The short version

Rakama stores the financial records you enter or import, plus the minimum needed to run an account — your name, email address and a hashed password. We do not sell your data, we do not show advertising, and we run no analytics or tracking software in the app or on this website. You can export your records, erase them, or delete your account outright from inside the app, at any time, without asking us.

The short version

This summary is written for reading, not for lawyers, and it is accurate — but the sections below are the binding version. Where the two appear to differ, the detail wins.

We collect what you type into Rakama, and almost nothing else.
We do not sell or rent your data to anyone, for any purpose.
We show no advertising and embed no advertising or analytics SDKs.
Our hosting, database and email providers process data needed to run Rakama. Google handles optional Sign-In. OpenRouter, Groq and Hugging Face process optional AI requests and submitted help questions, as described below. A fourth AI service, TypeSafe, is named in this policy but is switched off. Each is described in Who else sees your data.
We never use your records, receipts, recordings or questions to train or test any AI model without a separate, explicit opt-in that you can withdraw. No such opt-in exists today, so none of your data is used that way. See Training and accuracy testing.
If you connect an outside AI assistant, it reads only what you allow it to, within limits you set, and you can cut it off at any time. See Connecting an outside AI assistant.
You can export your records, erase them, and delete your account yourself, from the app. See Your rights and controls for what the export holds.

Who we are

Rakama is a personal finance application for tracking expenses, budgeting, splitting bills and setting savings goals, available on the web, Android and iOS. For the purposes of data-protection law, the controller of your personal data is Rana Aazan Mujahid, trading as Rakama, DHA Phase 7, Lahore, Pakistan 54930.

You can reach us about anything on this page at privacy@rakama.app.

What we collect and why

Everything in this section is either something you typed, something you imported, or something technically unavoidable in running the service. There is no category of data we collect quietly in the background.

Account details

Your name, your email address, your chosen display currency (Rakama defaults to PKR), your app settings, and the date you created the account. Your password is never stored. What we store is a bcrypt hash of it, which cannot be reversed back into your password.

We also record whether your email address has been verified, and when a verification code was sent, so that codes expire and cannot be replayed. A password-reset request stores a hashed one-time code that expires.

If you turn on two-factor authentication, we store its secret encrypted, and your backup codes only as hashes. We also record whether you have agreed to Rakama AI, and when.

Why: Necessary to perform our contract with you — without an account there is nothing to sign in to, and nowhere to keep your records.

Google Sign-In details, if you choose to use it

If you sign in with Google, we receive your Google account identifier, your email address, your name and your profile picture URL. We request only the openid email profile scope. We cannot see your Google password, your Gmail, your contacts, your Drive, or anything else in your Google account.

Why: Necessary to perform our contract, and only where you actively choose Google as your sign-in method. Signing in with an email address and password instead avoids this entirely.

Your financial records

This is the substance of what Rakama holds, and all of it is entered or imported by you:

Accounts — the names you give them, their type, their balance, their currency and their opening date. Rakama does not connect to your bank, so these are labels you create, not live bank connections.
Transactions — description, amount, date and time, category, type, currency, any note you add, and any file you attach to a transaction (for example a photograph of a receipt), along with its filename.
Categories — their names, colours and icons, including any you create.
Budgets — limits, periods, scope, alert thresholds and status.
Goals — name, description, target amount, amount saved and target date.
Bills — name, amount, issue and due dates.
Bill splits — the title of the split, the names you enter for the people in it, the expenses, who was excluded from what, and who has paid. See Other people in your records.

Why: Necessary to perform our contract — this is the service. We do not analyse it for any purpose other than showing it back to you.

Recurring transactions

The rules you create for a repeating transaction: name, amount, account, category, note, how often it repeats, and its start and end dates. Rakama creates each occurrence from the rule.

Why: Necessary to perform our contract.

Business records, if you use business mode

Business mode is on the web app only. If you use it, we store:

Customers and suppliers — their name, whether they are a customer or a supplier, and, if you add them, their email, phone, postal address, tax number, opening balance and notes. These are other people's details; see Other people in your records.
Items — products and services: name, SKU, description, unit, prices, tax rate, stock quantity and cost.
Invoices and supplier bills — their lines, numbers, dates, totals, notes and terms.
Payments received and made — amount, date, method and reference.
Stock movements.
Credit notes, refunds and payouts, and a record of each business import and how you matched its rows, so the same import is never applied twice.
The business details and template you put on your documents.
Your answers to the business set-up questions, which decide which features are shown.

