Privacy policy
Last updated 30 September 2026
The short version
- Kobuddy reads only the bank alert emails (and, if you choose, SMS alerts) that you send to it, to record your transactions.
- We never ask for your bank login, PIN or card details, and we can’t move money.
- Original alerts are deleted after 90 days. Your transactions stay until you delete them or your account.
- We don’t sell your data or use it for advertising.
- You can see, correct, export or delete your data. Write to privacy@usekobuddy.com.
1. Who we are
Kobuddy is an app that records your spending from your bank alerts. It is operated by Kobuddy (“Kobuddy”, “we”, “us”), based in Nigeria. We are the data controller for the personal data described here, under the Nigeria Data Protection Act 2023 (“NDPA”).
Contact us about privacy at privacy@usekobuddy.com.
2. What we collect
When you create an account
- Your phone number, to sign you in with a one-time code sent by SMS.
- Your name, and your email address if you choose to add one.
- The banks you use, so we can guide your setup.
From your bank alerts
- The alerts themselves. Each alert email you forward to your private Kobuddy address (and any SMS alert you send to Kobuddy) is stored as received, including its sender, subject and text.
- What we read from them: the amount, whether money went in or out, the date and time, the narration and any transfer remark, the reference, the last digits of your account number as the bank shows them, your balance after the transaction, and the bank charges applied.
- Other people’s names. Alerts often name the person or business you paid or received money from. We store that name as part of the transaction so you can see who it was and so Kobuddy can file future payments to them the same way.
What you add in the app
- Categories, how you file transactions (so Kobuddy can learn), cash transactions you add, notes, and your settings (such as when your week and month start).
Technical information
- Our service providers keep standard logs, such as IP addresses and times of requests, to run the service securely and troubleshoot problems.
We don’t collect your bank login details, PIN, BVN, card numbers, contacts, photos or location. We only receive the emails your Gmail filter forwards; Kobuddy has no access to the rest of your inbox.
3. How we use it, and why we’re allowed to
| What we do | Lawful basis (NDPA) |
|---|---|
| Sign you in and keep your account secure | Performing our contract with you |
| Turn your alerts into transactions, categorise them and show your totals | Performing our contract with you |
| Keep original alerts for 90 days to fix reading mistakes and answer support requests | Our legitimate interest in a service that works correctly |
| Send you service messages, such as sign-in codes and important changes | Performing our contract with you |
| Beta invites and product updates to people on our waitlist | Your consent, which you can withdraw at any time |
| Website analytics, only if you allow cookies | Your consent |
| Prevent fraud and abuse, and meet legal obligations | Legitimate interests and legal obligation |
Kobuddy doesn’t make decisions about you that have legal or similarly significant effects. Automatically choosing a category for a transaction is only a suggestion that you can change.
4. Who processes your data for us
We use a small number of service providers. They process data only on our instructions and to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Supabase | Our database, sign-in and server functions. Your account, alerts and transactions are stored here. | Ireland (EU) |
| Cloudflare | Receives alert emails at your Kobuddy address and passes them to our database; hosts this website. | Global network |
| Anthropic (Claude) | When our built-in readers can’t understand an alert, for example a new format from a bank, its text is sent to Anthropic’s AI model to pick out the transaction details. Only that alert’s sender, subject and text are sent. We don’t add your phone number or account details, though the alert may include your name as your bank wrote it. Anthropic doesn’t use data sent through its API to train its models. | United States |
| Termii | Sends your sign-in codes by SMS. Receives your phone number. | Nigeria |
| Google Analytics | Website visit statistics, only if you allow cookies on this website. Not used in the app. | United States |
We don’t sell your personal data, and we don’t share it with advertisers or data brokers. We may disclose it if the law requires us to, for example to a court or regulator, or to protect people from harm.
5. Data stored outside Nigeria
Some of our providers store or process data outside Nigeria, as shown above. When personal data leaves Nigeria we rely on the protections the NDPA allows, such as the providers’ contractual commitments to protect it and the data protection laws of the countries involved.
6. How long we keep it
- Original alerts (emails and SMS): deleted automatically 90 days after we receive them.
- Transactions, categories and settings: until you delete them or delete your account.
- Your account: until you delete it. When you do, your profile, alerts, transactions and settings are deleted. Copies can remain in our providers’ encrypted backups for up to 30 days before they’re overwritten.
- Waitlist emails: until you ask us to remove yours or we stop running the waitlist.
- Logs: for the periods our providers keep them, typically days to weeks.
7. How we protect it
- Data is encrypted in transit and at rest with our providers.
- Every account’s data is separated in the database, so one user can’t read another’s.
- On your phone, your session is stored encrypted.
- Your Kobuddy address is private and random. If you think someone else knows it, contact us and we’ll replace it.
- Access to production data is limited to the people who need it to run and support Kobuddy.
If a breach puts your rights at high risk, we’ll tell you and the Nigeria Data Protection Commission as the NDPA requires.
8. Your rights
Under the NDPA you can:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
Some of these you can do in the app, such as changing categories or deleting cash entries. For anything else, write to privacy@usekobuddy.com from the email address on your account, or tell us your account’s phone number. We’ll reply within 30 days. See how to delete your account.
If you’re not happy with how we handle your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng). We’d appreciate the chance to fix it first.
9. This website and cookies
usekobuddy.com uses no cookies unless you allow analytics. If you do, Google Analytics sets cookies to count visits and see which pages are useful. You can change your choice at any time with “Cookie settings” at the bottom of every page. If you join the waitlist, we store your email address and, if you tell us, whether you use iPhone or Android.
The Kobuddy app doesn’t use advertising or analytics cookies.
10. Children
Kobuddy is for people aged 18 and over. We don’t knowingly collect data from children. If you believe a child has created an account, contact us and we’ll delete it.
11. Changes to this policy
We’ll update this page when our practices change and change the date at the top. If a change is significant, we’ll tell you in the app or by email before it takes effect.
12. Contact
Kobuddy, Nigeria. Email privacy@usekobuddy.com for privacy questions, or support@usekobuddy.com for anything else.