Privacy

The short version

Our apps are local-first. What you enter — a budget in Lunas, a set of books in Arus, your progress through Learning — is written to your own device first, and reaches our servers only if you sign in so that it can follow you between devices.

Signed out, none of your figures leave the browser. That is not the same as our servers knowing nothing about the visit: we host the pages you are reading, so ordinary web request information reaches us either way, and this marketing site counts page views. Both are described below.

We never ask for your online banking credentials. That is a commitment, not a current limitation — there is nothing to hand over, so there is nothing for us to lose.

What does reach our servers is encrypted before it is stored, with the key kept somewhere the database is not.

We do not sell your data or pass it to data brokers, and we do not build a profile of you from it.

Who we are

KapiX Digital Enterprise, Unit A10, Lumapas Junction, BSB, Brunei, BJ2724 builds KapiX Learning, Lunas and Arus, and is the data controller for the information described here.

For anything in this policy, write to hello@kapix.io. A person reads it.

If you use Arus to keep books for a business, some of what you record may be information about other people — a customer's name, a supplier's details. For that material you are the one deciding what to record and why; we hold it on your behalf. If you need a written arrangement to that effect, ask.

What we collect

It depends on whether you sign in.

Used without an account, the apps keep everything in your browser's local storage and send none of it to us. No account, no server copy, and no way for us to see your figures — the trade is that the data lives on that one device only.

If you create an account, we hold the following:

• Your email address, and your name and profile picture if you signed in with Google or Apple. That is what the sign-in provider gives us, and we ask for nothing beyond it.
• If you set a password, a scrypt hash of it — never the password itself. It is kept in a table of its own so that it cannot be selected by accident alongside your account details.
• What you enter into the apps — in Lunas, your income, bills, savings goals, balances and transactions, and the people you split a bill with — a name, and a phone number if you add one so a reminder can open WhatsApp on it; in Arus, your business's journal entries and the contacts they name; in Learning, which lessons you have finished and which levels you have passed.
• In Arus, photos you take inside the app — a picture of how a product should look on its checklist, or of goods as you checked them before a customer collected. They are shrunk to a small size on your device before they are sent, encrypted like everything else, and kept only for the checks they belong to. The app never looks at photos you did not take in it.
• In Arus, the customers you choose to note on a till sale or on something set aside for them — a name, an Instagram handle or an email, and a phone number if you type one — and, when you record them, their memberships, store credit and bookings. Encrypted like the rest; the number is matched through a keyed fingerprint of its last digits, never stored readable.
• If your business uses Arus as a team: when each person clocked in and out, their usual working days and hours, any leave, day off or sick day recorded for them with its optional note, and whether they confirmed watching a till being counted. Why somebody is away is shown only to the owner and managers; colleagues see only that they are away.
• If your Arus team shares positions: where a person's phone is, about every half-minute, while they are clocked in or out on a delivery and Arus is open on the screen — never once it is locked or closed. Each person is told what is recorded and agrees before the first point. The owner and managers see everyone's last position; everybody else sees only their own. Positions are deleted after 90 days.
• If you connect a Take App store to Arus: the orders it sends — what was ordered, the amount, whether it was paid, and the customer's name — until you record or dismiss them, and a signing secret used only to confirm each order really came from Take App.
• If a business takes orders on its Arus website: what each customer ordered, the name, phone number and email address they gave, a delivery address and note if they wrote one, and — only if they choose to share it at checkout to see the delivery fee — where their phone said they were. The business decides what to do with each order; we hold it on the business's behalf.
• If you scan a receipt: the photo is shrunk on your device and sent once to Anthropic's Claude to read the shop, the date and the total off it. Anthropic does not use it to train its models. In Lunas we do not keep the photo at all — the reading fills in the expense form for you to check, and nothing is added until you tap Add. In Arus the photo is kept in your business's photo store, encrypted like every other photo, and nothing is recorded until you say what the receipt was for.
• If you connect an Instagram professional account to Arus: the account's username and id, an access token (encrypted) that lets Meta tell us when a message arrives, and for each conversation only when the customer last wrote and when you last replied — so Arus can count the conversations waiting for an answer. We do not keep, read or show the messages themselves, and we never send messages. Disconnecting on the Business screen deletes all of it; you can also remove KapiX under Instagram's own Apps and Websites settings.
• A copy of a document from just before it was replaced by a much smaller one. Emptying your budget on one device empties it on all of them, so we keep the last few of those replaced copies as a way back from a reset you did not mean. They are in your data download, and they go when your account does.
• Session records, so you stay signed in. A session is a row in our database rather than a token, which is what makes ending one take effect immediately rather than whenever a token would have expired.
• If you subscribe to Lunas+ through Google Play: which plan you are on, whether it is active, when it renews or ends, and the purchase token Google issues. We send that token back to Google to confirm the payment is real. Google handles the payment itself, and we never see your card or any other payment details.
• If you share a Lunas+ family plan: the email addresses you invite, and whether each person has joined. If somebody invites you, we hold your address against their plan in the same way. If you choose to share figures with your family, we hold your choice — the level, and any categories you keep back — and the plan holder's choice of who may see. The figures themselves are worked out from your own document at the moment somebody cleared to see them looks, and are not stored anywhere else. A reading in plain words sends those figures, and nothing else, to Anthropic's API to be written up; they are not used to train anything.
• Push notification subscriptions, but only if you turn Lunas notifications on. A subscription identifies a browser, not you. The daily expense reminder never contains your figures. The others can — today's safe-to-spend, a bill's amount, what is still owed on a card — because that is what they are for, so they may show on your lock screen. Each one can be turned off on Me.
• Short-lived counters used to rate-limit sign-in, registration and syncing. These are keyed to an email address, an IP address or an account id, and they exist to stop the sign-in form being used to mail strangers and to stop password guessing.
• If you joined a waitlist for a product that was not built yet, the address you gave and which product it was.

