Privacy policy
Last updated: 1 October 2026
This policy explains what personal data the Kaptal app and the kaptal.org website process, what for, for how long, and what your rights are.
1. Data controller
The data controller is Vladyslav Safronov, an individual resident in Portugal ("we"). For any question about your data: support@kaptal.org.
2. What data we process
Data you give us
- Account: email, name (optional) and password. For the password we only keep a cryptographic hash (argon2), never the password itself. If you sign in with Google, we receive your Google account identifier, email and name from Google.
- What you record in the app: wallets, projects, transactions (amounts, dates and notes), categories, links between projects and wallets, profit distributions and simulations. If you write other people's data in these records (for example, an investor's name), you are responsible for having a basis to do so.
Technical data
- Sessions: device name and model, platform (Android or iOS), and the start, last use and expiry dates of each session. They let you see and end the sessions open on other devices.
- Server logs: the web server records the IP address, the requested address and the browser or app identification (user-agent) of each request. The application logs keep the account's internal identifier, never the email, and the IP address only when a request exceeds the usage limits.
Data that stays on your phone
Session data, preferences (theme, language and currency) and the key used for biometric unlock are stored on the device and never sent to us. The app never sees your fingerprint or face: the operating system only tells it whether the unlock was accepted.
What we do not do
We do not use analytics, advertising or crash-reporting tools. We do not access your location, contacts or photos. We do not sell personal data or share it with third parties for their own purposes.
3. What we use the data for, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing the account; storing your records and doing the app's calculations | Performance of a contract (Art. 6(1)(b)) |
| Sending the emails the service needs: email confirmation, password reset and account deletion | Performance of a contract |
| Security: sessions, request limits, server logs and backups | Legitimate interest in protecting the service and your data (Art. 6(1)(f)) |
We do not send marketing emails.
4. Who processes data on our behalf
We use service providers (processors) that process data only on our behalf and according to our instructions:
- Oracle Cloud Infrastructure: hosting of the server, the database and the backups, in the Madrid region (Spain, European Union).
- Resend: sending the app's emails. It processes your email address and the content of the emails and may do so outside the European Union (United States), with the appropriate safeguards provided for in the GDPR.
- Google: only if you use "Continue with Google" (authentication is done by Google), and for the support mailbox.
We may also disclose data when required by law.
5. How long we keep the data
| Data | Period |
|---|---|
| Account and everything you recorded, including the change history | Until you delete the account |
| Accounts created and never confirmed | 48 hours |
| Sessions | Up to 90 days; once ended, 30 more days |
| Password reset and account deletion links | 60 minutes |
| Application logs | 183 days |
| Web server logs | 14 days |
| Database backups | Up to 365 days |
| Internal identifier of a deleted account (no email or name) | 400 days |
After you delete your account, your data may remain in the backups until they expire. It is not used, and if a backup ever has to be restored, the deletion is applied again: that is why we keep the internal identifier of the deleted account.
6. Deleting your account
You can delete your account at any time: in the app, under Settings → Account → Delete account, or without the app at kaptal.org/delete-account. Deletion is immediate and removes the account, all your records, the sessions and the change history. You will receive an email confirming it.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. To exercise them, write to support@kaptal.org from the account's email; we reply within one month. A copy of your data in a commonly used format is sent on request.
You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the authority of the country where you live.
8. Security
Connections to the app and the website are encrypted (HTTPS). Passwords are stored with argon2. The database cannot be reached from the internet and the backups are encrypted. Access to the server is restricted.
9. Age
Kaptal is intended for people aged 18 or over. We do not knowingly collect data from minors.
10. Changes to this policy
If we change this policy, we publish the new version here with the updated date. If the changes are significant, we let you know in the app or by email.