Why: Necessary to perform our contract — this is the service for a business user.

Categorisation corrections you make

When you correct the category Rakama guessed for a merchant, we store that correction so the same merchant is filled in correctly next time. We store the merchant text pattern and the category you chose, against your account only. Your corrections are never pooled with other users' or used to train anything shared.

Why: Legitimate interest in making the product work as expected — a categoriser that forgets your corrections is a categoriser you have to fight every month. This data never leaves your own account.

Session and security data

When you sign in, we set a session cookie named rakama_token containing a signed token that identifies your account. It is httpOnly, which means scripts cannot read it, and it expires after seven days. Changing your password invalidates every outstanding session immediately.

We use your IP address to rate-limit sensitive actions such as sign-up, sign-in, password changes and account deletion. To make that work across our hosting provider's multiple server instances, each counter is stored in our database as a single row holding the IP address, a count, and the moment the count expires. The row is deleted once that moment passes, typically within minutes. It is never joined to your account and is not used for any other purpose. We also keep a count of failed sign-in attempts against an email address, so repeated guessing can be slowed down; that count is deleted as soon as a sign-in succeeds, and in any case within an hour of the last attempt. Our hosting provider keeps its own short-lived request logs, which include IP addresses, as described in the next section.

We also keep a security log of events on your own account: sign-ins and failed sign-ins, password changes and resets, identity re-confirmations, signing out of all devices, exports and backups, imports and restores, erasing your data, and deleting your account. Each entry records what happened, when, the IP address it came from, and the browser or app that made the request. We keep these for as long as your account exists, because their purpose is to let you answer “did someone else get into my account?” — a log that expired would not answer it. You can read your own log at any time under Settings → Security → Security activity. Nobody can edit or erase individual entries, including us and including anyone who has taken over your account; the whole log is deleted when you delete your account. The log never contains a password, a token, or anything about your transactions.

A help question that had to be sent to an AI provider is recorded there too — that it happened, when, and the IP address and browser, never the question itself — so you can see when something left your account. Questions answered from a help page are not recorded.

Why: Necessary to perform our contract (keeping you signed in) and legitimate interest in security (stopping brute-force and abuse).

Sync bookkeeping

Rakama works offline, so we record when each record was last changed, and an identifier for each change your device has already sent us. This lets your devices agree on the current state without duplicating anything. It contains no financial detail of its own.

Why: Necessary to perform our contract — without it, a change you make offline would be applied twice or lost when your phone reconnects.

What we deliberately do not collect

These are absences we have verified in our own code, not aspirations. If any of them change, this policy changes first.

No analytics or tracking. There is no Google Analytics, no Firebase, no Meta pixel, no Crashlytics, no session-recording tool, and no product-analytics SDK in the website, the Android app or the iOS app.
No advertising, no ad identifiers, and no advertising SDKs.
No location data. The apps do not request location permission.
No access to your contacts, photo library, call logs or SMS. To scan a receipt you take a new photo or choose one in the phone's own picker, which hands Rakama that one photo and nothing else from your library.
No bank credentials. Rakama has no bank connection feature. We never ask for, and cannot receive, your online banking login, card numbers, or account numbers. If anything claiming to be Rakama asks you for these, it is not us.
No payment details. Rakama takes no payments today and has no payment provider in its code, so we hold no card number, wallet or payment-method data. If paid plans launch, this policy changes first.
No biometric data. If you unlock the Android app with a fingerprint or face, that check happens entirely on your device through the operating system. Your biometrics never reach us and cannot.

The complete list of permissions the apps ask for:

Android — internet access, network-state access, biometric unlock, and the microphone, which is used only when you choose to speak an expense to Rakama AI.
iOS — the camera, to scan a receipt (the text is read on the phone); the microphone, to speak an expense; and Face ID, to unlock the app.

The camera, microphone and Face ID are asked for only when you first use the feature that needs them. You can refuse, or revoke them later in the phone's settings, and the rest of the app keeps working.

