SumaFlow Kaban never sees your money. Your accounts, transactions, budgets, goals and net worth are created and kept on your own phone or tablet. We operate no server that could receive them, and the app asks for no bank login of any kind.
No data collected. No data shared with third parties.
This is the posture Kaban's Google Play Data Safety card declares. Buying SumaFlow Kaban Pro goes through Google Play, which processes the payment — see Payments.
SumaFlow Kaban is in open beta — Google Play open testing, free to join and free to use while it lasts. Beta status changes what is polished, not what is private: the architecture this policy describes is the one that ships, and none of the promises below are relaxed for testers. We collect nothing extra from beta users — no usage analytics, no crash telemetry, no tester profile. Nothing below is a plan; it is what the code already does.
The one network use
Most privacy policies for finance apps spend a page explaining which servers the app talks to. This one has almost nothing to list: Kaban's own code opens no connection, speaks no HTTP, and contains no client capable of either. Every figure you see is derived on your phone from an encrypted database, with no account and no server behind it.
The app's INTERNET permission exists for exactly one
purpose: Google Play Billing, which sells SumaFlow Kaban Pro.
Nothing else in the app uses it, and no user content crosses it.
A test in the repository enforces that on every build: it fails if a
network-capable package is added, if a socket or HTTP client appears
anywhere in the app source, or if the font library's runtime-download
switch is turned back on. You can read it at
test/data/no_network_test.dart, and the boundary it pins is drawn out in full
on the privacy architecture
page.
One correction, made plainly. An earlier version of
this page said the release build did not request Android's
INTERNET permission at all. That stopped being true when
SumaFlow Kaban Pro was added. Google Play Billing — the only way Android
permits an app to sell anything — brings INTERNET with
it, along with a Google telemetry component that the billing library
uses for its own purchase reporting. Neither can be removed while
selling through Play; we tried, and the app will not build without
them. We would rather explain that than quietly delete the paragraph.
What it does and does not mean: no ledger data goes anywhere. Billing carries a product id and a purchase token, and by construction has no access to your accounts, balances, transactions, payees, envelopes or goals. Google learns that a purchase happened — as it would for any paid Android app, because Google processes the payment — and nothing about your money.
The three permissions Kaban requests for itself are all local: biometric authentication for the app lock and export confirmation, local notifications for bill reminders and budget alerts, and the ability to re-arm those reminders after you reboot. None of them carries data off the device.
In-app purchases
During the open beta nothing is for sale. Every Pro
feature is unlocked for every tester, no purchase flow is reachable in
the build, and no charge is ever attempted. The billing library is
present — which is why the INTERNET permission is — but it
is not selling anything yet. What follows describes how buying Pro will
work once it is.
SumaFlow Kaban Pro is an optional in-app purchase processed by Google Play. We run no payment server and receive no payment details — your card, billing address, and Google account are handled by Google, not by us — and buying Pro creates no account with SumaFlow. Pro unlocks app features only; it does not change where your money data lives, and the billing channel carries none of your accounts, balances or transactions. Purchases are governed by Google Play's own terms and privacy policy.
If your subscription lapses, nothing you have made is taken away or hidden — your rules, holdings and saved reports stay exactly where they are and keep working; you simply can't create new ones until you renew. Your ledger, your exports and your backups are never gated on any tier.
No bank credentials, ever
Kaban does not connect to banks, and there is no screen anywhere in it that asks for a banking username, password, one-time code, or card number. Aggregation services of that kind are deliberately absent — not deferred, rejected. Balances are ones you enter or that Kaban derives from your own ledger, and statements arrive as files you choose to import.
Data collected
None. Your accounts, transactions, categories, budgets, goals, household members, receipt photos and reports live in a database on your device. They are never transmitted to SumaFlow or to anyone else, because there is no SumaFlow server to receive them and no permission to reach one.
Data shared
None of your money data, ever. The app contains no analytics SDKs, no advertising SDKs, and no crash reporting. Nothing about you phones home — not usage counts, not "anonymous" launch pings, not a stack trace when something breaks. The trade-off is honest and worth stating plainly: because we receive no diagnostics, a bug you don't report is a bug we will not learn about.
