Privacy Policy
This policy describes what data is collected by the Dengii app (the "App"), how it is processed, and what rights users have.
Operator
The personal data operator is Timofey Ushnitsky, an individual, residing in Almaty, Republic of Kazakhstan. Contact for requests and inquiries: support@dengii.app.
Applicable law
Personal data processing is governed by the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" of May 21, 2013 No. 94-V. For users in the European Union and the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR additionally apply.
What data is collected and where it is stored
Transactions (expense and income records)
All transactions, lists, budgets, and categories are stored in the user's personal iCloud storage via Apple CloudKit. The operator has no access to this data. Synchronization between the user's devices happens through Apple's infrastructure.
If the user creates a shared list and invites another participant, the shared list is stored in CloudKit's Shared Database and is accessible only to the invited participant. The limit is 2 people per shared list.
Anonymous authentication
To call server-side AI functions, the App creates an anonymous auth token through the Supabase service. The token is not linked to a name, email, phone number, or any other user identifier. The App does not request or collect a name, email, or phone number.
AI transaction parsing
When the user enters an expense by voice or text, the transcript is sent to OpenAI through a Supabase Edge Function (EU region). OpenAI parses the amount, currency, and category and returns the result. The transaction text is not stored on the Supabase side or on the OpenAI side after the request is processed. Edge Function logs are retained for no more than 30 days and do not contain personally identifying data.
AI insights (weekly digest, Mini-Wrapped)
To generate the wording of insights, aggregated numerical metrics (total spending, top 3 categories, day-of-week patterns), the currency, and the interface language are passed to the Edge Function. The transactions themselves and raw text are not transmitted.
AI consent and revocation
Consent to send data to Edge Functions → OpenAI is collected explicitly during onboarding, on a dedicated screen. Until consent is granted, no user data is sent to AI. Consent can be revoked at any time: Settings → AI processing → off. After revocation, voice input, AI parsing, and AI insights stop working; manual transaction entry and history viewing remain available without AI.
Subscriptions
Payments and subscription activations are handled by the Apple App Store and the RevenueCat service. The operator only receives subscription status (active / inactive) to unlock the App's features. The user's payment data is not transmitted to or stored by the operator.
What is not collected
- Name, email, phone number, physical address.
- Behavioral analytics (no Firebase, Amplitude, Mixpanel, or similar SDKs).
- Advertising identifiers (IDFA), advertising SDKs.
- Cookies on the dengii.app website.
- Geolocation.
- Data from other apps or contacts.
Third parties
The following services are used for the App to function. Each of them has its own privacy policy.
- Apple Inc. — CloudKit (storage), StoreKit (subscriptions), Family Sharing. Apple Privacy Policy.
- RevenueCat, Inc. — subscription management. RevenueCat Privacy Policy.
- Supabase Inc. — anonymous authentication and Edge Functions. Supabase Privacy Policy.
- OpenAI, L.L.C. — transaction parsing and insight wording generation. OpenAI Privacy Policy.
User rights
In accordance with the Kazakhstani Law "On Personal Data and Their Protection" and GDPR, the user has the following rights:
- Right of access — all data is stored in the user's personal iCloud and accessible to them through the App at any time.
- Right to rectification — any transaction, list, or budget can be edited in the App.
- Right to erasure — the App provides a "Delete account" function (Settings → Delete account). This function deletes all user data in CloudKit (transactions, lists, budgets, categories) and resets local state. The App Store subscription is not automatically canceled — it must be canceled separately via iPhone Settings → your Apple ID → Subscriptions.
- Right to restrict processing — the user may delete the App from their device; after deletion, no data processing by the operator takes place.
- Right to lodge a complaint — the user has the right to file a complaint with the authorized body of the Republic of Kazakhstan for the protection of personal data subjects' rights, or with the supervisory authority of their country of residence.
Send personal data subject rights requests to support@dengii.app. Response time — up to 10 business days.
Storage and processing period
Transaction data is stored in the user's iCloud indefinitely — until the user either deletes it themselves or uses the "Delete account" function. The anonymous Supabase auth token exists for as long as the session is active. Supabase Edge Function logs are retained for no more than 30 days and contain no identifying user data.
Children under 13
The App is not intended for use by individuals under 13. The operator does not knowingly collect data from users under 13. If such data is discovered, it will be deleted upon request from a parent or guardian at support@dengii.app.
Data transfer outside Kazakhstan
Apple, Supabase, RevenueCat, and OpenAI store and process data on servers outside the Republic of Kazakhstan, including in the United States and the European Union. By using the App, the user confirms consent to the cross-border transfer of data to the specified jurisdictions.
Policy changes
For material changes to the policy, the operator notifies users through the App or by email. The date of the most recent revision is shown at the top of this document.
Contact
For all questions related to personal data processing: support@dengii.app.