On your phone. If you sign in, a copy also lives on Kesef's server so you can use several devices, and there only your account can read it. If you never sign in, your transactions never leave the phone: only what you send when you use voice logging or the Chat travels. The data isn't sold.
Voice logging sends the audio, your category and payment method names and, if you're in groups, those groups' and members' names. A Chat question travels with an aggregated summary of your numbers, never an individual transaction or a note. The Mercado Pago and Apple Pay integrations are read-only and never involve your password. You can delete your account from the app, with everything in it, and local backup stays free. The full detail, service by service, is in the privacy policy.
More detail
- Without an account: everything lives on the phone (local database). A local backup exports it to a file of yours.
- With an account: a copy on the server, under your account, for syncing; a group's expenses are seen by that group's members.
- What leaves the phone through your action: the voice-logging audio (transcription) and Chat questions, with an aggregated summary of your numbers (totals by month and category, category names and the merchants where you spend the most; never an individual transaction or a note).
- Usage analytics without amounts or descriptions of your expenses.
- Do I need an account to use Kesef?What changes with and without an account.
- Can Kesef see my card or pay with it?What Kesef sees of your card and Mercado Pago (and what it doesn't).