The one third-party component in the app is the telemetry library that Google Play Billing requires in order to sell SumaFlow Kaban Pro, described under Kaban makes no network calls above. SumaFlow did not choose it, does not call it, and cannot remove it while selling through Play — and it has no access to your ledger.
Security practices
- The ledger is encrypted at rest. Kaban stores its database with SQLCipher (AES-256). The 256-bit key is generated on your device at first launch and held in Android's Keystore — backed by StrongBox hardware where the device provides it. The key never leaves the phone.
- The app locks. A device biometric or PIN gates entry. Individual household members can additionally hold a profile PIN, stored only as an Argon2id hash, which gates switching into their role.
- Roles are enforced in one place. Who may see or change what is decided by a single guard in the domain layer rather than by each screen, so a permission cannot be bypassed by reaching a screen another way.
- Receipt and goal photos are copied into app-private storage that other apps cannot read.
Backups you control
A backup is a single file encrypted with a passphrase you choose, written wherever you send it. It is a standard SQLCipher database — the passphrase is stretched with SQLCipher's own PBKDF2-HMAC-SHA512 and a per-file random salt — so it is a portable, documented format rather than something homemade, and the device's own Keystore key is never written into it.
We cannot recover a backup passphrase. There is no cloud copy and no key escrow. If you lose it, that file is unrecoverable — the direct and unavoidable cost of us holding nothing.
What leaves your device
Only what you deliberately send. Kaban can export your full ledger as CSV and JSON, export a report as CSV, and produce PDFs for printing or sharing. Each of these is something you initiate, and a full export is gated behind the Steward role plus a biometric confirmation. Once a file is in your email, your cloud drive, or a chat app, it is governed by that service and no longer by us — Kaban cannot protect a file after it leaves.
Data ownership is not a paid feature and never will be: export exists so that leaving is always possible.
Notifications and the home-screen widget
Bill reminders and budget alerts are scheduled by Android on your device. There is no push infrastructure and no server deciding what you should be told. The optional home-screen widget renders a small cached summary pushed to it by the app; the widget itself never opens the encrypted ledger.
Two features that do not exist yet
Kaban's settings mention two capabilities that would involve a network, and we would rather explain them now than have you find them and wonder:
- Investment price refresh. A switch exists, but no price source has been chosen and no fetching code is in the app, so turning it on does nothing beyond telling you it is not set up. If it ever ships it will be opt-in, monthly, and limited to ticker symbols — it would send which securities you hold to a price provider, never how many or what they are worth. Today, prices are set by hand.
- Sync across devices. Marked as a later version in the app. Only the offline merge logic exists today; the part that would move data between phones is not built. The design is end-to-end encrypted so that any relay would carry ciphertext only, and this policy will be updated before any such thing ships.
Until then the app is fully functional in airplane mode, which is the simplest way to verify all of the above for yourself.
What this does not protect against
Stating the limits is part of being trustworthy about the rest. Kaban's encryption protects data at rest on a working device; it cannot defend against a compromised or rooted operating system, against malware with screen-reading privileges, or against someone who knows your device passcode. A household member holding the Steward role can see the household's books — that is the point of the role, and it is a matter of who you trust, not of cryptography. Nor can any app protect you from being compelled to unlock it.
Not financial advice
Kaban helps a household keep its own records and see them clearly. It does not provide financial, tax, or investment advice, and its summaries and insights are descriptions of numbers you entered. The decisions remain yours.
Data deletion
Delete the app, and its data goes with it — there is no account to close, no server-side copy to request the erasure of, and no retention period to wait out. Individual records can be deleted inside the app at any time. Exports and backups you have already made are yours to manage; we have no way to reach them.
Children
SumaFlow Kaban is designed for adults managing a household's finances and is not directed at children under 13. Households can give a member a limited role, but the app is not a children's product and collects nothing from anyone.
Contact
For privacy questions or data-rights requests, email [email protected]. In practice we hold no data about you to disclose, correct, or delete — but the address is real and answered.