Privacy Policy

Introduction

Karrat (“we,” “our,” or “the App”) is a personal finance application that helps you track your net worth, monitor account balances, view transactions, and manage your financial picture in one place. We take your privacy seriously.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. By using Karrat, you agree to the practices described in this policy.

1. Information We Collect

1.1 Account Information

We collect your email address, display name and authentication information. You may also provide a profile photo, date of birth, occupation and financial preferences to personalize Karrat.

1.2 Financial Information

We collect financial information you enter or connect through Plaid, including accounts, balances, transactions, holdings, debts and financial plans. Connected account information may include institution names, partial account numbers, merchant details, investment cost basis, interest rates and payment schedules. We never receive or store your bank login credentials.

1.3 Subscription Information

We collect purchase identifiers, subscription plan and status information. Apple processes payments, and RevenueCat manages subscription verification. We do not receive your payment card details or billing address.

1.4 Group Information

We store household membership, roles and invitations. Financial information you connect to a household is shared with its other member. If either member uses the AI Coach, the household's financial information can be included in what that member's questions send to our AI provider (see Section 3). Retention after disconnection or deletion is explained in Section 5.

1.5 Device and Usage Information

We collect app usage events, device information and error reports, which may be associated with your account. If you enable push notifications, we also collect a device delivery token.

1.6 Optional Permissions

With your permission, we use your selected photo for your profile and foreground location to find a property address. We store the address you confirm, not your coordinates. Biometric App Lock operates on your device; we do not receive biometric data. You can manage permissions in iOS settings. We do not collect background location, contacts, calendar entries or microphone audio.

2. How We Use Your Information

We use your information to provide financial tracking, planning and AI features; support household sharing; manage subscriptions; deliver alerts; improve Karrat; and prevent errors, fraud and abuse. We do not sell your personal or financial data, share it with data brokers, or use financial information for advertising or marketing.

3. Service Providers

We use service providers to operate Karrat, including Plaid for bank connections, Supabase for hosting and authentication, and Apple and RevenueCat for subscriptions. Connected accounts are also subject to Plaid's privacy policy and End User Services Agreement.

PostHog and Sentry help us understand app usage and diagnose errors. These records may be associated with your account. We use controls to exclude financial account data from analytics and redact financial values from error reports.

When you use AI coaching, your messages and relevant financial context are processed by Anthropic models hosted on Amazon Web Services (AWS), configured for zero data retention and no model training. If you share a household, that context can include the household finances you can see in Karrat, including the other member's first name, accounts, balances, bills and transactions. Your AI Coach conversations are stored only on your device. Karrat's servers hold each answer briefly so it can reach your phone, then delete it. If you use the AI helper to describe an item you are adding, such as a vehicle, Karrat sends only the text you type to OpenAI, after asking your permission, to fill in the form. OpenAI may search the public web for details such as market values. No account, balance or portfolio data is sent, and OpenAI is not used for the AI Coach.

Market and property data providers receive ticker symbols or the property address you submit for a valuation. Push notification providers receive a delivery token and notification content, which may include transaction amounts, merchant names, spending totals or AI Coach answers for categories you enable. You can control notification categories in the App.

4. Data Security

We use encrypted connections, encrypted database storage, access controls and other safeguards to protect your information. No system is completely secure. We will notify you of security breaches affecting your personal data as required by applicable law.

5. Data Retention

We retain account, subscription and saved financial records while you maintain your account, unless you delete them or revoke access as described here. Disconnecting a bank stops imports but keeps saved history. Deleting a linked account removes its connection and bank transactions; planning records and some investment history may remain.

When Plaid reports revocation for an account, we remove that account's imported details and attached edits. Bills and income added to your plan and completed historical totals may remain. Disconnecting or revoking access does not end household sharing.

Account deletion removes your application records, photo and sign-in account, but failures may require follow-up. Shared manual records and detailed investment history may remain identifiable and visible to a surviving household. Limited records remain as needed for consent, security, recovery and completing bank disconnections. Backups and provider records may persist until their retention periods expire or separate deletion requests are completed. We attempt to request analytics deletion after account deletion. Contact privacy@karrat.ai for deletion requests or incomplete removal.

6. Data Sharing

We do not sell, rent or trade your personal or financial data. We share information with the service providers described above to operate Karrat, with household members you choose to share with, or in response to valid legal process.

7. Your Rights and Choices

7.1 Access and Portability

You can view all of your financial data within the App at any time. If you would like a copy of your data in a portable format, contact us at the email address below.

7.2 Deletion

You can disconnect bank connections, delete linked accounts, or delete your Karrat account through the app. These actions have different effects and retention exceptions described in Section 5. You can also request deletion at privacy@karrat.ai.

7.3 Withdrawing AI Consent

You can withdraw your consent to AI Coach data sharing at any time in Settings, under Account settings and then Privacy. After you withdraw it, Karrat stops sending your data to the AI service until you allow it again. Chats already on your iPhone stay there unless you delete them. The AI helper for describing items asks for your permission separately, and you can decline it and enter details manually instead.

7.4 California Residents (CCPA)

If you are a California resident, you have additional rights under the CCPA including the Right to Know, Right to Delete, Right to Non-Discrimination, and Right to Opt-Out of Sale (we do not sell personal information).

7.5 European Residents (GDPR)

If you are located in the EEA, you have rights under the GDPR including the Right of Access, Rectification, Erasure, Restriction of Processing, Data Portability, and the Right to Object.

8. Children's Privacy

Karrat is not intended for use by children under the age of 18. We do not knowingly collect personal information from children.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other appropriate means before the changes take effect.

10. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

Email: privacy@karrat.ai

We will respond to all privacy-related inquiries within 30 days.

This Privacy Policy is effective as of October 21, 2026.