Who is responsible
Kioxke Tecnologia is the controller of Macuta’s data. For any privacy question, write to info@macuta.ao.
Your finances: end-to-end encrypted
Accounts, transactions, budgets, goals, tags and receipts stay on your device.
If you use an account to sync your devices, our servers only receive an end-to-end encrypted copy, locked with a key that only your password (or your recovery code) opens. The server stores that file without being able to open it. The same goes for your profile photo.
Your password never leaves the device: the app only sends a key derived from it, which the server stores protected (scrypt). That’s why, if you lose both your password and your recovery code, we can’t recover your data.
Receipts, invoices and bank statements you ask to read are read with artificial intelligence, only if you agree (the app asks the first time and you can turn it off in Settings). The image or PDF goes, encrypted in transit, to our server and from there to Anthropic, the AI provider (Claude), only to be read; the answer goes back to the app and only what you confirm is kept. We don't keep the image or the result: the server only keeps how many reads you made this month (for your plan's limit) and, for 24 hours and only in memory, a fingerprint of the image and the result, so the same image isn't charged twice. Under Anthropic's commercial terms, data sent through the API isn't used to train models.
Account data
For your account to work, we keep on the server (not end-to-end encrypted):
- your email;
- your name and phone number, if you add them to your profile;
- each device linked to the account (an identifier and a name, such as “Pixel” or “Web”) and the date of last access;
- your plan and the date it ends.
If you sign in with Google, Google confirms your email to us; we never receive your Google password.
Payments
We keep the plan, amount, currency, method (Multicaixa or card), reference and date of each payment. When you tap “Continue to payment”, we record the attempt and your language, so we can send a single reminder two days later if you don’t finish.
Card and Multicaixa details are handled by the payment providers (for example, Revolut for card payments and EMIS for Multicaixa). Macuta never sees them.
Emails
We only send emails about your account: sign-in codes, new sign-in alerts, receipts, a reminder about an unfinished payment, plan-ending notices (7 days before and on the last day) and confirmation that your account was deleted. We don’t send marketing.
Emails are sent by our server or by an email delivery provider (Resend), which only receives the address and the content of the message.
Website, web app and statistics
We count visits to the website and the web app with Cloudflare Web Analytics, without cookies and without profiling visitors: only pages viewed, country, device type and where the visit came from.
The country of your IP address is used on the spot to show prices in kwanzas or US dollars; the IP address is not stored.
In the web app, with “Remember on this computer”, the session and key are kept in the browser, encrypted with a key that never leaves it. Without that option, nothing is kept on the computer.
The contact form sends the name, email and message you write to our mailbox.
Other services the app contacts
For exchange rates, the app queries Finda (BNA rates) and jsDelivr (other currencies); BODIVA quotes come from Finda through our server; Google is contacted if you sign in with Google. These requests carry no data about your finances. As with any internet connection, these services see your device’s IP address.
Where data is kept
Account data and encrypted copies are kept on our hosting provider’s servers (AngoWeb), in a data centre in Finland, in the European Union. The server’s technical logs don’t keep data content, full email addresses or access keys.
How long we keep it
We keep data while you have an account. Sign-in codes are valid for 15 minutes and sessions end after 90 days without use.
When you delete your account (in the app: More → Profile → Delete account), we immediately delete your email, profile, sessions, encrypted copies, photo, plan and payment attempts. Records of completed payments are kept, without your email, for as long as accounting law requires. Step by step: Delete your account and data.
Your rights
You can ask to access your data, correct it (the profile can be edited in the app), delete it (in the app, at any time) and take it with you (Settings → Export data file or CSV). For any request, write to info@macuta.ao.
In Angola, Law no. 22/11 of 17 June applies and you can complain to the Data Protection Agency (APD). In the European Union, the GDPR applies and you can complain to your country’s authority.
No selling of data, no advertising
We don’t sell your data or share it for advertising. There are no ads in Macuta.
Changes to this policy
If we change anything important, we’ll let you know in the app or by email. The date at the top shows the last update.