Our lawful basis for using your data

Where data-protection law such as the UK or EU GDPR applies to you, we rely on the following bases, which are also noted against each item above:

Performance of a contract — for your account, your financial records, your sessions and synchronisation. These are the service itself.
Legitimate interests — for security, abuse prevention, and remembering your categorisation corrections. We have considered your interests and consider these uses to be ones you would reasonably expect.
Consent — for optional Google Sign-In, for AI categorisation (which is off until you switch it on; see Automatic categorisation and AI), and for any marketing email. Any of these can be withdrawn at any time, and withdrawing one does not affect the others or your account.
Legal obligation — where we are required to retain or disclose information by law.

We do not sell your personal data, and we never have. We do not share it with advertisers, data brokers, or credit reference agencies. The only third parties involved are the service providers we need to run Rakama, each of which processes data on our instructions and for no purpose of their own:

Our hosting provider (Vercel) — serves the website and the API. It necessarily handles requests in transit and keeps short-lived operational logs containing IP addresses and requested URLs.
Our database provider — stores your records at rest, encrypted by the provider.
Brevo — delivers transactional email. It receives your name, your email address and the contents of the message we are sending you, such as a verification code. It is used for nothing else.
Google — for optional Sign-In. Gemini is disabled in the current free AI release.
OpenRouter — processes the AI text requests described in the next section. OpenRouter is a router rather than a model host: it forwards each request to the company that serves the free model chosen for it, so that company receives the same text. Rakama uses only models OpenRouter prices at zero.
Groq — processes AI requests described in the next section, and is the only provider that receives voice recordings, because it serves the only speech transcription available on a free plan. It is also the only provider that categorises imports, and it takes turns with OpenRouter and Hugging Face at other text requests.
Hugging Face — processes AI text requests described in the next section, but not imports. Like OpenRouter, it is a router: it forwards each request to the company that serves the model, and that company receives the same text. Rakama names that company in every request, so the router cannot choose a different one. Today it is OVHcloud. Rakama uses only models Hugging Face prices at zero.
TypeSafe (its “Jev” classifier) — switched off. Rakama's code keeps it off unless we deliberately turn it on with a server setting, and it is not on today. It is a classifier, not a language model, built as a second check on how Rakama read an AI money question. If we ever switch it on, it would receive the text of a question you asked Rakama AI (after you have turned Rakama AI on) and how Rakama read it: the kind of question, the figure and period, and any account, person or category the question named. It would never receive balances, transactions, receipts or recordings. We will update this page, the date at the top and the AI consent text in the apps before it is switched on.
Have I Been Pwned — its Pwned Passwords service checks a new password against passwords known from breaches. Only the first five characters of the password's SHA-1 hash are sent. Your password and the full hash never leave Rakama, and nothing that identifies you is sent.

We may also disclose information where we are legally required to, or where it is necessary to establish or defend legal claims, or to protect the safety of a person. If we are ever compelled to disclose your data, we will tell you unless we are legally prohibited from doing so.

If Rakama is ever sold or merges with another company, your data may transfer as part of that transaction. We would tell you before it happened, and the new owner would be bound by this policy until you were given notice of any change.

Automatic categorisation and AI

Keyword categorisation runs inside Rakama. Optional AI uses OpenRouter, Groq and Hugging Face. The current beta uses only confirmed free-plan accounts and models the provider prices at zero, with shared limits and no paid-provider fallback. Import categorisation goes to Groq only. The three take turns at other text requests: each request starts with the next one and moves to another if that one fails. Voice recordings go to Groq only.

You choose what to enable

Import AI is off until you enable it in Settings → Privacy → AI categorisation. Expense, receipt and voice AI ask separately for Enable and continue in Rakama AI. Previous import consent does not enable these new uses. Turning AI off in Settings stops new import, capture and voice requests; an already submitted request may finish. Help questions you deliberately submit can still be sent to an AI provider as described below.

Imports: unrecognised, normalised merchant description text and category options are sent to Groq for classification. Import amounts, dates, balances and attachments are not sent.
Expense drafts: the text you submit, including any amounts, dates or names within it, your local date, account names and currencies, and category choices are sent to OpenRouter, Groq or Hugging Face. Internal account IDs, full transaction history and account balances are not sent.
Receipts: the browser reads the image on your device. You review the recognised text before submitting it to OpenRouter, Groq or Hugging Face. The original image is stored privately in Rakama when you prepare a draft and is attached to the expense when saved; it is not sent to any AI provider.
Voice: after microphone permission, up to 2 minutes of recorded audio are sent to Groq for transcription — only Groq, because it serves the only speech transcription available on a free plan, so your voice is never sent to OpenRouter or Hugging Face. You review the transcript before using it as a help question or expense. Rakama does not retain the audio after processing.

