Privacy Policy
Kash · Effective November 5, 2026
The short version
- The Android app reads SMS from banks and mobile-money services only, to build your transaction history.
- Your transactions and those bank messages are synced to your Kash account so you can see them on the web and keep them if you change phones.
- Only you can see your data when signed in. The developer can access it to fix import problems and answer support requests.
- We don't sell your data, show ads, or share it with anyone for marketing.
- You can delete your account and all of its data from the app at any time.
Who we are
Kash is an independent app made by Nahusenay Gebreamlak in Ethiopia. If you have any question about this policy or your data, email nahusenaygebreamlak@gmail.com.
What we collect
- Bank and wallet SMS. With your permission, the app reads text messages from a fixed list of Ethiopian banks and mobile-money services (for example CBE, Telebirr, Bank of Abyssinia, Awash and Dashen). Messages from those senders about money (payments, transfers, balances) are stored and synced to your account. Other messages they send, such as one-time codes and promotions, are not uploaded. Messages from anyone else are not stored by the app and their text is never uploaded.
- Transactions. From those messages the app extracts amounts, dates, balances, fees, reference numbers, the name or masked account of the other party, receipt links, and your own masked account number.
- Your categories and reviews. The categories you assign and the rules the app learns from them.
- Account details. Your email address, the name you enter, and, if you use Google sign-in, the basic profile Google shares (name and email).
- App and dashboard usage. When you use the app or the web dashboard we record session start and end times and the app version, plus your browser's user-agent on the web or your phone's Android version and model in the app. The app also sends a random install ID, a few in-app events (for example finishing an SMS scan, setting a PIN, or an error) and its sync status (how many items are waiting to sync, the last sync error, and whether SMS access and a PIN are on). We use this to see which versions are in use and to find bugs.
- Crash reports. If the app crashes or hits an error, it sends a report to Sentry: the technical error and where in the code it happened, the app version, your phone's model and Android version, and the random install ID. Numbers and quoted text are removed from error messages before they are sent, and reports never include your messages, amounts, balances, account numbers, name, email or phone number.
- Feedback. Answers you choose to give in the in-app feedback survey.
We do not collect your contacts, location, photos, or your personal (non-bank) messages, and we never ask for your bank PIN or password.
Phone permissions
- Read SMS and receive SMS. Reading bank SMS is the core of Kash: without it the app can't build your history. The app checks each message's sender and keeps only the ones from the bank and mobile-money list above. The app explains this on screen before Android asks, and works without it if you'd rather add transactions by hand.
- Notifications. To tell you about new transactions, reviews and reminders. You can turn them off at any time.
- Background work. To scan your SMS history the first time you open the app and to keep syncing when you're offline or the app is closed.
How we use it
- To show your balances, transaction history, categories and spending insights in the app and on the web dashboard.
- To keep your data in sync between your phone and the web, and to restore it if you sign in on a new phone.
- To fix messages the app fails to read correctly and to improve support for more banks.
- To answer you when you contact support.
Where it is stored and who can see it
- On your phone. A copy is kept in the app's private storage. It is excluded from Android cloud backups and phone-to-phone transfers. Logging out does not erase it; deleting your account or uninstalling the app does.
- In the cloud. Synced data is stored with Supabase, our database provider, and is sent over an encrypted (HTTPS) connection. Database rules allow each account to read only its own data.
- The developer. The developer's admin account can read synced transactions and bank messages. This access is used only to fix import problems, investigate bugs, and help you when you ask for support.
- Service providers. Supabase (database and sign-in), Google (if you choose Google sign-in), Cloudflare (hosting this website and the web dashboard) and Sentry (crash reports) process data only to provide those services.
We don't sell your data, use it for advertising, or share it with anyone else unless the law requires us to.
How long we keep it
We keep your data while your account exists. When you delete your account, your account and all of its synced data (transactions, bank messages, categories, sessions and other records) are deleted from our database straight away. Feedback survey answers are kept but are no longer linked to you.
Your choices
- Delete your account: in the app, go to Settings → Delete account. This removes your account and its data from our servers and clears it from your phone. If you can no longer sign in, see how to delete your account by email.
- Stop SMS reading: revoke the SMS permission in your phone's settings, or uninstall the app.
- Notifications: turn them off in Settings → Notification Preferences or in your phone's settings.
- A copy or a correction: email us and we'll help.
Children
Kash is not intended for children under 13, and we don't knowingly collect their data.
Changes to this policy
If we change how we handle your data, we'll update this page and the date at the top. For significant changes we'll also tell you in the app.
Questions? nahusenaygebreamlak@gmail.com