Privacy Policy

1. Who is responsible

Kuentas is a service of Lorenzo Wynberg, a person, in Costa Rica. There is no company behind it. He is responsible for the personal data Kuentas processes.

For any question or request about your data, write to soporte@kuentas.online.

2. Your books are encrypted on your devices

What you record in a book (sales, expenses, contacts, amounts, loans and receipt photos) is encrypted on your devices before it leaves them. The keys to open it are only on the devices of the book's team.

Our server keeps only what is encrypted: the records, the receipt photos and the copies devices upload to catch up. It does not have the keys to read them.

Your 12 words are not sent to the server. With them, and with a passkey if you add one, your device encrypts a copy of your key so you can get back in; the server keeps that encrypted copy and cannot open it.

3. What the server keeps unencrypted

So you can sign in, work as a team and sync your devices, the server keeps this data unencrypted:

• Your account: your email, your name, your language, your theme, your time zone, your plan, when you last signed in and the last book you opened. Of your password it keeps only a digest (hash), not the password.
• Your second sign-in step, if you turned it on: your authenticator app's key and your backup codes, encrypted with a key of the server's own.
• Your sessions: when they start and expire, the IP address you signed in from and the browser you used.
• Books: their name, their settings (country, time zone, currencies, start of the week and of the fiscal year, number format), who made each, which owner's plan it counts in, and whether it is closed.
• Each book's team: who is in it, in what role, who invited them, and who changed a role or took someone off.
• Invitations: the email they were sent to, who sent each, for which book and role, and when it expires or was used. Of each link (an invitation, or one to change a password) it keeps only a digest, not the link.
• Usage limits, to stop abuse: how many times something was tried from an IP address or with an account, and failed sign-ins with an email.
• Each book's encrypted data, with what the server needs to order and check it: its size, when it arrived, from which device, and the public keys and signatures the team's devices recognize each other by.
• What the Kuentas administrator notes about an account or a book: the plan or access given to it, and who changed what.

What is inside a book is not on this list: the server cannot read it.

4. What we use it for

Only to provide the service: to let you sign in, show you your books and your team, sync your devices, send your account's emails and protect the service from abuse.

We do not sell your data, we do not use it for advertising and we do not build profiles of you.

Kuentas emails you only when needed: an invitation, a link to change your password, and a notice when your password or your second step changes. It sends no advertising.

5. Who processes data for us

Kuentas uses these services, which process data only to provide the service:

• Vercel hosts the app and this page. It receives each visit, with its IP address.
• Turso holds the server's database.
• Cloudflare R2 stores the encrypted files: receipt photos and copies of the books.
• Resend sends the emails: it receives your address and the text of each email.
• If error reporting is turned on, Sentry receives technical reports of failures (the kind of error, the screen, the browser), with no records, receipts, keys, words, PIN, emails or names.

These services are in the United States: your data is stored and processed there.

Beyond them, we share data only if the law requires it.

6. What stays on your phone

The app keeps in your browser what it needs to work, even with no signal:

• Your books, encrypted, to read them and record with no connection, with the receipt photos you opened.
• Your keys, kept under your lock (your PIN or your passkey).
• What is shown before the lock opens: your name, your email, your role and the names of your books. The rest of your account is kept encrypted under your lock.
• The app's code, to open it with no connection.
• Cookies to keep your session, your language, your theme and your time zone, to remember that your lock is on and, while you change your password, the link you are using.
• A few notes of this browser's, such as which books are already on this phone or whether you chose not to install the app.

There is no analytics, advertising or third-party tracking, in the app or on this page. This page uses no cookies.

“Remove from this phone”, in Settings, deletes that book's records from this browser.

7. Your rights

Under Law 8968, you may ask to see, correct or delete your personal data, and to know how it is used.

• In My account you correct your name, your language, your theme, your time zone and your password.
• In My account → “Delete my account” you delete your account for good, with the books you pay for: first it tells you what happens to each book, and asks for your email, your lock or your second step's code.
• With Export, in Settings, an owner downloads the book's records as spreadsheets.
• To change your email or for any other request, write to soporte@kuentas.online.

What is inside a book is managed by its team: since the server cannot read it, it cannot correct it for you either.

8. How long we keep it

Your data is kept while you use Kuentas, or until you delete your account in My account. Deleting it removes your email, your password, your second step, your sessions and the books you pay for; your name stays only on what you recorded in other people's books, and the administration log keeps that the account was deleted, with its email.

If a book is closed or disabled, the server deletes its receipt photos 90 days later. The encrypted records stay on the server and on the team's devices.

The server's backups may keep what was deleted for up to 30 more days.

9. Security

Books are encrypted end to end, and the app connects only over HTTPS. No system is infallible: if we learned of improper access to your data, we would tell you as the law requires.

10. Changes to this policy

If we change this policy, the date above changes. If the change is important, we will tell you in the app or by email.