Privacy Policy

1. Who we are

Koma is the data controller for the personal data you provide while using this application. For privacy questions, contact us at privacy@heykoma.com.

2. What we collect

• Your email address (for sign-in via one-time code).
• Your first name, if you give it to us.
• Your pay date, home currency, and chosen corridor.
• Your basic salary, if you enter it (used for pay-cycle and gratuity planning).
• Transactions you log (amount, category, optional note).
• Budgets and savings goals you create.
• The names you give the family members you track support for, including an optional Arabic spelling.
• Your Telegram chat id, only if you choose to link the Telegram bot.
• A push notification token, only if you turn on notifications.
• Transactions captured automatically from your bank's notifications, only if you turn that on. Section 3 explains exactly what this reads and what it keeps.
• Device information (browser, language, timezone) for session handling.

3. Automatic transaction capture (Android)

Koma can log your spending on its own by reading the transaction alerts your bank sends to your phone. This is off until you turn it on, and it only ever reads the banking apps you pick yourself.

• Koma reads notifications only from the apps you selected. Notifications from every other app are ignored and never leave your phone.
• From a bank alert, Koma stores the amount and currency, the merchant name, the last four digits of the card, the bank's own reference for the purchase, and the date and time the bank says it happened.
• The bank's original message text is stored only if you also turn on the option that lets Koma learn message formats it does not recognise yet. It is deleted automatically 30 days later.
• To suggest which apps to pick, Koma notes which apps on your phone look like banking apps. That list is kept encrypted on your phone and is never uploaded to our servers.
• The phone doing the capture holds a device token so it can add transactions to your account. You can revoke it from Settings at any time, and turning the feature off stops the reading immediately.
• Android never grants this access silently. You have to switch Koma on yourself in your phone's notification access settings, and you can switch it off there whenever you want.

4. Lawful basis

We process this data on the lawful basis of your explicit consent under Article 6 of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

5. How we use it

• Budgeting and spending insights tailored to your pay cycle.
• Tracking the money you set aside for family, and your goals.
• AI-assisted logging when you choose to use the chat assistant.
• Logging transactions for you automatically, if you turned on automatic capture.
• Sending you the notifications you asked for.

6. Artificial intelligence processing

When you type into the chat assistant, log a transaction in your own words, or message the Telegram bot, that text is sent to Google and processed by the Gemini model so Koma can understand it. Koma does not store your chat messages as message records. The transaction, budget, or goal that results from the text is stored, because that is the thing you asked Koma to remember.

If you turned on automatic capture and your bank sends an alert in a format Koma does not recognise yet, the text of that alert is sent to Google and processed by the same model so Koma can read the amount and the merchant. Once Koma has learned that bank's format, later alerts in the same format are read on our own servers and are not sent to Google.

7. Who processes your data

We use the following processors, each bound to process data only on our instructions:

• Google (Gemini): processes text you type, as described above.
• Supabase: database and authentication.
• Vercel: application hosting.
• Sentry: crash and performance diagnostics.
• Firebase Cloud Messaging: push notification delivery on Android.
• Resend: transactional email, including your sign-in code.
• Upstash: caching and rate limiting.
• CurrencyBeacon: exchange rates. No personal data is sent to it.

8. What we do not do

Koma contains no advertising, no advertising identifier, and no third-party analytics software. We do not track you across other apps or websites, and we do not sell or rent your personal data. We do not read notifications from apps you did not select, and we never send the list of apps installed on your phone to our servers.

9. Security

Your data is encrypted in transit over HTTPS on every request, and encrypted at rest by our cloud infrastructure providers. On your phone, the automatic-capture device token and anything waiting to be sent are held in encrypted storage.

10. Retention

We keep your data while your account is active. The original text of a bank alert is an exception: it is erased 30 days after we receive it, while the transaction it produced stays. You can delete your account at any time from Settings; after deletion, your data is removed from production systems within 30 days and from backups on the following rotation.

11. Your rights

Under the UAE PDPL you have the right to access, rectify, delete, or object to our processing of your personal data, and to withdraw your consent at any time. Account deletion (Settings) is the canonical path to exercise the right to withdraw consent.

12. Contact

For any privacy-related inquiry, or to exercise your rights, contact us at privacy@heykoma.com.