This Privacy Policy explains how Bilsis Information Systems and Technologies Inc. (“Bilsis,” “we,” “us”) collects, uses, and protects your information when you use Akcha (the “Service”), a personal finance application that lets you connect your financial accounts to see your balances, transactions, budgets, and insights in one place.
By using Akcha you agree to this Policy. If you do not agree, please do not use the Service.
Information we collect
- Account information — your name, email address, and password (passwords are handled by our authentication provider and stored only as a secure hash; we never see them in plain text).
- Sign-in through Google or Apple — if you choose to sign in with one of these providers instead of a password, we receive your name and email address from them so we can create your account. We do not receive your password, and we do not post anything or read anything else from those accounts.
- Financial account data — when you connect a bank through our data provider Plaid, we receive information such as account names and balances, transaction history, and institution details. We never receive or store your online banking username or password — those are entered directly with Plaid and your bank.
- Categorization history — for each transaction, a record of how it was categorized and counted: what your bank sent, what Akcha decided, and what you changed, so a total can be explained.
- People named in your transactions — your bank’s descriptions can name other people, such as someone you paid or who paid you. We keep those names as part of your transaction and categorization history, and — for a payer you mark as your pay, or tell us isn’t your pay — in your money rules until you change that or remove the bank it came from. We use them only to show, categorize and count your own transactions.
- Payment information — subscriptions are processed by Stripe, or by Apple for subscriptions bought in the iPhone app. We do not store your full card number; Stripe handles payment details and shares only limited billing metadata (e.g. subscription status, renewal date) with us. From Apple we receive the subscription’s transaction identifiers, product, purchase and expiry dates, renewal status, and whether a payment failed or was refunded, plus an identifier for the app on your Apple Account, which we use to decide whether an App Store free trial can be offered. We never receive your payment details or your Apple Account email. After you delete your account we keep only a subscription’s Apple identifiers and its last status, and whether a free trial was offered, with nothing that links them to you, so that later updates from Apple are handled correctly and you can pick the subscription up with a new account.
- Preferences you set — such as your display currency, language, notification settings, budgets, goals, categories, your money rules (how refunds, pay and money we can’t name are counted, the payers you mark as your pay or as not your pay, and which accounts count), and notes you add to transactions.
- Balance history — when you have a scheduled summary turned on, we record your total balances once per send so the email can tell you how your position moved since the last one. Without it there is nothing to compare against.
- Technical data — basic information needed to operate the Service securely, such as log and device data and error diagnostics.
How we use your information
- To provide the Service — display your accounts, transactions, budgets, goals, and insights across every device you sign in from.
- To count your income and spending the way you tell us to — by your money rules and the answers you give when Akcha asks about a transaction.
- To detect recurring payments, forecast spending, and generate the analytics that are the core of Akcha.
- To process your subscription and manage billing.
- To send you service-related communications (e.g. account confirmation and password reset) and, if you turn them on, the scheduled email summaries of your spending. You can switch those off at any time in Settings, or from the unsubscribe link in any summary.
- To secure the Service, prevent abuse, debug problems, and meet legal obligations.
We do not sell your personal or financial information, and we do not use your bank data for advertising.
How we share information
We share information only with the service providers that make Akcha work, and only as needed:
- Plaid — securely connects your bank accounts and provides transaction data. Your use of Plaid is also governed by Plaid’s End User Privacy Policy.
- Stripe — processes subscription payments made on our website.
- Apple — sells and bills subscriptions bought in the iPhone app, and tells us their status.
- Supabase — hosts our database and authentication.
- Vercel — hosts and serves the application.
- Resend — delivers transactional email.
- Google Analytics — tells us which screens are used, and nothing else. It receives no financial information and no information that identifies you. See “Cookies and analytics” below.
- Sentry — reports technical errors so we can fix them. It receives the error, the page it happened on, and the code that failed. It does not receive your financial data, anything you typed, your session, or an identifier for your account.
Each of these providers receives only the information it needs to do its job for us, may use it only for that purpose, and is bound — by its agreement with us and by its own published privacy and security commitments — to give it the same or equal protection as this Policy describes. Plaid also handles the information you give it directly, when you connect a bank, under its own End User Privacy Policy.
We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a merger, acquisition, or sale of assets (you will be notified of any such change affecting your data).
Cookies and analytics
We use a small number of cookies and similar technologies, and it matters which is which:
- Essential cookies — keep you signed in and keep your session secure. Akcha does not work without them, and they carry no advertising purpose.
