Privacy Policy

Last updated: June 2026

Koruja (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our service.

1. Data We Collect

Account data. When you create an account via Google OAuth or email/password, we receive and store your name, email address, and (for Google sign-in) profile picture.

Financial data. You may enter financial transactions, including descriptions, amounts, dates, categories, and account balances. All financial data is manually entered by you through the application interface.

Usage data. We collect anonymized usage statistics and error reports to improve the service.

2. How We Use Your Data

We use your data exclusively to provide and improve the Finance Tracker service — displaying your financial overview, categorizing transactions, tracking balances, and generating insights.

We do not sell your personal data. We do not use your financial data for advertising, credit scoring, or profiling beyond what the application displays to you.

3. Data Storage

Your data is stored on infrastructure provided by:

Neon (PostgreSQL) — primary database for all application data.
Upstash (Redis) — session caching and rate limiting.

Both providers are GDPR-compliant and encrypt data at rest and in transit.

4. Third-Party Services

We rely on the following third-party services to operate Finance Tracker:

Google OAuth — authentication provider for Google sign-in. Google receives your sign-in request but does not receive your financial data.
OpenAI— used for automatic transaction classification. Transaction descriptions (not account details) may be sent to OpenAI's API for category suggestions. OpenAI does not retain this data for training.
Sentry — error and performance monitoring. Sentry receives anonymized crash reports and performance metrics.

5. Cookies

We use a session cookie managed by NextAuth to keep you signed in. This cookie is essential for the application to function and does not track you across other websites. We do not use analytics or advertising cookies.

6. Your Rights

Under applicable data protection laws, you may:

Access — request a copy of the personal data we hold about you.
Correct — update inaccurate or incomplete data.
Delete — request deletion of your account and all associated data.
Export — receive your data in a structured, machine-readable format.

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account, all personal and financial data is permanently removed from our systems within 30 days.

8. Security

We implement industry-standard security measures including encrypted connections (HTTPS), database encryption at rest, and secure authentication flows. However, no method of transmission over the Internet is 100% secure.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the application.

10. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at:

contato@koruja.app.br

← Back to sign in