Kumbak Privacy Policy

Master text in English (DE, FR, IT, ES, PT are translations; if they differ, this text prevails). Version of 5 November 2026, in force since 5 November 2026.

In short

• Your purchases stay on your phone. Purchases, deadlines, amounts and notes are kept in an encrypted database on your device. We never receive them. Receipt photos are only read on your phone and are not kept.
• No account. Kumbak asks for no name, e-mail address or password.
• Premium is checked with Google Play. Our server keeps only a hashed and encrypted subscription identifier, its status and expiry, and deletes it 180 days after the subscription ends.
• The free version shows one ad when you open the app, at most once every four hours, provided by Google AdMob. In the EU/EEA, the United Kingdom and Switzerland we ask for your consent first. Premium has no ads.
• Our website sets no cookies, keeps no IP addresses in its logs and uses no analytics, tracking, external fonts or scripts.
• The deadlines and rules in Kumbak are general information, not legal advice: always check them yourself. See section 3 of our Terms of Service.

1. Who is responsible

The controller is the operator of Kumbak:
Kumbak
Switzerland
E-mail: team@kumbak.app

The operator's full name, postal address and telephone number are shown in the developer information of the Kumbak listing on Google Play and are provided on request by e-mail.

We have not appointed a data protection officer, because the law does not require one for Kumbak.

2. Which laws apply

We are based in Switzerland, so the Swiss Federal Act on Data Protection (FADP) applies. Because Kumbak is offered to people in the EU/EEA and the United Kingdom, the EU General Data Protection Regulation (GDPR, Art. 3(2)) and the UK GDPR also apply to the processing described here.

3. Data on your phone (Free and Premium)

Everything you enter or import into Kumbak — purchases, deadlines, amounts and notes — is stored only on your device, in a database encrypted with a key kept in your phone's secure hardware keystore. When you scan a receipt, the photo or PDF is read on your phone with Google ML Kit text recognition (its usage statistics are switched off); only the purchase data taken from it is saved, and a photo taken with the camera is deleted right after reading. Files you share or import (e-mails, texts, attachments, store exports) are read on your device in the same way; Kumbak does not keep a copy. Calculations also run on your device. Reminders are local notifications scheduled on your phone: no push service is used and no device identifier is sent to us.

• We have no access to this data and cannot see, restore or delete it for you.
• Android's system backup and device-to-device transfer are switched off for this data.
• Free version: there is no backup. If you lose or reset your phone, or delete the app, the data is lost. The app tells you this before you add your first purchase.
• Importing e-mails: you can share a single e-mail, text or attachment from your mail app to Kumbak. It is read on your device. Kumbak has no access to your mailbox and no forwarding address.
• Importing a store's data export: you can open the order history a store gives you on request (a CSV or ZIP file). It is read on your device and only the purchases you choose are saved. Kumbak never logs into your store account.

4. Data our server processes

Our server (api.kumbak.app) runs on hardware we operate in Switzerland. It is reached through Cloudflare (see section 7).

a) Premium subscription. When you buy Premium, payment is handled entirely by Google Play; we never see your name, e-mail address or payment details. The app sends us the Google Play purchase token and product. Our server asks Google for the subscription status, confirms new purchases to Google, and stores:

• a SHA-256 hash of the token (used to find the record) and the token itself, encrypted;
• product, base plan (monthly/yearly), status, end of the paid period, and the times of creation and last check.

Google also sends us automatic notifications when a subscription changes (via Google Cloud Pub/Sub). We use them only to ask Google for the current status. Google provides us with sales reports for our accounting; they may show your country and postal code, but not your name or e-mail address. Purpose: to give you Premium. Legal basis (GDPR): performance of the contract, Art. 6(1)(b).

b) Legal rules. The app downloads updates of the legal-rules files (deadlines, warranty periods, store policies). These files contain no personal data; the request only reveals technical data (see d).

c) Complimentary codes. When you redeem a code, the app sends it to our server once. For a code limited to a number of devices, the server then gives your phone a random activation token, which the app sends at every start to confirm Premium. We store only a SHA-256 hash of the code, its status and, for limited codes, a hash of each activation token and its slot number. No name, e-mail address, advertising ID or other device identifier is involved. Purpose: to provide Premium from the code and prevent its use on more devices than allowed. Legal basis: performance of the contract, Art. 6(1)(b) GDPR.