- A local preference — your light or dark theme choice, and which one-time dashboard notes you have dismissed, are stored in your browser and never sent to us. The one exception is the two quick questions about how you count: that you have answered them is kept with your account, beside your answers, so you aren’t asked again on another browser or phone.
- Google Analytics — tells us which screens people use, so we know what to improve. It runs on our public pages and inside your account, and what it receives is deliberately narrow: the name of the screen you are on (for example “Dashboard” or “Transactions”) and nothing further.
- It never receives your balances, transactions, budgets, goals, account names, or any other financial information — none of that is sent, and none of it appears in a screen name.
- It never receives what you type. Anything a page carries in its address — a search you ran, an account you opened — is removed before the screen name is sent.
- We send no user ID and no account identifier, so Google Analytics cannot tell one Akcha user from another. IP addresses are anonymised.
- In the iPhone app it receives the same screen names, plus the app’s version and the fact that it is the iPhone app. In place of a cookie, the app makes up a random identifier the first time you open it, used only to count visits: it is not linked to your account, and it is erased when you delete the app. The app does not use Apple’s advertising identifier and does not track you across other apps or websites.
We do not use advertising cookies, we do not run advertising or retargeting tags, and we do not share your financial information with any analytics provider. Most browsers let you block or delete cookies; blocking analytics cookies does not affect your use of Akcha.
Do Not Track. Akcha does not track you across other websites or apps, and does not let third parties collect information that identifies you about your activity over time or across other sites — Google signals and ad personalization are turned off in our Google Analytics. So our website works the same way whether or not your browser sends a Do Not Track signal.
Where your data is stored
Your account and financial information are stored in a database located in Canada. Some of the providers listed above process information in the United States or elsewhere to provide their services: Vercel, which runs the servers that answer the app and the website; Plaid, Stripe and Apple; Resend, which sends our emails; Google Analytics; and Sentry. Wherever it is processed, it is protected as this Policy describes, but outside Canada it is subject to the laws of that country, and its courts, law-enforcement and national-security authorities may be able to access it.
How we protect your information
- Bank access tokens are encrypted at rest, with the encryption key kept separately from the database.
- Every account’s data is isolated by row-level security, so you can only ever access your own information.
- All traffic is encrypted in transit (HTTPS), and webhooks from our providers are cryptographically verified.
No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of financial data.
Data retention
We keep your information while you have an active trial or subscription. When you delete your account — or 7 days after we notify you that your trial or subscription has ended, if you have not subscribed or renewed by then — we delete your personal and financial data and disconnect your linked institutions, except where we must retain limited records to meet legal, tax, or accounting obligations. An App Store subscription that Apple is still trying to renew doesn’t count as ended. Akcha’s own record of how it first filed each transaction is deleted after 24 months. Your answers, your money rules and the rest of your categorization history are kept as long as the rest of your data (see above); removing a bank removes its part of that history.
Your rights and choices
- Access & correction — you can view and edit much of your information in the app, and request a copy of your data.
- Deletion — you can delete your account at any time from Settings, or from the subscription screen once access has ended, which removes your data and unlinks your banks. If you sign in with Apple, deleting your account in the iPhone app also asks Apple to revoke the authorization you gave Akcha through your Apple Account. If you delete it on the web, or that revocation does not go through, the email confirming the deletion tells you how to revoke it yourself in your Apple Account settings on your iPhone.
- Disconnecting banks — you can remove any linked institution at any time, which stops Akcha from receiving further data from it.
- Withdrawing consent — you can withdraw your consent at any time, in the iPhone app or on the web: remove a bank (Settings → Linked institutions) to stop us receiving its data, turn off scheduled summaries (Settings → Notifications, or the unsubscribe link in any summary), or delete your account (Settings → Delete account), which deletes your data as described under “Data retention”. Some of the Service cannot work without the information it relies on, so withdrawing consent may mean we can no longer provide it.
- Depending on where you live (e.g. under Canada’s PIPEDA, the EU/UK GDPR, or California’s CCPA), you may have additional rights. Contact us to exercise them.
Children
Akcha is not directed to, and may not be used by, anyone under the age of majority in their jurisdiction. We do not knowingly collect information from children.
Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will notify you (for example, by email or in the app) before they take effect. The “Last updated” date above reflects the current version.
Contact us
Our Privacy Officer is responsible for how Akcha handles personal information. Questions about this Policy or your data, or a request to exercise your rights? Contact the Privacy Officer at privacy@akcha.app, or by mail at Bilsis Information Systems and Technologies Inc., 17 Bathurst Street, Toronto, Ontario M5V 0N1, Canada.