Privacy Policy

This Privacy Policy describes how PromethionTech LLC (“PromethionTech,” “we,” “us,” or “our”) collects, uses, and protects your information when you use the Kiwi personal finance app (also referred to as Kiwi Finance; Google Play package com.promethiontech.kiwifinance) and related websites at kiwifinance.app. PromethionTech LLC is the organization and developer associated with Kiwi on the Google Play Store and Apple App Store.

1. Information We Collect

Information You Provide Directly

• Email address (required for account creation and communication)
• Full name (optional, for personalization)
• Phone number (optional, for account security)
• Payment information is handled by Stripe (web/card), or by Apple App Store / Google Play Billing via RevenueCat for in-app subscriptions — Kiwi does not collect or store your full payment card number
• Customer service communications and feedback

Financial Information via Data Sources

• Account balances and transaction history (via Plaid and other secure providers)
• Investment holdings and cryptocurrency wallet data
• Subscription and recurring payment information
• Budget and spending category data you create
• Financial goals and preferences
• API keys and credentials necessary for financial data source integrations

Automatically Collected Information

• Device Information: Browser type, operating system, IP address, unique device identifiers (including Android ID and push/Firebase messaging tokens used for notifications and Live Updates)
• Usage Information: App features used, time spent, access times, crash logs, diagnostics, email interactions
• Location Information: Approximate and precise GPS coordinates (with permission) used for store detection; city, state, ZIP from IP where available. Location may be transmitted to our servers to identify nearby stores. Location is not used for advertising.
• Photos: Optional profile pictures you choose to upload
• Purchase history: In-app subscription and purchase status via Apple / Google Play Billing and RevenueCat

Information from Other Sources

• Information from other users of the Services
• Payment service providers (Stripe for web where applicable; Apple / Google / RevenueCat for in-app subscriptions)
• Crash and diagnostics provider (Sentry)
• Financial account linking (Plaid)
• Third-party login services (Sign in with Apple, Google)

2. How We Use Your Information

• Core App Functionality: Track spending, categorize transactions, identify subscriptions, and provide financial insights
• Account Management: Create and maintain your account, process payments, and provide customer support
• Communication: Send transactional emails (receipts, account notices) and optional marketing updates
• Product Improvement: Analyze usage patterns to improve features and user experience
• Security: Detect fraud, prevent unauthorized access, and maintain data security
• Legal Compliance: Comply with applicable laws and regulations, respond to legal requests
• Business Operations: Establish, exercise, or defend legal rights, enforce our Terms of Service

Combined and Aggregate Information

We may combine information from different sources to provide better services. We may also create aggregate or de-identified information that cannot be linked to you personally, which we may use for any purpose including:

• Research and analytics to improve our services
• Marketing and business development purposes
• Sharing with third parties for industry insights (anonymized only)

3. Information Sharing

We do not sell, rent, or trade your personal information. We may share data only in these limited circumstances:

Service Providers

• Plaid: Securely connects your financial accounts
• Stripe: Processes web and card-based subscription payments (where used on the website)
• Apple / Google / RevenueCat: Process in-app subscription payments and purchase history
• Supabase / cloud hosting: Account data, sync, store-detection requests, and profile media
• Sentry: Crash logs and diagnostics to keep the app reliable
• Google / Apple push infrastructure (including Firebase Cloud Messaging on Android): Deliver notifications

Other Users and Public

Any content you post in publicly accessible areas (forums, comments) can be read and used by others with access to those areas.

Corporate Transactions

We may transfer your information in connection with mergers, acquisitions, or sales of assets, subject to appropriate confidentiality protections.

Legal Requirements

We may disclose information if required by law, court order, or to protect our rights and users' safety.

With Your Consent

We may share information with third parties when you direct us to do so or have provided consent.

4. Data Security

• Encryption: All data is encrypted in transit and at rest using industry-standard AES-256 encryption.
• Authentication: Multi-factor authentication available for enhanced account security.
• Access Controls: Strict employee access controls and regular security audits.
• Third-Party Security: We only work with SOC 2 Type II certified providers like Plaid, Stripe, and RevenueCat.
• No Credential Storage: We never store your banking login credentials.

5. Data Retention

• Account Data: Retained while your account is active and for 2 years after account closure for legal compliance.
• Financial Data: Retained for up to 7 years as required by financial regulations.
• Marketing Data: Deleted immediately when you opt out of marketing communications.
• Usage Data: Anonymized and aggregated data may be retained indefinitely for product improvement.

6. Your Privacy Rights

Account Control

• Update your profile information anytime in Settings
• Disconnect linked accounts at any time
• Request account and data deletion from the app Settings or this website's delete-account page
• Delete your account and associated data

Communication Preferences

• Opt out of marketing emails anytime (transactional emails like receipts cannot be opted out)
• Control push notification preferences
• Choose your preferred communication frequency

Legal Rights (Where Applicable)

Under CCPA, GDPR, and other privacy laws, you may have additional rights including access, correction, deletion, and portability of your data.

7. Cookies & Tracking

• Essential Cookies: Required for app functionality (login sessions, preferences)
• Analytics Cookies: Help us understand app usage (you can opt out)
• No Advertising: We do not use tracking cookies for advertising purposes
• Third-Party Services: Some integrated services may use their own cookies per their privacy policies

8. Children's Privacy

Kiwi is intended for users 18 and older. We do not knowingly collect information from children under 18. If we discover we have collected information from a child, we will delete it immediately.

9. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email and in-app notifications. Continued use of Kiwi after changes constitutes acceptance of the updated policy.

10. Notice to California Residents

California's “Shine the Light” law gives California residents the right to request information about how we share certain categories of personal information with third parties for direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes.

Under the California Consumer Privacy Act (CCPA), California residents have additional rights including the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information. For CCPA requests, please contact us using the information below.

11. Notice to Nevada Residents

Nevada consumers may opt out of the sale of personally identifiable information for monetary consideration. We do not engage in such activity; however, Nevada residents may submit opt-out requests for potential future sales by contacting us at legal@kiwifinance.app with “Nevada Opt-Out” in the subject line.

12. Third-Party Links and Services

Our Services may contain links to third-party websites, apps, or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information.

13. Location Data and Background Processing

Background Location Access: With your explicit consent, Kiwi will access your device's location in the background, including when the app is closed or not in use. This permission is used to detect when you arrive at or leave a store so Kiwi can show budget previews, spending alerts, and related on-device visit notifications.

How it works: Background location helps Kiwi determine whether you are arriving at, dwelling near, or leaving a commercial venue (such as a grocery store, coffee shop, or retailer). When a relevant store visit is detected, Kiwi may show budget context for that visit. Approximate and precise location may be transmitted to our servers (and, if needed for store lookup fallbacks, to map/geocoding providers) solely for this feature. Location is not used for advertising.

Live Activities (iOS): On compatible iOS devices, a detected store visit may start a Live Activity with budget information for that location.

Your Control: You can decline background location and still use Kiwi. You can manage or disable location permissions anytime in device Settings or in the app under Settings → Privacy. Disabling background location limits store detection to while the app is open.