Privacy Policy

Updated 4 Oct 2026

The short version: your data exists to be shown back to you, and to nobody else. No trackers, no ads, no selling or sharing of data, no training on your content. The only measurement is anonymous, cookieless page view counting: our own first party counter, plus Vercel Web Analytics. Neither sets a cookie, neither can follow you to another site, and neither keeps your IP address or browser string. Our counter turns those into a short one way hash whose secret changes every day, so one day's counts cannot be matched against another's. Signed in visits are not counted at all. Export everything or delete everything, one click each, any time.

What we store

Account: your email address and an account identifier, from Google sign in or the email sign in link. We never see your Google password. We use the email address to sign you in and, rarely, to write to you personally about your account (for example, to ask how Khalt worked for you); never for newsletters or marketing lists, and replying “stop” ends it. Once you have at least one entry we also send a short monthly statement: how your net worth moved that month, in percent, and how many estimates are due for review. It never contains your net worth or any figure from your records, it has no tracking pixel and no tracked links, and you can turn it off on the Account page or by replying “stop”. If you arrived through a link that named a campaign (a utm_campaign orutm_source tag), that one word is kept with your account so we know which campaign brought you. Nothing else about the visit is.
Your records: the assets, valuations, notes, locations, photos, and documents you enter. Photos are stripped of EXIF metadata (including GPS location) at upload.
Snapshots: a daily total of your net worth, to draw your history chart.
Operational data: short lived rate limit counters, error logs needed to run the service safely, and a log of the actions your account takes in the app (for example “entry created” or “import failed: unreadable number”) without any of the content, kept for 90 days so we can find bugs. This is not page view tracking: which pages you visit while signed in is still not recorded.

Cookies

Khalt sets only essential cookies: your sign in session (Supabase auth), your display currency and your theme preference. There are no analytics or third party cookies (the page view counting above is cookieless), which is why there is no cookie banner.

Where it lives

Data is stored with Supabase (database, sign in, and file storage; AWS region eu-north-1, Stockholm) and served through Vercel (hosting/CDN). Both act as processors under their standard data processing terms. Encrypted in transit; stored documents are private and served only through short lived signed URLs.

What leaves the service

To price live assets, our servers request market data from providers (stock quotes, crypto prices, FX rates). Those requests contain ticker symbols only, never your identity, holdings quantities, or account information.

Your rights

Export: a complete JSON copy of your data, one click from the Account page, any time.
Deletion: self serve on the Account page. It removes every record, photo, document, and your sign in account, immediately and irreversibly. Routine storage backups age out within days.
Rectification: everything is editable in the app.

Legal basis for processing is performing the service you signed up for (GDPR art. 6(1)(b)). Data is kept until you delete it.

Contact

Questions, requests, or anything else: support@khalt.app.