Model, receipt and voice interpretations produce editable drafts. Only a narrow, complete typed expense instruction with a known account and category can save directly. Request IDs prevent a retry from creating another expense. Discarding a draft immediately removes its stored receipt and draft contents. Drafts expire after 24 hours; abandoned contents older than seven days are cleaned on your next capture request. Saved expenses and receipts follow your normal account retention, export and deletion controls.

We count how many AI requests each account makes in a period, so the shared free limits hold. The counts hold no content, and are deleted with your account.

Rakama does not train models on your financial records. Processing and retention at OpenRouter and Hugging Face, at the companies they route to, and at Groq are governed by their own service terms and account data controls; this app does not promise zero provider retention, and free model tiers in particular may be subject to provider terms that differ from paid ones. Do not submit information you do not want processed by those services.

How to refuse, and what stays with the provider

You can refuse AI altogether: it is off until you switch it on, and Rakama keeps working with its built-in keyword categorisation and manual entry. You can switch it off again at any time in Settings → Privacy. What Rakama itself keeps of an AI request is described under How long we keep it. What a provider keeps of a request it has already received is set by that provider, and we cannot delete it for you.

Merchant/category mappings from imports may be reused within your account. When three independent accounts agree on the same normalised merchant/category pair, it can enter a shared merchant list without account attribution. Turning AI off deletes your own mappings, but cannot isolate your contribution to an already shared mapping. Expense drafts, receipt text and voice transcripts never enter that merchant list.

Training and accuracy testing

Your data is not used to train or test models

We never use your financial records, receipts, voice recordings, help questions or any other content from your account to train, fine-tune or evaluate any AI model — ours or anyone else's — unless you give a separate, explicit opt-in for exactly that. It would have to be asked for on its own, never bundled with these terms, with turning on Rakama AI, or with any other consent, and you would be able to withdraw it. No such opt-in exists in Rakama today, so no user data is used for training or evaluation. The only consent that exists for AI is the one described above, for processing your own requests.

When we check how accurate our categorising, amount reading and speech handling are, we use public datasets whose licences allow it, and examples written or generated by us. None of it comes from users' accounts. If we ever add a way for you to contribute your own data for this purpose, it will be off by default, will say what is kept, why, for how long and who can see it, and will be described on this page before it opens. Until then, please do not read anything on this page as asking for that consent.

The in-app help assistant

Help answers use written product guidance. When a question needs more interpretation, OpenRouter, Groq or Hugging Face receives your question, up to six recent short conversation turns, and relevant product guidance. This is disclosed in the panel. Avoid including private details in help questions. The model is not given your account balances or transaction history.

When you are signed in and have turned on Rakama AI, a question about your own money is sent to OpenRouter, Groq or Hugging Face with the names of your accounts and categories, so it can be matched to the right report. Balances, transactions, and customer, supplier and item names are not sent. The figures in the answer are calculated by Rakama and never sent to a model. Expense creation uses the separate consent and review flow above. Closing the panel clears the visible help conversation; a pending expense draft can be resumed separately.

We keep a record of the questions it could not answer from a help page — the ones it had to ask an AI to phrase, and the ones it could not answer at all — because that list is how we know which help pages to write next. Three things about that record are worth stating plainly, and each is enforced in the code rather than promised:

It is not linked to you. The stored row holds the question and nothing else — no account id, no email, no IP address, no session. We can see that a question was asked eleven times; we cannot see who asked it.
Numbers are removed before it is stored. Digits and email addresses in the question are replaced with placeholders as it is written, so an amount, phone number or account number typed into the box while describing a problem does not reach the record at all.
It is deleted after 30 days. A question that has not come up again within a month is not worth keeping the wording of.

Questions the assistant answers from a help page are not stored at all, and are not sent anywhere. Closing the panel clears the conversation from your browser; we do not keep a transcript of it either way.

Connecting an outside AI assistant

You can connect an outside AI assistant — Claude, ChatGPT, or another tool that speaks the Model Context Protocol — so that it can work with your Rakama data on your behalf. Nothing is connected by default, and Rakama never sends your data to such an assistant on its own: the assistant asks, and only ever gets what your permission allows. If you have not connected one, this section does not apply to you.

