Privacy Policy

CofiApps (“we,” “our,” “us”) makes Cashvelope (budgeting and expense tracking), Daykept (journaling), and Kindstone (meditation and sleep). We are a small independent developer based in Ho Chi Minh City, Vietnam. This policy covers these three apps and this website.

Cashvelope and Daykept store your data locally on your device: transactions, budgets, and receipts in Cashvelope, and journal entries, photos, and voice recordings in Daykept. If you do not create an account, this data is never sent to our servers.

Kindstone downloads meditations and sounds from our servers and stores your settings on your device.

Daykept and Cashvelope. An account is optional. If you create one, we store:

• Your email address and a securely hashed password
• Your name and profile photo, if you add them (Daykept)
• The data you sync: journal entries, tags, templates, photos, and voice recordings in Daykept; transactions, budgets, categories, and receipt images in Cashvelope

Kindstone. To save your favorites and listening statistics, Kindstone creates an anonymous account for each install. It uses a random identifier, not your name or email. If you choose to sign in with an email address, we also store that email address.

Where it is stored. Account data and synced records are stored on servers we rent from Hetzner Online. Photos, recordings, and receipts are stored with Cloudflare R2. Data is encrypted in transit (HTTPS). It is not end-to-end encrypted, so it is readable on our servers. We access it only to run, secure, and support the service. We back up the servers daily and keep each backup for 14 days.

With your permission, Kindstone saves your meditation sessions to Apple Health or Health Connect as mindful minutes. It reads mindful minutes only to avoid saving the same session twice. Health data stays on your device. We never send it to our servers, and we never use it for advertising or share it with anyone.

Paid plans in Cashvelope and Daykept are sold through the Apple App Store and Google Play. The store processes your payment, and we never receive your card or billing details.

We receive a record of what you bought and whether your plan is active. Daykept uses RevenueCat to check purchases, and it links your purchases to your Daykept account ID so your plan works on all your devices. Kindstone has no purchases.

All three apps use Google Firebase:

• Firebase Analytics records how features are used, for example which screens you open and whether a sync succeeded. It never records the content of your entries, transactions, or recordings.
• Firebase Crashlytics sends crash reports: device model, OS version, app version, and technical details about the crash.
• Firebase Remote Config lets us turn features on or off without an app update.
• Firebase Cloud Messaging (Kindstone) delivers push notifications, if you allow them.

Meta App Events (Kindstone). Kindstone uses Meta’s SDK to measure how well its ads work, for example whether an install came from an ad. On iOS, the app asks for tracking permission first, and Meta receives your advertising identifier only if you allow tracking. You can turn Meta analytics off at any time in Kindstone’s settings.

This website (cofiapps.com) uses Google Analytics 4 to understand how visitors find and use the site. Google Analytics collects anonymized data such as page views, session duration, device type, and referral source. It does not collect personally identifiable information.

Analytics only runs in production. If you prefer not to be tracked, you can use a browser extension like uBlock Origin or enable Do Not Track in your browser settings.

When you send a message via our contact page, we collect:

• Your email address (required)
• Your name (optional)
• The message you write

We use this information only to reply to your inquiry. We do not add you to any mailing list. The contact form is protected by Google reCAPTCHA to prevent spam.

We do not sell, rent, or share your personal information with third parties for their own advertising or marketing. We use the following providers only to run our apps and website, and each handles data under its own privacy policy:

• Hetzner Online: servers for accounts and sync
• Cloudflare: file storage (R2)
• Google: Firebase (all apps), Google Analytics and reCAPTCHA (website)
• RevenueCat: purchase checks (Daykept)
• Meta: ad measurement (Kindstone, can be turned off)
• Apple and Google Play: app distribution and payments

We keep your account data for as long as you have an account.

• Daykept and Kindstone: delete your account in the app’s settings.
• Cashvelope: email us from the address on your account, and we will delete it.

After you request deletion, you have 30 days to change your mind by signing in again. After that, we permanently delete your account and synced data within 60 days of your request, and it disappears from our backups within 14 more days. Data stored only on your device is removed when you uninstall the app.

Our apps are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please email us and we will delete it promptly.

We may update this page if our practices change. The “Last updated” date at the top will reflect any revision. We will not make material changes without posting them here.