d) Technical data. Each connection to our server or website necessarily transmits your IP address, the address requested, date and time, and the app or browser type. Our website log records only the page requested, the result and the time: no IP address and no browser data. Our API logs record the method, path, result and duration of a request, but not your IP address or the content of the request; for status checks the path contains the hashed identifier. For abuse protection your IP address is held in memory for about one minute. Logs are overwritten automatically when they reach a fixed size and are not archived. Purpose: operating and securing the service. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

5. Premium backup to your own cloud

With Premium you can back up your data to your own Google Drive (iCloud will follow on iOS). The backup is encrypted on your phone before upload (AES-256), with a recovery key shown to you once. The app keeps a copy of the key only on your phone, so that later backups need no input; we never see it and cannot read, recover or delete the backup. To reach your Drive, the app asks Google for access to its own hidden app folder only (permission "drive.appdata"), and Google shows you the account and the permission before you agree. The app receives a temporary access token for that folder, uses it only on your phone and never sends it to us. The file is stored in that hidden folder under your own agreement with Google; you can delete it in the app (Backup → Turn off backup) or in Google Drive (Settings → Manage apps). Without the recovery key the backup cannot be restored. Restoring a backup remains possible after Premium ends.

6. Ads in the free version

The free version shows one full-screen ad when you open the app, at most once every four hours; there are no other ads. Ads are provided by Google AdMob (Google Ireland Limited for users in the EU/EEA and Switzerland, Google LLC elsewhere). To show and measure ads, Google processes your advertising ID, IP address, device and app information and your consent choice. Ad requests never contain your purchases or anything else you enter in Kumbak.

In the EU/EEA, the United Kingdom and Switzerland the app asks for your consent with Google's consent form before ads are requested. If you do not consent to personalised ads, Google shows only non-personalised or limited ads. You can change your choice at any time in the app under Settings → "Privacy choices for ads". You can also reset or delete your advertising ID in your Android settings. Google uses the data as described in its privacy policy (policies.google.com/privacy) and at policies.google.com/technologies/partner-sites.

Legal basis: consent, Art. 6(1)(a) GDPR, for personalised ads and wherever storing or reading information on your device requires it; for non-personalised ads, our legitimate interest in financing the free version (Art. 6(1)(f) GDPR). Premium has no ads, and the app then makes no ad requests.

7. Service providers and recipients

We do not sell your data. We use these providers, bound by data processing agreements or their own terms:

We use Google Search Console to see how our website appears in Google Search; it does not run on your device. We may disclose data to authorities where required by law.

8. International transfers

Our server is in Switzerland, which the EU and the UK recognise as providing adequate protection. Some providers process data in other countries, including the USA. Where a country lacks adequate protection, we rely on the provider's certification under the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses (with the Swiss and UK addenda). You can ask us for a copy of the safeguards.

9. How long we keep data

Records we must keep under accounting or tax law are kept for the period the law requires.

10. Your rights

Depending on the applicable law you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting earlier processing). Write to team@kumbak.app.

Because we have no accounts, our Premium records contain no name or e-mail address, so we cannot find a record from them; if you write to us, we will tell you what we need to identify a subscription. Data on your phone is under your control: you can view or delete it in the app. To cancel Premium, use your Google Play subscriptions; cancelling does not happen by deleting the app.

You may lodge a complaint with a supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch
• EU/EEA: the data protection authority of the country where you live or work
• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk

We do not make decisions about you based solely on automated processing.

11. Security

The local database is encrypted (ChaCha20-Poly1305, key in the hardware keystore). Connections use TLS, and the app accepts only certificates from the certificate authorities used by Cloudflare. Purchase tokens are stored encrypted with a key kept apart from the database. The rules files are digitally signed and checked by the app before use.

12. Children

Kumbak is not directed at children under 16. We do not knowingly process data of children under 16. If you believe a child has used Premium, contact us.

13. Changes

We will update this policy when Kumbak changes, in particular before new features (such as store connections or iOS) go live. The current version and its date are always available at https://kumbak.app/en/privacy/ and in the app. The rules for using Kumbak are in our Terms of Service. We will inform you in the app of significant changes.