Privacy policy

This policy covers the Kosha service at getkosha.app. Kosha is open source, and anyone can run their own copy. A copy you or someone else runs is outside this policy: whoever runs it is responsible for the data in it.

The short version

• Your financial data is yours. It is not sold, rented, shared for advertising or used to train models.
• There are no ads, no analytics, no tracking pixels and no third-party cookies.
• AI features are off unless you add your own provider key, and you choose what they may see.
• You can export everything, or delete your account and all its data, from Settings at any time.

What Kosha stores

• Your account: your name, email address, a hash of your password (never the password itself), passkeys, two-factor settings and an optional profile picture. If you sign in with Google, Kosha also keeps your Google account id, your Google profile picture's address and the tokens Google returns, encrypted.
• Your finances: everything you enter or import, such as accounts, transactions, payees, categories, tags, events, subscriptions, reconciliations, statement imports and attached receipts or payslips.
• Sign-in sessions: for each signed-in device, the IP address and browser name it signed in with, so you can see and end sessions. Sessions expire after 30 days without use.
• Security records: IP addresses are counted for a short time to limit repeated sign-in attempts and API requests.
• API keys and connected apps: keys you create and apps you connect through the MCP server. Keys are stored hashed.
• AI settings: provider keys you add, stored encrypted, and a record of each AI request's token counts for Settings › AI › AI usage. When Keep a request log is on, the request and reply are kept for 30 days. Each log row is deleted after 62 days.

Why it is stored

Data is used only to run Kosha for you: to sign you in, keep your account secure, show your totals and run the features you turn on. The legal basis is the agreement to provide the service you sign up for, and the legitimate interest in keeping it secure and free of abuse.

AI features

AI features use a provider key you add yourself, such as Anthropic or OpenAI. When you use one, Kosha sends that provider only what Settings › AI › What AI can see allows, and hidden payees and account references are replaced with codes first. The provider handles that request under its own terms and privacy policy, which you accept when you create a key with them. Kosha has no AI key of its own and never sends your data to an AI provider you did not set up.

Services Kosha relies on

• Cloudflare hosts the app, its database (D1) and file storage (R2), and processes every request, including short-lived request logs used to fix errors. Data may be processed in any country where Cloudflare operates.
• Exchange rates come from the public fawazahmed0 currency API through jsDelivr. Kosha's server fetches them; no data about you is sent.
• The API reference page loads its viewer from jsDelivr, which sees your IP address like any website you load files from.
• Google, only if you choose to sign in with it. Google tells Kosha your name, email address and profile picture, and learns that you signed in to Kosha.
• AI providers you add yourself, as described above.

Cookies and storage on your device

Kosha sets only the cookies it needs to keep you signed in and, if you choose, to remember a trusted device for two-factor sign-in. Because these are strictly necessary, there is no cookie banner. The browser also keeps a few preferences, such as your theme and last-used account, and entries you add while offline until they are sent. When installed as an app, Kosha saves pages and data on your device so it works offline. Signing out clears the saved pages.

How long data is kept

Your data is kept while your account exists. Deleting your account in Settings › Delete & reset removes your financial data, profile picture and attachments straight away. Copies in the database provider's point-in-time recovery expire within 30 days. The shared demo account holds invented data only.

Your rights

Depending on where you live, laws such as the GDPR give you the right to access, correct, export and delete your data, and to object to or restrict how it is used. Most of these you can do yourself:

• Correct anything by editing it in the app.
• Export your data as CSV or JSON in Settings › Import & export.
• Delete your account and all its data in Settings › Delete & reset.
• End sessions and disconnect apps in Settings › Sign-in & security and Settings › API & MCP.

For anything else, contact the maintainer (below). You can also complain to your local data protection authority.

Security

Traffic is encrypted with HTTPS. Passwords are hashed, AI provider keys are encrypted, and every query is scoped to your account. No system is perfectly secure. If you find a vulnerability, please report it privately to the maintainer rather than in a public issue.

Children

Kosha is not meant for children under 16, and does not knowingly hold their data.

Changes

When this policy changes, the date at the top changes too, and the full history is public in the source repository.

Contact

Kosha is run by Amruth Pillai. For privacy questions or requests, use the contact details on the maintainer's GitHub profile. For anything that is not private, open an issue on GitHub.