Privacy Policy
The short version
- The waitlist stores your email and your answers to the form, in Singapore.
- The Kelpie app stores the accounts, transactions and other records you and your forwarded bank alerts create, so it can show them back to you. Read the app section.
- You can export your transactions as a CSV file and delete all your Kelpie data from inside the app. Deletion starts with a 7-day grace period.
- Kelpie never reads your inbox. It sees only the bank alert emails you choose to forward.
- We use them to send you one confirmation email and your beta invite, and to decide which banks to support next.
- We do not sell your data, show ads, or share it with anyone except the service providers listed below. Our usage analytics never include amounts, merchants, descriptions, account names or email addresses.
- You can unsubscribe from any email, and you can ask us to see, correct or delete your data at privacy@kelpie.site.
Who we are
Kelpie ("we", "us") is a personal finance app for iPhone, run by an individual developer based in Singapore. This policy covers the website at kelpie.site, the waitlist, and the Kelpie iPhone app. It is written to meet Singapore's Personal Data Protection Act 2012 (PDPA).
Our Data Protection Officer can be reached at privacy@kelpie.site.
The website and waitlist
What we collect when you join the waitlist
- Your email address.
- Your answers: your bank, your country, which email service receives your bank alerts, and your confirmation that you are 18 or older.
- How you found us: the campaign tags in the link you followed (such as utm_source or ref) and the page that referred you, if your browser shares it.
- Records of the sign-up: when you joined, when we sent the confirmation email, when you confirmed, and when you unsubscribed. We keep only a one-way hash of the confirmation link, never the link itself.
Bot and abuse protection
The form uses Cloudflare Turnstile to check that a person, not a bot, is signing up. Turnstile runs in your browser and Cloudflare receives technical signals such as your IP address and browser details. When you submit, we pass the Turnstile result and your IP address to Cloudflare to verify it.
To limit repeated sign-ups we count attempts per IP address per hour. We never store your IP address: we store only a keyed one-way hash of it, which cannot be turned back into the address, and we delete these counters within two days. When many sign-ups come from the same address in one hour, the later ones are saved and their confirmation email is sent after the hour ends. While a sign-up waits, it keeps that hash so queued emails go out in order; we delete the hash as soon as the email is sent, and in any case within two days.
Why we use it
- To send you one email asking you to confirm your spot, and later your TestFlight invite.
- To decide who gets invited first and which bank to support next.
- To understand which posts and links bring people to Kelpie.
- To keep the waitlist free of bots and abuse.
We rely on your consent, which you give by submitting the form. You can withdraw it at any time (see "Your choices and rights").
What we don't do
Kelpie's own pages set no cookies and use no advertising or cross-site tracking. The form keeps the campaign tags from your link in your browser's session storage until you close the tab, so they survive moving between our pages. Cloudflare Turnstile may store a short-lived token in your browser to do its check.
How long we keep it
- Waitlist entries: until you ask us to delete them.
- If you unsubscribe: we keep your email address and the date you unsubscribed, only so that we never email you again. Ask us and we will delete that too.
- Rate-limit counters and the hashed address on a queued sign-up: deleted within two days.
- Emails you send us: kept only as long as we need them to answer you and keep a record of the conversation. Ask us and we will delete them.
In the Kelpie app
This section applies once you sign in to the Kelpie iPhone app, including during the TestFlight beta. The app is for people aged 18 and over.
What the app collects and stores
- Your sign-in: Sign in with Apple gives us a unique account ID and, if you share it, your email address (which may be an Apple private relay address). We do not receive your Apple password.
- Your age confirmation: the date you confirmed you are 18 or older, and the country of your App Store storefront (for example SGP).
- Your financial records: the accounts you create (name, currency, opening balance), transactions, categories, budgets, subscriptions, income sources and balance snapshots. Transactions come from bank alerts you forward, statements you import, and entries you make by hand or with Siri. Statement PDFs are read on your iPhone and are never uploaded; only the transactions you choose to save are stored.
- Your forwarding address and forwarded alerts: Kelpie gives you a private forwarding address on in.kelpie.site. For each email sent to it we keep the figures we read (amount, merchant, date), a message ID used to avoid duplicates, whether the bank's signature checked out, and what we did with it. We do not keep the full email unless it is an alert we could not read and you turned on "Keep alerts Kelpie can't read for 30 days". Gmail also sends a confirmation email to this address when you set up forwarding; we keep the code in it so the app can show it to you.
- Your settings: onboarding progress, forwarding preferences, widget and notification settings, and the push tokens your iPhone gives Apple for notifications and widget refreshes.
- AI advisor data, if you use it: your conversations, saved memory notes, and the AI provider key you add. Your key is stored encrypted. If you do not add a key, the AI features stay off.