When you approve a connection you choose how far it reaches, and the choice is enforced on every single request rather than recorded once at sign-up:

What it may do. View can read balances, transactions, budgets and upcoming bills. Suggest can additionally prepare an expense for you to approve, but cannot save one. Act can save an expense itself, within your limits. An assistant granted View is not offered the tools that write — they are not in the list it is given.
Which accounts. You can restrict a connection to particular accounts. Every read is filtered to those accounts, including bills and the balances total.
How much. You set a cap per expense and a daily cap, in both count and amount. A request over a cap is refused and left as a draft for you, and a refused request does not spend any of that day’s allowance.

The assistant receives a token that identifies only the permission you granted — never your password, and never a key that would let it sign in as you. Tokens expire, and are meaningless to any other app. Specifically: the one-time code that starts a connection lasts 60 seconds and works once; an access token lasts one hour; the connection itself ends after 7, 30 or 90 days, whichever you choose; and a replayed code or refresh token ends the whole connection. Only fingerprints of tokens are stored, so a copy of our database holds nothing an assistant could use.

Today an assistant connected this way has exactly seven tools. It can read your account balances, your transactions (at most 90 days and 200 rows per request, showing date, description, category, amount, account and type), your budgets with what has been spent, and your upcoming bills; it can prepare an expense draft and check what became of a draft it made; and, only if you granted Act, save a draft it made within your limits. It cannot read your notes, receipts or attachments, your customers and suppliers or other business records, your security log, your settings or your export; it cannot change or delete an existing record; and it cannot see your password, two-factor secret or other connections. Anything that is not on that list is not reachable by it. If we ever add a tool, this list changes first.

Four things about this are enforced in the code rather than promised:

Every action is written down. Each tool an assistant uses is recorded in your security log, with the app’s name and whether it succeeded or was refused.
Loosening asks, tightening does not. Lowering a connection’s level or cutting its limits takes effect immediately with no password. Raising either one requires a fresh confirmation from you, and that confirmation is spent once.
Odd behaviour ends the connection. An assistant that writes unusually often, or is refused repeatedly, is suspended automatically. Settings tells you why it ended.
You can undo a day. For a connection allowed to save expenses, one button removes everything it added today and puts the money back. Anything you have since edited yourself is left alone and reported, rather than silently reverted.

You can see every connected assistant in Settings, change what it may do, disconnect one, or disconnect all of them at once. Disconnecting takes effect immediately: its tokens are deleted and the next request it makes is refused. Signing out of all devices, or changing your password, also ends every connection. We can also switch outside-assistant access off for everyone at once.

A connection is made from the assistant’s side, and you approve it on a Rakama screen that shows the app’s name, what it asks for, and a choice of level, accounts, limits and duration. Only Claude and ChatGPT are marked Verified, and only when the request returns to their official address. Any other app can register itself under any name it likes, so for those the name on the screen is not a guarantee of who is behind it.

One limit is worth stating plainly: once an assistant has read your data, what happens to it next is governed by that company’s privacy policy, not ours. We control what leaves Rakama and can stop it at any time; we cannot reach into another company’s systems and delete what it already holds. Connect only assistants you are willing to trust with the accounts you have given them, and grant the narrowest level that does the job.

Connecting other services

Rakama does not connect to your bank, and today it does not connect to any online store, payment service or accounting tool: you bring records in by uploading a file, and Rakama reads that file. The first one being built is Shopify, for store orders; it is switched off and no one can connect it yet. If we open a connection to another service, it will work like this, and this section will be updated before it opens:

When you connect one. Nothing is connected unless you start it and approve it on that service’s own sign-in or permission screen. We would ask for read access only, and for no more than the feature needs.
What is read. Only what the connection needs to bring into your own Rakama records, for example orders, products or balances. The page for that connection will list it. It would be stored as part of your records, with everything this policy says about your records, and would include other people’s details if the service holds them (see Other people in your records).
Your credentials. We would store the access token the service gives us, encrypted, never your password for that service, and we would use it only to read what you approved.
Connection bookkeeping. So nothing is brought in twice, we would keep the id the other service uses for each thing it brought in, next to the record it became, and a log of each delivery and import from that service: what happened and when, never the customer details in it. Both are deleted with your account, like the rest of your records.
Disconnecting. You could disconnect at any time from Settings, and from the other service’s own settings. Disconnecting would stop any further reading and delete the stored token. Records already brought in would stay in your account until you delete them, erase your data or delete your account, exactly like records you typed yourself.
No training. Nothing read through a connection would be used to train or test any AI model; see Training and accuracy testing.

