Kupyura Privacy Policy
1. Who we are
The Kupyura app (“we”, “us”, “Kupyura”) is provided by DIGITAL IT ADVISOR COMPANY LIMITED, registered in Thailand. Kupyura runs in the browser at app.kupyura.com and as an app for iOS and Android. For anything related to this Privacy Policy, write to admin@digitalitadvisor.com.
2. What we collect
2.1 Account data
Your email address, which is also your login. You can sign in with a one-time code sent by email or through Google; in the latter case Google gives us your address and an internal account identifier, nothing more. We store the address encrypted and, separately, as an irreversible hash that lets us find you at sign-in without decrypting the database.
2.2 Your records
Everything you enter in the app: transactions (amount, currency, date, description), accounts, categories, sheets, books, counterparties and loans, and your settings. You enter this yourself — Kupyura does not connect to banks or cards and does not import statements.
2.3 Attachments
Files you attach to transactions (receipts, photos) and category pictures. They are stored encrypted, outside any web-served directory, and are served only to you. File names are encrypted too: “Clinic invoice.pdf” says as much about a person as the transaction description does.
2.4 How the encryption works — and what it does not give you
Every user has their own encryption key. It is not stored as-is: it is wrapped in a master key that lives outside the database, in the server configuration. A leaked database dump or backup is useless without the master key — it holds ciphertext only.
To be straightforward about the limit: this is not end-to-end encryption. With access to both the database and the master key, the server is able to decrypt your records. We do not do that — except when you ask us to help with your own data, or when the law requires it.
2.5 Visit log
Every time the site or the app is opened we write a log entry: date and time, country, city, region and time
zone, the referring source, and the account if you are signed in. We do not store the IP
address — only an irreversible hash of it (salt + SHA-256), from which the address cannot be recovered. To
resolve country and city, the address is sent to ipwhois.app. The log lets us see load and notice
code-guessing attempts; it is kept for 180 days and then deleted automatically.
2.6 Technical data
Server error logs and session details (device and browser type, expiry). Email addresses appear in logs masked only, and the contents of your records never do. There are no advertising or analytics libraries in the app at all: no counters, no trackers, no advertising identifiers.
2.7 Waiting list
If you left your email in the form on kupyura.com, we keep it encrypted and use it once — to tell you about the launch. To be removed, write to the support address.
2.8 Payment data
Kupyura currently has no paid purchases. When a subscription appears, payments will be handled by Apple (App Store) and Google (Google Play): card numbers are never available to us and are not stored by us; we receive only the subscription status and the date it is paid through.
3. How we use the data
- To run the app: show your records, compute balances, convert currencies.
- To let you in: send the sign-in code, validate the session.
- To help you through support and fix a fault you reported.
- To protect the service: rate limiting and an administrator action log.
We show no advertising, build no advertising profiles from your data, and do not sell it or pass it to data brokers. The contents of your records are not used to train any models.
4. Third parties
We rely on these providers to run the service:
- Hosting provider — the server running the application and the database.
- Backblaze B2 — storage for backups (encrypted before upload, see §5).
- Email provider — delivery of sign-in code emails; receives your address and the message.
- Google — if you chose to sign in with Google.
- ipwhois.app — resolving country and city from an IP address.
- Expo (EAS Update) — delivery of mobile app updates. Update checks send the platform, the app version and an installation identifier.
- Apple and Google — app distribution through the App Store and Google Play.
Each of them processes data under its own privacy policy.
5. Storage, backups and deletion
Data is kept for as long as the account exists.
A database backup is taken once a day. It is encrypted on the server with a separate key before it leaves, and then uploaded to cloud storage; the private key is not kept on the server, so a copy cannot be decrypted from there. Copies remain in storage after an account is deleted — meaning deleted data still exists as ciphertext in the archive for some time.
You can delete your account yourself, with no emails and no explanations:
- in the browser — Settings → Account → Delete account;
- in the mobile app — Settings → Delete account.
Immediately after you confirm, the account is closed, every session on every device ends, and attachments are removed from disk. The remaining records are erased from the database permanently within 30 days — that margin is there in case you deleted the account by mistake. If you need everything erased at once, write to admin@digitalitadvisor.com. Visit-log entries are detached from the account and disappear after 180 days in any case.
6. Your rights
- Get a copy of your data — the browser version exports all records to a file.
- Correct or delete any record — directly in the app.
- Delete the whole account — see §5.
- Ask what data we hold about you, and object to processing — by writing to the support address.
We answer such requests within a reasonable time, normally within 30 days.
7. Children
Kupyura is not intended for children under 16. We do not knowingly collect data from children under that age.
8. Changes
We may update this Policy. We will announce material changes in the app or by email; the effective date at the top of this page always shows the current version.
9. Governing law
This Policy is governed by the laws of Thailand.
10. Contact
DIGITAL IT ADVISOR COMPANY LIMITED, Thailand.
admin@digitalitadvisor.com