Privacy Policy

Karmash · Effective date: March 12, 2026

    Karmash is a personal finance tracker. Your financial data — transactions, categories, budgets, and goals — is stored exclusively on your device and never sent to any server. We do not have accounts or user profiles.
  

1. What data we collect and why

We collect only what is necessary to make the app work and improve it. Below is an honest breakdown.

a) Your financial data
All transactions, categories, budgets, savings goals, and recurring payments are stored locally on your device using SQLite. This data never leaves your device unless you manually export a backup. We do not have access to it.

b) Analytics (PostHog)
We use PostHog to understand how the app is used. The following information is collected:

App events: opening the app, navigating between screens, using features (e.g. "created transaction", "opened AI scanner", "changed currency setting"). Events do not include financial amounts, category names, or any content you enter.
Device type and operating system (e.g. "iOS")
App language
Country and region — derived from your device's locale settings (not GPS)
City — derived from GPS, only if you grant location permission (see section 2)
Subscription status: whether you are on the free or Pro plan

PostHog processes this data on our behalf. See PostHog's Privacy Policy.

c) Subscriptions (RevenueCat)
If you purchase Karmash Pro, RevenueCat handles the transaction. RevenueCat receives a device identifier and purchase receipt from Apple to verify and manage your subscription. We do not store payment details. See RevenueCat's Privacy Policy.

d) AI features — Google Gemini API
The receipt scanner and AI assistant (voice/text input) are powered by Google Gemini API. Before you use these features for the first time, the app will ask for your explicit consent.

When you use an AI feature, the following is sent to Google's servers:

Receipt scanner: the photo of the receipt (as an image file), your base currency, and your expense category names
AI assistant: the text of your request, your base currency, and your expense/income category names

What is not sent: your transaction history, balances, personal name, email, or any other financial data.

Google processes the request and returns a result. Google does not retain your data beyond the duration of the request. See Google's Privacy Policy.

You can decline AI processing — in that case, the receipt scanner and AI assistant will not be available, but all other app features work normally.

2. Location

The app uses your location in two situations, both requiring your explicit permission:

Auto-detect currency: when you tap "Detect by location" in Settings, the app uses GPS to determine your country and suggest the matching currency. The coordinates are used only at that moment and are not stored or sent anywhere.
City for analytics: on the first launch, the app may request location permission to determine your city and send it to PostHog as an anonymous analytics attribute. If you deny the permission, this step is skipped entirely.

We never track your location continuously or in the background.

3. Data we do not collect

We do not collect your name, email address, or any account credentials (there are no accounts in Karmash)
We do not collect the content of your transactions (amounts, notes, merchant names)
We do not sell or share your data with advertisers
We do not use tracking for advertising purposes

4. Data storage and retention

Your financial data lives on your device. If you delete the app, all local data is deleted with it.

Analytics data in PostHog is retained for 1 year. You can request deletion by contacting us (see section 7).

5. Children's privacy

Karmash is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, please contact us and we will delete it.

6. Security

Because your financial data never leaves your device, there is no server-side risk of a data breach for that data. For the analytics data transmitted to PostHog, standard HTTPS encryption is used in transit.

7. Your rights and contact

You can stop all data collection by uninstalling the app. To request deletion of any analytics data associated with your device, or if you have any questions about this policy, contact:

matvey55561@mail.ru

8. Changes to this policy

If we make significant changes to this policy, we will update the effective date at the top of this page. We encourage you to review this page periodically.