profile page. That takes effect at once, and doesn’t stop essential account messages, alerts or the weekly summary, which have their own settings.
• Text messages and WhatsApp: you agree to them separately for each channel, and you can turn them off at any time in Settings, or by replying STOP to any of our texts or WhatsApp messages. We stop straight away and send one message to confirm. Reply HELP for help. Carrier message and data rates may apply.

Depending on where you live (for example California and other US states, or the EU and UK), you may have further rights, such as to know what we hold, to object to certain uses, or to complain to a regulator. Write to hello@kemback.com to use them; we won’t treat you differently for doing so. We don’t sell or “share” personal information as those laws define it.

Security

We protect your information with encryption in transit (HTTPS) and for sensitive secrets and every stored document at rest, one-way hashing of passwords and tokens, isolation of each household’s data in the database itself, passkeys and two-step verification, and a tamper-evident audit log. No system is perfectly secure, so please use a strong, unique password or a passkey. Read more on our security page, and report vulnerabilities to security@kemback.com.

Where your data is stored

Your data is stored on servers in Germany. If you use Kemback from elsewhere, including the United States, your information is transferred there, and to our service providers listed above.

Children

Kemback is not for children. You must be 18 or older to create an account, and we don’t knowingly collect information from children under 13.

Changes to this policy

If we change this policy in a significant way, we’ll tell you by email or in the app before the change takes effect. The date at the top shows when it last changed.

Contact

Phlorin LLC, New Jersey, United States. Email: hello@kemback.com.