Privacy Policy

Short version: Okha stores what you put into your log so it can answer your questions about it. Nothing goes to an AI provider until you agree in the app. We do not connect to your bank, do not sell data, and do not use your content to train models. Delete everything from the app in a few taps.

Controller

Individual Entrepreneur Konstantin Vasilkov, Tbilisi, Georgia. hello@okha.app.

What we collect

• Account: email and sign-in identity (Google, Apple or email/password) via Firebase Authentication; display name, language, preferred currency and timezone you set.
• Your log: the messages, voice notes and receipt photos you send, and the entries Okha creates from them (merchant, amount, items, category). Every change to an entry is recorded with who made it and when.
• Telegram (if you use the bot): your Telegram user id and the messages you send to the bot.
• Usage analytics: product events (for example "entry confirmed") with your language, preferred currency and timezone, without message text, amounts or other personal content, via PostHog.
• Technical logs: request timings, AI token counts and cost, model names and error types, via Logfire. They hold no message text, amounts or images.
• Crash reports: app and server errors, crashes and performance traces with device details and a hashed user id, via Sentry. They hold no message content.
• Payments: handled by Apple (in-app purchase). We receive the subscription status and a transaction reference, never card details.

How we use it

To run the Service: turn your input into entries, answer your questions, keep your account working, and fix bugs. Legal basis under GDPR-style laws: performance of the contract with you, and our legitimate interest in keeping the Service reliable.

AI processing

Okha uses third-party AI providers to read what you send, log entries and answer questions. Before your first message the app asks for your permission, and nothing is sent to them until you agree. They receive your messages, voice notes and receipt photos, the earlier messages of the conversation, the entries needed to answer, and your display name, preferred currency, language and timezone. They never receive your email or password.

• OpenAI: the main assistant model, and turning voice notes into text.
• Anthropic: the backup assistant model, and sorting entries into categories.
• Google: reading receipt photos (Document AI in the EU, and Gemini).

Data is sent only for the request at hand under the providers' API terms, which do not permit training on it. To stop AI processing, delete your account.

Service providers

• OpenAI, Anthropic, Google: AI processing, as described above.
• Google Cloud: servers and database, region europe-west1 (Belgium); secrets in Google Secret Manager.
• Cloudflare: the website and its page analytics, traffic to the Service, and storage of receipt photos (R2).
• Firebase Authentication and Google Sign-In (Google), Sign in with Apple (Apple): sign-in. They receive your email and sign-in identity; Google Sign-In may estimate your general location from your IP address to prevent fraud.
• Logfire (Pydantic): technical logs, without message text, amounts or images.
• Sentry: crash and error reports and performance traces from the app and the server.
• PostHog (United States): product events, without message text or amounts.
• Telegram: the messages you send to the Okha bot, if you use it.

Retention

Your log stays until you delete it or your account. A receipt photo is kept while its entry exists and is deleted a day after the entry is deleted; a photo that did not become an entry is deleted after a day. Voice notes are not stored: they are turned into text and discarded, and the text stays in your chat. Technical logs, crash reports and analytics are kept for a limited period and then dropped or aggregated. Deleted data is removed from backups on the next backup cycle.

Your rights

Access, export, correction, deletion, objection, portability. Email hello@okha.app from your account address; we answer within 30 days.

To delete your account, open Profile in the app and tap Delete account. It removes, right away, your log, receipt photos, voice notes, chats, profile, subscription records, sign-in account and analytics profile. Apple keeps its own record of in-app purchases. Deleted data leaves our backups on the next backup cycle.

Cookies

The website uses no tracking cookies. Its only cookie, cf_clearance, comes from Cloudflare's bot protection: it keeps automated traffic out and is not used for tracking.

Page analytics on the website use Cloudflare Web Analytics. It records the page you open, the site that sent you there, your country, your device type, browser and operating system, and how fast the page loaded. It sets no cookies, stores nothing in your browser and does not identify you.

Children

Okha is not intended for children under 16.

Changes

Updates are posted on this page with a new date; material changes are announced in the app or by email.