Hosted Edition Privacy Policy

Version: 2026-09-29. This English text is provided for reference; the Traditional Chinese version governs in the event of any discrepancy. This policy applies to the Hosted Edition of KakePhooa used at kakephooa.com. Visitor analytics and the interest list on the home page are covered by the separate website Privacy Policy. It does not apply to the Self-hosted Edition: your data stays entirely in the environment you manage.

Who is responsible for your data

The Hosted Edition is provided by KakePhooa (operated by Duye Chen as an individual), the collector of the personal data described here. For any question, email [email protected].

What we collect

Category	Contents	Source
Account data	Email, password (stored only as a one-way hash; we never see it), nickname, time zone, display language, and the version of this policy you agreed to and when. If you sign in with Google, we also store your Google account identifier and email.	You, when you sign up or change settings; Google, when you sign in with Google.
Budget data	Household name and currency, income, fixed outgoings, debts, savings, budgets, and each expense's amount, date, category, note, and the email of the Member who recorded it.	You and the other Members of the same Household, or a Backup file you upload.
Invitations	The invitee's email.	A Member who invites someone to a Household.
AI assistant access	The name of each AI assistant you authorize, its Access Credential (stored only as a one-way hash), when it was last used, and how often.	Created when you authorize an AI assistant (such as Claude) to access your account.
Security records	The email and time of sign-in, sign-up, and password reset attempts, used to limit brute-force attempts.	Created when you or someone else uses the sign-in pages.

Our servers keep no access logs and do not write your IP address to the database. Error logs written when something goes wrong may contain an email address and are used only for troubleshooting. Pages behind sign-in load no Google Analytics or any other tracking code.

How we use it

• To provide the budgeting service and let the Members of a Household share one set of books;
• To verify your identity, keep you signed in, and prevent brute-force attempts and abuse;
• To send email the service needs: sign-up confirmation, password reset, Household invitations, account security notices, and notices of changes to this policy.

We do not sell your data, use it for advertising, build personal profiles, or use your budget data to train AI models.

Who can see your data

• Members of the same Household can see all of that Household's budget data, and the other Members' emails and nicknames. You cannot see Households you are not a Member of, and no one else can see yours.
• AI assistants you authorize (such as Claude) can read and add budget data in the Households you belong to. Once data reaches that service, its own privacy policy applies. You can revoke access in Settings at any time.
• The operator: data is encrypted in transit but not end-to-end, so the operator can technically access the database. We look at your data only when you email us asking for help, to troubleshoot or handle a security incident, or when the law requires it.

Processors and where data is stored

Provider	Purpose	Data handled
Amazon Web Services (Tokyo region, Japan)	Server and database	All data listed on this page
Cloudflare	DNS and network proxy; every connection passes through Cloudflare	Your IP address and the encrypted connection in transit
Google	Sign in with Google (when you choose it) and sending service email	Email addresses and email contents

These providers' servers may be located outside Taiwan. Apart from the table above and AI assistants you authorize yourself, we do not share your data with any third party, except when the law requires it.

How long we keep it

Data	Kept until
Account data and budget data	You delete the Household or your account
Sign-in sessions	30 days, or until you sign out
AI assistant Access Credentials	1 year, or until you revoke them
Pending invitations	7 days, or until the inviter revokes them
Security records	Cleared after 15 minutes
Outgoing email	Deleted as soon as it is sent
Backup files you upload	Cleared as soon as the import finishes, whether it succeeds or fails
Database backups	30 days

Deleting your data

• Delete a Household: when you are its only Member, you can delete it yourself in Household settings. All of its budget data is removed from the database immediately.
• Delete your account: you can delete your account yourself in Settings. We send a confirmation email; once you open the link and confirm, the account is deleted immediately. Households where you are the only Member are deleted with it. Households with other Members stay, as if you had left; the expenses you recorded stay too, but they show "Deleted member" as the recorder and no longer keep your email.
• Before deleting, you can download a Backup from the Export page in Household settings. Deleted data disappears from our database backups within 30 days.

Security

The whole site uses HTTPS. Passwords, sign-in sessions, and AI assistant Access Credentials are stored only as one-way hashes, so a database leak alone cannot be used to sign in. The database accepts no outside connections.

Cookies

Name	Purpose	Retention
bp_session	Keeps you signed in; required to use the service	30 days, or until you sign out
bp_google_handshake	Holds the verification data of a Sign in with Google attempt	10 minutes, deleted once sign-in completes
bp_lang	Remembers your display language; contains no personally identifying information	1 year, or until you clear your browser data

Your rights

Under Article 3 of Taiwan's Personal Data Protection Act, you may:

• Inquire about, review, or get a copy of your data: download a Backup from the Export page in Household settings, or email us;
• Supplement or correct it: you can edit your account data (except your email) and all budget data yourself;
• Ask us to stop collecting, processing, or using it, or to delete it, as described under "Deleting your data" above.

An email address is required to create an account; without one you cannot use the Hosted Edition. Everything else is up to you.

Changes to this policy

When this policy changes materially, we will email registered users at least 14 days before the change takes effect and update the version date at the top of this page. Once the new version takes effect, you will see it when you sign in and need to agree to it before continuing.