SAKU

ID EN

Privacy Policy

Last updated: April 19, 2026

SAKU ("we", "us", or "the app") is developed by Pena Studio. This Privacy Policy explains how we collect, use, and protect your information when you use the SAKU application.

1. Core Principle: Privacy-First

SAKU is designed with a local-first principle. That means all your financial data (wallets, sakus, transactions, categories, budgets) is stored by default on your own device, not on our servers.

We only process your data on the server when you explicitly:

• Link your Google account for synchronization
• Enable collaboration on a specific wallet

2. Data We Collect

2.1 Data on Your Device (Never Sent to Server)

• 6-digit PIN: stored as a hash (SHA-256 + salt) in the device's secure storage. We never see or have access to your PIN.
• Financial data: wallets, sakus, transactions, categories, and budgets are stored in the device's local SQLite.
• App preferences: language, theme, notification settings.

2.2 Data We Receive (Only If Google Is Linked)

• Google account info: email, name, and profile photo URL (from Google OAuth).
• Collaborative wallet data: only wallets where you enable "Collaboration" are synced to our server. Personal wallets remain on-device.

2.3 Technical Data (Minimal Analytics)

• App version, operating system, device type — for bug diagnostics.
• We do not use third-party tracking cookies (Google Analytics, Facebook Pixel, etc).

3. How We Use Data

• Provide core app functionality (financial tracking).
• Sync data across your devices (if Google is linked).
• Enable wallet collaboration with members you invite.
• Restore PIN via Google account verification (if you forget).
• Fix bugs and improve app quality.

4. Sharing Data with Third Parties

We do not sell your data to anyone. We only share data with service providers we use to operate SAKU:

• Supabase (PostgreSQL hosting) — stores collaborative wallet data.
• Resend (email service) — sends notification emails when needed.
• Google OAuth — verifies your identity when you sign in with Google.

All these partners have their own privacy policies and security standards.

5. Data Security

• PINs are stored as hashes in iOS Keychain / Android Keystore — unreadable by other apps.
• Connections to our server are encrypted via HTTPS/TLS.
• Google auth tokens are stored in secure storage.
• Rate limiting: 5 PIN attempts before a 15-minute lock.

6. Your Rights

You have the right to:

• Access all data we store about you.
• Delete your data — the Profile screen has a "Reset All Data" button that clears all local data, and an "Unlink Google Account" option to remove server binding.
• Export your data in a standard format (feature available in future versions).
• Revoke Google authorization anytime from the Profile screen.

7. Children's Data

SAKU is not intended for users under the age of 13. We do not knowingly collect data from children. If you are a parent/guardian and believe your child uses SAKU, please contact us.

8. Policy Changes

We may update this policy from time to time. Significant changes will be announced in the app or by email (if Google is linked). The "Last updated" date above indicates the latest version.

9. Contact

Questions about this privacy policy can be sent to:
surelna.studio@gmail.com