What stays on your device

Local storage is part of how these apps work rather than an implementation detail, so it is worth being plain about what is in it.

Your budget, your books and your progress are all held in the browser you are using, under a key belonging to whoever is signed in. Two accounts on one computer do not share a slot, and neither can read the other's.

Signing out ends the session; it does not, by itself, erase the copy in the browser. That is deliberate — it is what lets the app open instantly and keep working with no signal — but it is the wrong default on a shared or borrowed computer, so every app offers a “clear this device” action beside signing out, and deleting your account clears it too.

What we do not collect

Some of this is worth stating explicitly, because other money apps do it.

• Banking credentials. None of our software asks for them, and none of it has any facility to use them.
• Bank or card account numbers. You tell the app what happened; it does not read your accounts. A bank statement you import into Lunas is read on your device and the file never reaches us — only the lines you tick are added, like anything you type.
• Your location — except in Arus, in the two cases described above: a team member's position while they have agreed to share it, and the spot a customer chooses to share at a business's website checkout.
• Your contacts, photos, files or anything else on your device outside the app.

How we use it

To run the products, and for nothing else. Concretely: to sign you in, to keep your data in step across your devices, to send the reminders you asked for, and to protect the service from abuse.

We do not use your financial data to train machine learning models, and we do not profile you, score you, or pass anything to a credit reference agency or a data broker.

Who else touches it

We use a small number of service providers to run the product. Each one is named here, along with what it actually sees:

• Vercel — hosting. Serves the site and the apps, and processes request information such as your IP address in the ordinary course of answering a web request. This happens whether or not you have an account.
• Vercel Web Analytics — page view counts on this marketing site only. It is cookieless and does not track you between sites or build a profile. It does not run inside the apps.
• Neon — the Postgres database that holds accounts, sessions and the documents above.
• Google and Apple — only if you choose to sign in with one of them, and only to confirm who you are.
• Resend — sends the one-time sign-in links, the address confirmation and the password reset. It sees the address the mail goes to.
• Google Play — only if you subscribe to Lunas+ in the Android app. It takes the payment, and tells us when a subscription starts, renews or ends. It never sends us card details.
• GitHub — runs our weekly database backup and stores the result. Each backup is encrypted before it reaches GitHub, with a key GitHub does not have, so GitHub holds files it cannot read.
• Exchange rate data (open.er-api.com) — when you record spending in a foreign currency, we look up a rate. The request contains a currency code and nothing else: no amount, no account, no identifier. It can happen without an account, because recording spending can. You can turn it off in settings.
• Anthropic — reads a receipt you choose to scan, in Lunas or Arus. It receives that one photo, sends back the shop, the date and the total, and does not use it to train its models.
• Push delivery services operated by Apple, Google, Mozilla and Microsoft, if you turn notifications on. They carry each notification encrypted, so they cannot read what it says.

Where it is held, and for how long

Data is held on servers operated by the providers above, which may be outside your country. Where a transfer leaves a jurisdiction with data transfer rules, it relies on the provider's standard contractual protections.