Other people in your records

Some of what you enter is about someone else, and you are the one choosing to enter it.

Bill splits hold the names you type for the people you split with. Rakama does not ask for their contact details.
Business customers and suppliers can hold their email, phone, postal address and tax number. As the business owner, you decide to hold these, and you should have a reason to, such as invoicing them.

Rakama never contacts any of these people. An invoice is handed to your own email to send; Rakama does not send it. We store what you enter so the feature works, and do nothing else with it.

Please only enter what you need. Deleting a split deletes the names in it. Deleting a customer or supplier removes their email, phone, address, tax number and notes. Their name, kind and opening balance stay with the deleted record, so documents made before it still read correctly. Deleting your account deletes all of it.

How long we keep it

We keep your data for as long as your account exists, because the whole point of the service is a financial history you can look back through. We do not expire your records after a period of time.

If you delete a single record — a transaction, account, category, budget, goal or bill — its contents are removed immediately. An empty marker with its id and the time it was deleted is kept, so your other devices learn it was deleted. A deleted account's marker also keeps its name, type and currency, so past transactions still say which account they were in.
Deleted invoices, supplier bills, payments and business history keep their contents, because business reports for a past date rebuild the books as they stood on that date. They are removed when you erase your data or delete your account.
If you erase your financial data from within the app, every record's contents are removed immediately and your account remains. Only the empty deletion markers are left.
If you delete your account, the account and every record about it are permanently deleted from our live database immediately. This is a hard delete, not a flag — the rows are gone, and we cannot restore them for you afterwards. Your security log goes with it.
Unanswered help questions are deleted 30 days after they are recorded, on a daily clock, whatever happens to your account — they are not linked to it, so there is nothing to delete alongside it. See the in-app help assistant.
A sign-up that is never verified and holds no data is deleted after 7 days, so an address someone else typed in does not stay with us.
AI requests. When an AI draft is saved, the text you sent is cleared. What is kept is a record that the request was completed, so a retried request cannot save the same expense twice; it is deleted after 180 days. Every other AI request — a draft you abandoned or discarded, with its receipt image, or a money question answered from your figures — is deleted 7 days after it was last touched.
Outside AI assistants. When you disconnect one, its tokens and unused codes are deleted at once. A short record of the connection (the app's name, the level and limits you set, and the dates) stays in your Settings history and your security log until you delete your account, so you can see what was connected and when. A draft an assistant prepared is an AI working draft and follows the AI request rule above.
On your phone, signing out removes your financial records once nothing is waiting to upload. Changes that have not reached us yet are kept, so they are not lost, and are sent the next time you sign in. Bill splits and unsent AI captures also stay after sign-out, because they exist only on that phone. Deleting your account removes everything Rakama stored on the phone. The iOS app's local copy is excluded from device and iCloud backups, and the Android app does not allow backup.
Encrypted backups held by our database provider may retain a copy for up to 35 days before rolling off, after which no copy remains. Backups exist so we can recover the service from a failure; they are not searched, and we do not restore an individual account from them after a deletion.

Your rights and controls

Most privacy policies ask you to email someone and wait. In Rakama, the important controls are built into the app and you can use them yourself, immediately:

Get a copy of your data — export from the app's settings, at any time, as often as you like, as a spreadsheet or a JSON file. It holds your transactions, accounts, categories, budgets, goals and bills, your business records and business set-up answers if you have any, your bill splits, your categorisation corrections, your recurring transaction rules and what they created, the outside apps you have connected, your security log, and your profile and settings. It leaves out only your password and two-factor secrets, sign-up and reset codes (hashed, and deleted once used), sync bookkeeping, connection bookkeeping for linked services (their sealed access tokens, delivery log and id map), cached merchant data (a copy of categories already in your transactions), and AI working drafts, which are deleted within 7 days. For anything else, email privacy@rakama.app.
Correct your data — edit or delete any record directly.
Erase your financial data — wipe every transaction, budget, goal, bill and split while keeping your login.
Withdraw consent to AI — Settings → Privacy, one switch, effective immediately. It deletes the merchant mappings and any cached merchant data your imports created, and it also withdraws your consent for expense, receipt and voice AI.
Delete your account entirely — permanently, from the app's settings.

