01Introduction
Welcome to Kaya ("we," "our," or "us"). Kaya is a mobile application and web platform ("Service") designed to help friend groups split expenses, track balances, and settle payments easily.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Kaya iOS application and the website at kaya.dlmbaccay.com. It also describes your rights under the Republic Act No. 10173, also known as the Data Privacy Act of 2012("DPA"), and its Implementing Rules and Regulations.
By accessing or using Kaya, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms herein, please discontinue use of the Service immediately.
02Who We Are
Kaya is an independently developed application. For purposes of the Data Privacy Act of 2012, the developer of Kaya acts as the Personal Information Controller (PIC) — the entity that determines the purposes and means of processing your personal data.
Email:
dlmbaccay@gmail.comWebsite:
kaya.dlmbaccay.com03Information We Collect
3.1 Information You Provide Directly
- Account Information: When you sign in via Google or Apple, we receive your name and email address from the respective identity provider. We do not collect or store passwords.
- Profile Information: Your display name, first name, last name, and optionally a profile photo (avatar) that you choose to upload.
- Group Data: Names of expense groups you create or join, and the category of those groups (e.g., trip, food, home).
- Expense Data: Descriptions of expenses, amounts (stored in Philippine Peso centavos), expense category, date, who paid, and how the expense is split among group members.
- Settlement Data: Records of payments between members, including optional notes and optional payment proof photos you choose to upload.
- Invite Information: If you invite someone to a group via email, we collect the recipient's email address for the purpose of sending that single invitation. This is stored as a pending invite until accepted or until the group is deleted.
- User-Generated Content: Photos of receipts or payment proofs that you upload within the app.
3.2 Information Collected Automatically
- Push Notification Token: If you grant notification permissions, we collect your device's Expo push notification token and store it against your profile to deliver expense and settlement notifications. This token is device-specific and does not identify you personally on its own.
- Authentication Session Data: We use Supabase for authentication, which maintains a session token stored on your device via AsyncStorage. This allows you to remain signed in across sessions.
3.3 Information We Do Not Collect
We do not collect:
- Payment card numbers, bank account details, or GCash credentials
- Precise GPS or location data
- Microphone, camera roll (photos are explicitly chosen by you via picker), or contacts
- Browsing history, behavioral tracking, or advertising identifiers
- Biometric data (Face ID / Touch ID is handled entirely by your device's OS and is never transmitted to us)
04How We Use Your Information
We use the information we collect for the following purposes, all of which constitute legitimate interests or are necessary for the performance of the service you requested:
| Purpose | Data Used | Basis |
|---|---|---|
| Create and maintain your account | Name, email, avatar | Performance of contract |
| Display your profile within groups | Display name, avatar | Performance of contract |
| Record and split expenses | Expense data, split amounts | Performance of contract |
| Track balances between group members | Expense data, settlement data | Performance of contract |
| Send group invite emails | Recipient email address | Legitimate interest / consent |
| Send push notifications for expenses and settlements | Push token | Consent |
| Maintain data integrity for deleted accounts | Anonymized profile row | Legitimate interest |
| Detect abuse and enforce Terms of Service | Account and usage data | Legitimate interest |
| Improve the Service | Aggregate, non-identifiable usage patterns | Legitimate interest |
We do not use your data for advertising, profiling, or sale to third parties.
06Data Retention
| Data Type | Retention Period |
|---|---|
| Active account (profile, group data, expenses, settlements) | For as long as your account is active |
| Invite emails (pending status) | Until accepted, or until the group is deleted |
| Invite emails (accepted status) | Retained for record-keeping while the group exists |
| Push notification tokens | Retained while account is active; removed on account deletion |
| Storage files (avatars, receipts) | Retained while account is active; not automatically deleted on account deletion (see note below) |
| Anonymized profile row (deleted accounts) | Indefinitely, for referential integrity of historical expense and settlement records |
07Account Deletion
You may delete your account at any time from the Profile screen in the app. Upon deletion:
- 1.Your profile is anonymized — your name becomes "Deleted User," your avatar is removed, and your email is disassociated.
- 2.You are removed from all group memberships.
- 3.All groups you created are deleted (along with their associated expenses and settlements).
- 4.Your authentication account (Apple or Google) is revoked from our system.
- 5.Your push notification token is cleared.
Expenses and settlements you participated in (but did not create the group for) remain in those groups' history attributed to "Deleted User" to preserve the financial records of other members.
08Your Rights Under the Data Privacy Act of 2012
As a data subject under Republic Act No. 10173 and its IRR, you have the following rights:
dlmbaccay@gmail.com.To exercise any of these rights, email us at dlmbaccay@gmail.com. We will respond within 30 days of receiving your request.
09Data Security
We take reasonable technical and organizational measures to protect your personal data, including:
- All data in transit is encrypted via HTTPS/TLS
- Supabase enforces Row-Level Security (RLS) on all database tables — you can only read and write data you are authorized to access
- Authentication is handled exclusively via OAuth 2.0 (Google, Apple) — we never store passwords
- Storage buckets for avatars and receipts enforce appropriate access policies
- Edge Functions that require service-role access operate server-side only and are never exposed to the client
Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong credentials with your linked Google or Apple account.
10Children's Privacy
Kaya is not directed to individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at dlmbaccay@gmail.com and we will take steps to delete that information.
11International Users
Kaya is designed primarily for Philippine users, and data may be stored on servers located outside the Philippines (Supabase's infrastructure). By using Kaya, you acknowledge and consent to the transfer of your personal data to servers outside the Philippines, subject to appropriate safeguards consistent with the Data Privacy Act of 2012.
12Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this document. For significant changes, we may also provide notice within the app.
Continued use of Kaya after changes have been posted constitutes your acceptance of the revised Privacy Policy.
13Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:
Email:
dlmbaccay@gmail.comWebsite:
kaya.dlmbaccay.comThis Privacy Policy was last reviewed and updated on March 26, 2026.