Privacy Policy

This notice describes the current limited-access testing version of KOA Family Finances. It must be reviewed and revised before public registration is offered.

Information used by the application

For authorized private-test users, Google Sign-In supplies account identity information to check whether access is allowed. The finance interface can read an approved Google Sheets TEST workbook, including bill and household-budget information. When separately enabled, read-only transaction snapshots from the existing backend may include transaction identifiers, dates, descriptions, amounts, financial institution names, and masked account identifiers. Do not treat the Google sign-in ID token as the separate Google Drive backup permission.

Why the information is used

Information is processed to authenticate access, show budget and reconciliation views, and investigate possible differences between transactions and ledger records.

Connected services

The current implementation involves Google Sign-In and Google Sheets; Netlify hosts the controlled finance interface; a backend on Render handles some finance API features. Development code also describes Firestore storage and Plaid banking-data integrations, when enabled. Cloudflare routes email received at our support address. Actual deployed service configurations, processor terms and data retention need to be verified before releasing a final policy.

Google Drive backup access

An existing separate Desktop OAuth client is intended to request the limited Google Drive drive.file permission for specific files created or explicitly authorized through that integration. The backup work is still in synthetic-data testing. Unattended backups containing real financial information have not been verified or activated. Revoking Google access does not, by itself, establish deletion of files or copies previously stored elsewhere.

Data sharing and security

Information may be processed by necessary hosting, authentication, cloud and financial connectivity services to support features in use. The app implements access checks and read-only protections in its current build. No internet service can guarantee absolute security.

Retention and deletion — not yet approved

The current source review has not established comprehensive retention periods or a verified end-to-end account deletion workflow for Google identity metadata, spreadsheets, Firestore/financial data, service logs and any backup copies. Before approving this notice: inventory actual storage and deletion behavior and publish an honest request process with any exceptions. Do not assume that disconnecting a bank or revoking Google access automatically deletes copies held by this application or its providers.

Privacy requests — manual review during private testing

Requests for access, correction, export or account deletion can be sent to support@getkoaops.com. Incoming delivery has been independently tested. We have selected a manual review approach for the limited household phase: before acting on a request, the operator must verify account ownership, determine which records and providers are affected and document what can actually be completed. There is no automated Delete My Account feature. Do not send passwords, banking credentials or account numbers by email. Revoking a Google authorization is a separate control and does not automatically erase app data or backups. Before publication: validate actual procedures and retention exceptions; an untested end-to-end deletion process must not be represented as operational. Cloudflare forwards incoming support email, but a branded outgoing mailbox and tested reply workflow are still pending.

Updates

The policy will display an effective date and any material revisions once approved for publication.