What we collect
- Google sign-in: your email address and name, as provided by Google. KHMYS does not use passwords and never receives your Google password.
- Financial data you bring in: accounts, balances, transactions, budgets, goals, rules, tags, notes and to-dos that you enter, import from statements, or load through a connected bank.
- Bank connections through Plaid: if you connect a bank, Plaid shares account details and transactions for the institution you choose. KHMYS requests Plaid’s transactions product for US institutions. Your bank login credentials are entered into Plaid’s interface, not KHMYS.
- Session information: a session cookie and, for each sign-in, the browser description your device sends, so you can see and end your own sessions.
- Technical error reports: if the app crashes in your browser, it may send a short report with the error type and page area. Reports are scrubbed of email addresses, tokens, identifiers, money amounts and query strings, are written to a server log line, and are not stored in your account.
What we do not do
- KHMYS does not include advertising or tracking cookies. Cloudflare Web Analytics, which does not use cookies, counts page views in aggregate.
- Nothing here sells your data.
How it is used
Your data is used to show you your own accounts, spending, budgets and goals, to categorise transactions according to rules you set, and to keep your connected accounts up to date.
Who it is shared with
- Google, to verify your sign-in.
- Plaid, only if you choose to connect a bank. Plaid handles that connection under its own terms and privacy policy.
- Cloudflare, which carries traffic between your browser and the site and therefore processes requests in transit.
Disconnecting a bank
When you disconnect a bank in Settings, KHMYS asks Plaid to remove the connection and deletes the stored connection and its access token. Accounts and transactions that were already imported remain in your KHMYS account.
Cookies and local storage
KHMYS sets one session cookie (HttpOnly, so page scripts cannot read it) and stores a few preferences, such as theme, in your browser. There are no advertising cookies.
Retention and deletion
There is no automatic expiry of your data, and self-service account deletion is not available yet. To ask for your account and its data to be deleted, use the contact route below.
The demo
demo.khmys.com shows a shared, read-only account filled with fictional data. It does not use your information.
Contact
Email [email protected] for privacy questions or to request account and data deletion.