Privacy Policy

Last updated: 23 September 2026

Kosht ("the app", "we", "us") is a personal finance app with an AI assistant called Vira. This policy explains what data the app handles and how.

What we handle

Financial data you enter. Transactions, budgets, goals, accounts, subscriptions, and projects you create in the app. This data is stored on your device and, if you use iCloud, synced through your private iCloud account (Apple CloudKit). We do not have access to your private iCloud data.

Authentication (Firebase). We use Firebase Authentication (Google) to sign you in and to secure requests to our server. We do not store your password. A record identified by your account ID is kept in Firebase (Cloud Firestore) to enforce AI usage limits.

Vira AI. When you chat with Vira or send her a photo or PDF, your message and the relevant financial context needed to answer are sent to our server (kosht.finance) and to our AI provider, Anthropic (Claude), solely to generate a response. This data is used only to answer you and is not used to train models. We do not store the text of your conversations with Vira on our server, your chat history lives only on your device. Our server records only the number of tokens used per request, to enforce the beta usage limit.

Analytics (TelemetryDeck). We track a small, fixed set of product events, never your in-app behavior: your first app launch, your first monobank connection, whether Vira's first proactive message (sent after you connect monobank) was sent, opened, and replied to, and whether you returned to the app on day 2 or day 7. That is the complete list. We do not track which screens you open, what you tap, or which features (Scan, Goals, and so on) you use. TelemetryDeck assigns its own anonymous, rotating identifier under the hood. We do not send it your device ID, account ID, or any identifier of our own, and it cannot be used to trace events back to a specific person.

Bank connection (optional). If you connect a bank (e.g. monobank), the app reads your balances and transactions through that bank's API only to show them in the app.

What we do not do

• We do not sell your data.
• We do not use your data for advertising.
• We do not track you across other apps or websites.
• We do not track which screens you view or what you tap inside the app.
• We do not store your Vira conversations on our servers.

Third parties

• Apple (iCloud/CloudKit): data sync
• Google Firebase (Authentication and Cloud Functions): sign-in and server requests
• Google Sign-In: lets you sign in with your Google account
• Anthropic Claude (Haiku): powers Vira
• TelemetryDeck: 7 fixed retention events only (first launch, first monobank connection, Vira's first proactive message sent/opened/replied to, day 2 and day 7 return). No screen views, no button taps, no feature usage tracking, no financial data, and no identifier of ours tied to your account
• monobank Open API: connects your bank account and syncs transactions, only with your explicit consent and a personal token you create yourself
• Netlify: hosting of our server

Your control

You can edit or delete your data in the app at any time, reset Vira's memory, and delete your account. Deleting the app removes local data from your device.

Children

Kosht is not directed at children under 13.

Changes

We may update this policy and will post the new version on this page.

Contact

Questions about privacy: help@kosht.finance