Privacy policy

Kotasa helps groups share costs and helps you keep your own budget. It is built and run by Vimmik in Sri Lanka. This page explains what we collect, why, who can see it, and how to have it deleted. Questions: info@vimmik.com.

What we collect

• Your account: your name, and your email address if you sign in with Google. We get these from Google when you agree to it. We don't get your Google password, contacts or anything else.
• Your mobile number, if you or a group admin adds it. It's used for logging in with a PIN and for the weekly SMS. Your PIN is stored only as a secure hash.
• What you and your groups enter: expenses, splits, meal orders, payments between people, budgets and notes.
• Me, your personal space: your budgets, your spending, and your take-home pay and payday if you add them.
• Technical data: a sign-in cookie that keeps you logged in, your theme choice (saved in your browser), and anonymous page-view counts from Vercel Analytics, which uses no cookies.

Who can see what

• People in a group see that group's expenses, balances and member names. They never see your other groups.
• Me is private. Nobody else, group admins included, can see your budgets, your own spending or your pay.
• Someone added to a group by name and mobile number gets a weekly SMS with a link to a read-only bill. Anyone who has that link can see that one person's bill in that group, so treat it like a private message.
• We don't sell your data, show ads, or share it with anyone except the services below.

Services we use

These process data for us, only to run Kotasa:

• Supabase: the database and sign-in.
• Vercel: hosting, and the anonymous page-view counts.
• Google: “Sign in with Google”.
• Text.lk: sends the weekly SMS. It receives the mobile number and the message text.

How long we keep it

We keep your data while you use Kotasa. If you leave a group, its history stays with the group, because the other members' balances depend on it. Your name stays on those entries.

Your choices

• You can change your name, currency, pay and categories in Me › Settings, and delete your own entries.
• You can switch off the weekly SMS by asking your group admin.
• To get a copy of your data, or to have your account and your Me data deleted, email info@vimmik.com from the address you sign in with. We reply within 30 days.

Security

All traffic is encrypted. The database can't be read from the browser: every request is checked on our server first, and each group's data is kept separate from every other group's.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in the app. See also our terms of use.