Privacy Policy
This policy explains how Technology Resolution Group LLC (“Kemback”, “we”, “us”) handles personal information when you use the Kemback website, web app and mobile apps (the “Service”).
The short version: we collect what we need to run Kemback for you. We don’t sell your data, we don’t use it for advertising, and we don’t track you around the web. You can export everything at any time, and ask us to delete it.
What we collect
Account information. Your email address, and your password, which we store only as a one-way Argon2id hash so that no one, including us, can read it. If you turn on two-step verification or add a passkey, we store what’s needed to check them. Two-step secrets are encrypted.
Your financial data. Accounts, balances, transactions, categories, budgets, bills, goals, rules, tags, notes and files you import (such as OFX, QFX, QIF, CSV or Mint exports). This is the information you choose to put into Kemback.
Household information. The households you belong to, your role in each, and the email addresses of people you invite.
Bank connection data. If you connect a bank through an aggregator such as Plaid (when available), we receive account and transaction data from it. The aggregator gives us an access token, which we store encrypted. We never receive or store your bank username or password.
Device and security information. When you sign in, we record your IP address, browser or device type, and when the session was last used, so you can see and sign out your devices and so we can detect abuse. We keep a tamper-evident log of security-relevant actions in your account and households. If you turn on notifications in the iPhone app, we store its push token, encrypted.
Messages. If you email us, we keep the conversation.
The public website. Our public pages don’t use analytics or advertising cookies. We count how many times each blog post is read, without cookies and without recording who read it. Our servers keep standard technical logs (such as IP address and request path) for a short time for security and troubleshooting.
How we use it
- To provide the Service: show your register, budgets and reports, sync your devices, import your files, and share what you choose with your household.
- To send the email and notifications you ask for, such as verification links, invitations, alerts and the weekly summary, and essential account messages.
- To keep the Service and your account secure, for example by limiting repeated sign-in attempts and spotting suspicious activity.
- To fix problems and improve Kemback. Where we study how features are used, we use aggregated information, not the contents of your accounts.
- To meet legal obligations and enforce our Terms of Use.
We don’t sell or rent personal information, we don’t share it for advertising, and we don’t use your financial data to market financial products to you.
Who processes it for us
We use a small number of service providers, each bound to use your information only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online | Hosting our servers and database | Germany (EU) |
| Postmark (ActiveCampaign) | Delivering email | United States |
| Apple | Delivering iPhone notifications, if you turn them on | United States |
| Plaid | Bank connections, if you choose to connect a bank (when available) | United States |
We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business (in which case this policy will continue to apply to your information, or we’ll tell you).
Other members of your household
Information in a shared household is visible to its members, according to their roles. Accounts you mark as private are visible only to you. Members can see the household’s activity log.
Cookies
The web app uses two cookies, both necessary for it to work: kb_session keeps you signed in, and kb_csrf protects your account against cross-site request forgery. We don’t use advertising or third-party tracking cookies.
How long we keep it
We keep your account and financial data while you have an account. Expired sign-in challenges and rate-limit records are removed automatically. When you ask us to delete your account, we delete your personal information and any households only you belong to within 30 days, apart from what we must keep by law. Copies in our backups are overwritten within a further 30 days.
Your choices and rights
- Export: download all your data as JSON or CSV at any time, from Your data in the app.
- Correct: change your information in the app, or ask us.
- Delete: ask us to delete your account by writing to hello@kemback.com from the email address on the account.
- Email: turn off alerts and the weekly summary in Settings, or with the unsubscribe link in each email. We’ll still send essential account messages.
Depending on where you live (for example California and other US states, or the EU and UK), you may have further rights, such as to know what we hold, to object to certain uses, or to complain to a regulator. Write to hello@kemback.com to use them; we won’t treat you differently for doing so. We don’t sell or “share” personal information as those laws define it.
Security
We protect your information with encryption in transit (HTTPS) and for sensitive secrets at rest, one-way hashing of passwords and tokens, isolation of each household’s data in the database itself, passkeys and two-step verification, and a tamper-evident audit log. No system is perfectly secure, so please use a strong, unique password or a passkey. Read more on our security page, and report vulnerabilities to security@kemback.com.
Where your data is stored
Your data is stored on servers in Germany. If you use Kemback from elsewhere, including the United States, your information is transferred there, and to our service providers listed above.
Children
Kemback is not for children. You must be 18 or older to create an account, and we don’t knowingly collect information from children under 13.
Changes to this policy
If we change this policy in a significant way, we’ll tell you by email or in the app before the change takes effect. The date at the top shows when it last changed.
Contact
Technology Resolution Group LLC, New Jersey, United States. Email: hello@kemback.com.