Depending on where you live, you may also have the right to object to or restrict processing, the right to data portability, and the right to lodge a complaint with your local data-protection authority. To exercise anything not covered by the in-app controls, email privacy@rakama.app. We will respond within 30 days.

We will never charge you for a request, and we will never make you close your account in order to exercise a right.

If you lose both your authenticator and your backup codes, you can ask support to remove two-factor authentication from your account. Support can only remove it; support cannot sign in as you or see your password. Every session is signed out, you prove who you are again through your email, and the removal appears in your security log as “Two-factor authentication removed by support”.

How we protect it

All traffic is encrypted in transit over HTTPS, with strict transport security enforced.
Passwords are hashed with bcrypt and are never stored, logged, or recoverable.
Session tokens are signed, expire after seven days, are inaccessible to scripts, and are all invalidated at once when you change your password.
Sensitive endpoints are rate-limited against brute-force attempts.
Optional two-factor authentication uses a time-based code from an authenticator app. Its secret is stored encrypted (AES-256-GCM), you are given ten single-use backup codes that we keep only as hashes, a code cannot be used twice, and the sign-in step after your password expires in five minutes. Turning it off, or creating new backup codes, asks you to re-confirm who you are first.
Before an export, a backup, erasing your data, deleting your account, or raising what a connected assistant may do, Rakama asks you to re-confirm your identity, and that confirmation lasts five minutes. You can sign out of every device at once from Settings.
Every request for data is scoped to the signed-in account, so one user's records cannot be returned to another.
Data is encrypted at rest by our database provider.
The website sends a strict content-security policy to limit what can run in your browser.

No system is perfectly secure, and we will not pretend otherwise. If we ever discover a breach affecting your personal data, we will notify you and the relevant authority without undue delay, and tell you plainly what happened and what to do.

Cookies and local storage

Rakama uses four cookies. All are strictly necessary, none can be read by scripts, and none is used for tracking:

rakama_token keeps you signed in, for seven days.
rakama_reauth is set for five minutes when you re-confirm who you are before a sensitive action, such as an export or deleting your account.
g_state and g_next exist for at most ten minutes, only while you sign in with Google. One protects the sign-in against forgery; the other remembers where to return you. Both are cleared as soon as sign-in completes.

Your browser's local storage holds preferences only: light or dark mode, brand colour, sound effects, date format, bill-split defaults, and, on the blog, whether you prefer phone or desktop screenshots. Session storage, which is cleared when the tab closes, holds the id of an account waiting for its verification code and the id of an AI draft you have open. None of this leaves your device. The cookies are sent only to Rakama.

There is no consent banner because there is nothing optional to consent to. We use no third-party cookies and no cross-site identifiers.

Where your data is stored

Our servers and database are hosted in the Asia-Pacific region. Our email and sign-in providers operate globally, which means that if you are in the EU, the UK, or another region with transfer restrictions, your data may be processed outside your country. Where that happens, we rely on the safeguards those providers offer, such as standard contractual clauses.

The AI text and voice data described in Automatic categorisation and AIare processed by OpenRouter, Groq and Hugging Face, whose services may process them in the United States, and in the two routers’ case by the company serving the model they route your request to, which may be in another country again. This can be a transfer outside your country. Review the applicable provider terms and data controls before enabling AI.

Children

Rakama is not directed at children and is not intended for anyone under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect, rather than relying on you to re-read this page.

The versions of this policy, newest first:

6 October 2026 — rewritten against the code. Names TypeSafe, which is switched off, and what it would receive; states that no user data is used to train or test models and that a separate opt-in would be required; adds what an outside AI assistant can and cannot reach, how long its tokens last and how it is revoked; adds a section on connecting other services, written as how it would work, because none exists today; adds two-factor authentication and re-confirmation details; states that we hold no payment details; and sets the effective date of this version to 6 October 2026.
24 August 2026 — Groq added as an AI processor, behind Gemini. Gemini has since been disabled and OpenRouter and Hugging Face added; this page has been kept in step with the code since.
8 August 2026 — first version.

Contact us

Questions, requests, or concerns about anything on this page go to privacy@rakama.app, or by post to Rana Aazan Mujahid, trading as Rakama, DHA Phase 7, Lahore, Pakistan 54930. We read every message.

Privacy Policy