- Usage analytics: which screen or onboarding step you reached and whether setup finished, tied to your account ID. See "Analytics" below.
Why we use it
- To show your own spending, balances, budgets and subscriptions back to you.
- To log bank alerts automatically and to read statements you import.
- To send the notifications and widget updates you turn on.
- To run the AI advisor when you ask for it.
- To see where people get stuck in setup, so we can fix it.
We do not sell this data, use it for advertising, or use it to train AI models.
Forwarded bank alerts
Kelpie does not connect to your mailbox. You set up a filter in your own email service that forwards only your bank's alert emails to your forwarding address. Cloudflare receives the email and passes it to our servers, which read it. Only alerts carrying a valid signature from the bank's own domain are saved as transactions. Anything else, such as an alert you forwarded by hand, is used at most to show you a preview during setup and is never saved as a transaction. Alerts we cannot read are discarded straight away unless you have opted in to 30-day retention, in which case we keep the email for 30 days and then delete it. You can pause forwarding, change your forwarding address (the old one stops working immediately), or turn the 30-day option off, at any time in the app.
AI features and your provider key
The AI advisor runs only on an AI provider key that you add yourself, and any charges are yours. When you ask the advisor something, the question and the parts of your financial records needed to answer it are sent to the provider you chose (for example OpenAI, Anthropic, Google or Groq), under that provider's terms. Kelpie does not use its own AI keys for your requests. You can remove your key in the app at any time.
Analytics
The app sends product analytics to PostHog's EU cloud. Events say what you did in the app, such as "finished the accounts step", and are tied to your Kelpie account ID. A filter in the app drops anything that looks like financial content, so events never carry amounts, merchants, descriptions, account names or email addresses. Screen recordings, where used, are limited to onboarding screens with text masked.
Exporting and deleting your data
- Export: the "You" tab has an option to export your transactions as a CSV file.
- Delete: the "You" tab also has "Delete my Kelpie data". You type DELETE to confirm, and your deletion is scheduled for 7 days later. If you sign in during those 7 days, the app shows the deletion date and a Restore button, and nothing is removed until the date passes.
- What deletion removes: your accounts and every financial record, your forwarding address and settings, your push and widget tokens, your AI advisor conversations, memory and stored provider key, and finally your sign-in itself.
Backups
We do not currently keep backups of the app database. When your scheduled deletion takes effect, your data is removed and cannot be recovered. We keep a log of deleted account IDs and deletion dates (nothing else) as a record that each deletion was carried out.
How long we keep it
- App data: until you delete it, or until the deletion you scheduled takes effect.
- Unreadable alerts you opted to keep: 30 days.
- Deletion log: your account ID and the deletion date, kept as a record that the deletion was carried out.
Who processes your data
We use these service providers to run Kelpie. Each processes data only to provide its service to us, except your chosen AI provider, which acts under your own agreement with it.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and servers for the waitlist and the app | Singapore |
| Convex | AI advisor data: conversations, memory and your encrypted provider key | EU (Ireland) |
| Amazon Web Services (SES) | Sending our emails | Mumbai, India |
| Cloudflare | Hosting this website, Turnstile bot protection, receiving email sent to kelpie.site and to your forwarding address | Global network |
| PostHog | Product analytics from the app, without financial content | European Union |
| Apple | Sign in with Apple, TestFlight and App Store distribution, push notifications | Global |
| Your chosen AI provider | Answers AI advisor questions, only if you add your own key | Depends on the provider you pick |
| Google (Gmail) | Our inbox: email you send to kelpie.site addresses is forwarded here | Global |
Some of these providers store or process data outside Singapore. Where they do, we rely on their contractual commitments to protect it to a standard comparable to the PDPA.
Your choices and rights
- Unsubscribe: every email we send has an unsubscribe link.
- Access and correction: ask us what data we hold about you, or ask us to fix it.
- Withdraw consent and delete: ask us to stop using your data and delete it. App users can also do this themselves with the in-app delete button and CSV export described above.
Email privacy@kelpie.site from the address you signed up with. We reply within 30 days. If you are not satisfied with our answer, you can contact Singapore's Personal Data Protection Commission.
Security
Your data travels over encrypted connections. Each person's app data is protected by row-level access rules in the database, so one account cannot read another's, and the waitlist can only be read by our own server code, not by visitors to the site. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the PDPA requires.
Age
Kelpie is for people aged 18 and over. The app asks you to confirm this the first time you sign in. We do not knowingly collect data from anyone younger. If you believe a minor has signed up, email us and we will delete their data.
Changes
We will update the date at the top whenever this policy changes.