Privacy policy

Last updated: 4 November 2026

This policy explains what data the Kaffa app («كفّة», com.getkaffa) and the getkaffa.com website collect, why, and how you can delete it. It is written in plain language and only describes what the app actually does.

In short: if you use Kaffa for free without signing in, your data stays on your phone and we never receive it. We collect data only when you sign in for sync or a subscription, when you contact support, and when you use AI import. No ads, no analytics or tracking tools, and we never sell your data.

Who we are

Kaffa is an accounting, inventory and POS app built and run by HashStudio, which is responsible for your data under this policy. For anything about privacy, write to support@getkaffa.com.

Free use without signing in

Everything you enter (items, customers, invoices, balances, stock) is saved on your device only and is not sent to us. The free monthly operations counter runs on the device too. The app may contact our server to fetch exchange rates or an update notice; these requests carry no business data and do not identify you, only technical details such as the app version.

If you pick a customer from your contacts, the app reads only the contact you picked (name and number) and saves it on that customer. It does not read the rest of your contacts.

What we collect when you sign in or subscribe

When you sign in and turn on sync across devices, branches, staff and the web app, your business data is uploaded to our server so it reaches your other devices. This includes:

Account details: name and email address, plus phone number and business address if you add them to the business profile (optional).
Business financial data: invoices, returns, vouchers, balances, stock, items, customers and suppliers, including any contact you saved on a customer or supplier.
Purchase history: your subscription status and the operation packs you bought (no card details: payment happens in Google Play).
Photos: item photos and the business logo, if you upload them.
App device id: an id the app creates for each device to run sync and sign-in sessions, with the app version and OS. It is not the advertising id; we never use the advertising id.

Support requests

When you send a support request from the app, we receive your message and any screenshots you attach, together with your email, business name, plan (free, trial or paid), app version, device model and OS, so we can understand the problem faster. Requests are stored in the support system on our website. Screenshot links expire after 30 days and the images are removed from our server within 45 days at most. If you email us, we receive only what you send.

AI import (optional)

If you import items, accounts or opening balances from a file (Excel, PDF or an image), the file is uploaded to our server and its contents are sent to an AI provider (currently Anthropic, through the Claude API) to read it and return suggested rows, which you review before saving. The file is used only for that processing. We delete the file from our server as soon as the import finishes, is canceled or fails, and within 7 days at most; the suggested rows are deleted after 30 days.

Subscriptions and payments

Subscriptions and operation packs are bought through Google Play, under Google's privacy policy. We never see or store your card number. We use RevenueCat to confirm purchases: it receives the purchase details from Google and your account id with us (an internal number, not your name or email), and we keep your subscription status on our server.

Why we use the data

To run the app: saving and syncing across your devices, branches, staff and the web app, and the cloud copy.
To manage your account: sign-in, permissions, subscription and packs.
To answer support requests and send necessary account messages (such as a sign-in code, or a notice before data is deleted).

What we don't do: no ads, no third-party analytics, tracking or crash-reporting tools in the app, no selling or renting your data, and no marketing of other companies' products with it.

We don't share your data with anyone for their own purposes. We only use service providers that process data for us and for the service: Google Play (payments, and Google sign-in if you choose it), RevenueCat (purchase confirmation), the AI provider (import only), the hosting provider that runs our servers, and the email provider that sends account messages. We may disclose data if the law or a court order requires it.

Inside your business, staff see what the permissions set by the owner allow.

Security

Data between the app and the server is encrypted in transit (HTTPS). Each business is isolated from the others on the server, and permissions are checked on every request. No system is perfectly secure, but we keep what we collect small and protect it. If we learn of an incident affecting your data, we will tell you.

How long we keep data

While your subscription is active, we keep your business data on the server so sync works.
After a subscription ends, business data stays on the server for 12 months so you can come back to it. Item photos are deleted after 3 months (the logo stays); then all business data is deleted. We email the owner 30 days and 7 days before. The copy on your phone stays on it.
When you delete your account or business, data is deleted for good after a 30-day grace period (see deletion below).
Subscription purchase and billing records are kept without your personal details for the period required by law.

Your rights and deletion

You can export your data from the app (backup file or Excel) and edit your account and business details in settings. You can delete your account in the app: More → Security & account → Delete my account, or by email. Details are on the delete account page. For any other request about your data (access, correction, or deleting support requests), write to support@getkaffa.com.

Children

Kaffa is a tool for business owners. It is not meant for anyone under 18, and we don't knowingly collect children's data. If you learn that a child has sent us data, contact us and we will delete it.

The getkaffa.com website

The website uses no ads, no analytics and no tracking cookies. Your browser remembers your language or country choice if you dismiss the version bar; this is not sent to us. Our network provider may tell us your country from your IP address so we can suggest the right version; we don't store it. The free tools run in your browser and don't send what you type to any server.

Changes to this policy

If we change this policy, we will post the new version here with its date. If the change is significant, we will tell you in the app or by email before it applies.

Contact

HashStudio, the Kaffa team: support@getkaffa.com