We keep your account data for as long as the account exists, and for thirty days after you ask for it to be deleted so that an accidental deletion can be undone.

We also take an encrypted backup of the whole database once a week, so that losing the database does not mean losing your records. Each backup is destroyed ninety days after it is taken, which means a deleted account is gone from every backup at most ninety days after it is erased. We open a backup only to recover from losing the database itself, never to bring back an account that was deleted. Apart from those backups there is no archive, and no shadow copy of a deleted account.

• Weekly backups: ninety days each, encrypted with a key kept offline.
• Sessions expire after 30 days without use, and sooner if you end them.
• Rate-limiting counters measure windows of minutes, and the rows themselves are removed within a day of their window closing.
• Confirmation and password reset links expire within the hour and can be used once.
• Recovery copies of a replaced document: the last few per app, per account. Making a change that is not a wholesale deletion pushes the oldest one out.
• Deleting your account removes the user record. Sessions, linked sign-in providers, your password, outstanding links, all three apps' documents, push subscriptions, the recovery copies, your Lunas+ record and your family plan membership are removed with it, and so are any waitlist entry and rate-limiting counters attached to your address.

What you can do about it

These are built into the apps rather than being a request you have to make and wait on. Each one is available from Lunas, Arus and Learning, because it is one account and the same data whichever app you happen to have open:

• Export — download everything held for your account as a JSON file. Not a summary: the actual stored documents for all three apps, the recovery copies, and the account details. It deliberately leaves out your password hash and any sign-in tokens, which are of no use to you and dangerous in a file.
• Deletion — delete your account from within any of the apps. You are signed out everywhere at once and the account is erased thirty days later, cascade and all. Signing in again during those thirty days cancels it; after them, nothing is recoverable. Deleting the account does not cancel a Lunas+ subscription bought through Google Play, so cancel that in the Play Store first.
• Full erasure — if you want your data gone at once, backups included, write to us from the account's address and ask for full erasure. We erase the account immediately, and we record it so that restoring a backup can never bring it back. The process is set out on the account deletion page.
• Correction — every figure you have entered is editable by you, directly, at any time.
• Withdrawing consent — turn reminders off, turn exchange rate lookups off, clear the device, or delete the account entirely.

How it is protected

Sign-in is Google, Apple, a one-time emailed link, or an email address and password. A password is stored only as a scrypt hash, in a table separate from your account record, and is never written to a log or an export.

Your documents are encrypted before they are stored. Each account has its own key, which is itself encrypted with a key held outside the database entirely — so a copy of the database, a leaked backup, or anyone at our database provider sees nothing readable. An Arus business's books are encrypted the same way, with a key of the business's own: its records, the names of its customers and suppliers, its notes, till sales and signatures. Dates, stock counts and prices are kept readable so the books can be added up. Everything travels over TLS on the way there.

To be precise about what that does not mean: we hold the key, so we are able to read your data, and we will if you ask us to help with a problem. It is what makes a forgotten password recoverable instead of fatal. Anyone telling you a service can both restore your data and never read it is describing something that cannot exist.

An account is not usable until the address on it has been confirmed, because anyone can type a stranger's address into a registration form. Confirming an address also takes away any password that was set on it before anyone had proved they owned it.

Sessions are database rows rather than tokens. Signing out ends the session you are using; resetting your password and deleting your account end every session on every device at once. Session cookies are Secure, HttpOnly and SameSite in production.

Every database query that touches user data takes a user id from the verified session as its first argument. No endpoint accepts a user id from a URL, header or request body. User ids are UUIDs rather than sequential numbers, so they cannot be guessed or walked.

No system is perfectly secure, and we would rather say so than imply otherwise. If you find a problem, please write to us before disclosing it publicly.

Children

Lunas and Arus are not directed at children.

KapiX Learning is about money as a subject, and some of it is written to be readable by a teenager. It is not directed at children under 13, it is not marketed to them, and it works entirely without an account — so a young reader can use all of it while we hold nothing about them at all.

We do not knowingly collect data from anyone under 13. If you believe a child has created an account, write to us and we will remove it.

Changes to this policy

If this policy changes in a way that materially affects you, we will say so in the app rather than quietly editing this page and relying on the date at the top. The date at the top still tells you when it last changed.

Contact and complaints

Write to hello@kapix.io about anything here, including a request to exercise a right that the in-app tools do not already cover.

This policy is governed by the laws of Brunei Darussalam.

If you are in a jurisdiction with a data protection authority and we have not resolved your concern between us, you have the right to complain to it.