1. Who controls the data
“Piko,” “we,” or “the operator” means the party operating the Piko service. For data protection purposes, the Piko operator acts as controller where it determines why and how personal data is processed.
If you receive access through an organization or another party, that party may have its own policy for data it controls.
2. Data we may process
- Account data such as name, email, account identifiers, sign-in status, and preferences.
- Money records you enter, including income, expenses, amounts, dates, categories, notes, recurring bills, and report summaries.
- Your conversations with Piko and the corrections or confirmations you provide.
- Receipts, images, or voice recordings only when you choose to upload or record them, together with OCR or transcription results.
- Data from integrations you enable, such as a Telegram chat/account identifier and linking code.
- Technical and security data as needed, such as access times, change activity, device/browser information, and network addresses used to prevent abuse. Session tokens keep you signed in and help connect your account to Telegram when you choose that integration.
3. Why we use data
Our legal bases may include providing the service you request, consent for optional features, legitimate interests in security and service improvement, and compliance with law.
- To create and maintain your account, record entries, display reports, and sync account data.
- To understand chat instructions, extract transactions, read receipts, transcribe audio, and generate requested summaries.
- To deliver reminders or notifications you enable.
- To secure the service, prevent abuse, diagnose issues, and keep an audit trail of important changes.
- To meet legal duties and enforce the Terms of Service.
4. AI and service providers
Relevant portions of messages, receipt images, or audio may be sent to configured AI, OCR, or transcription providers. Piko also uses infrastructure providers for authentication/database services, hosting, anti-bot protection, notifications, and email. Examples may include Supabase, AI providers such as Sumopod or Groq, and Cloudflare.
If you connect Telegram, information sent through Telegram is also processed by Telegram under its own policy. Do not enable integrations you do not need.
Providers may process data in other countries. Where data crosses borders, we take steps required by law to maintain appropriate protection.
5. When data may be shared
We do not sell personal data. We share it only as needed with providers that operate Piko; at your direction or with your consent; in response to valid legal process; to protect users, the operator, or the service; or in a business restructuring with notice where required by law.
6. Retention and deletion
We retain data while your account is active and while needed for the purposes above. After account closure or an approved deletion request, data is deleted or anonymized within a reasonable period unless limited information must be retained for security, disputes, limited backups, or legal duties.
Deleting an entry or conversation may not immediately remove rotating backup copies. Those copies are not restored for routine use and expire through the backup cycle.
7. Security
We use reasonable technical and organizational safeguards, including access controls and account-level data separation. No internet system is risk-free. Protect your password and devices, and notify the operator promptly if you suspect unauthorized access.
8. Your rights and choices
Submit requests through the official support channel shown in the app. We may verify your identity and may restrict or decline a request where permitted or required by law.
- Access, correct, or update information through available features.
- Withdraw consent for optional features by disabling notifications or disconnecting an integration.
- Request a copy, restriction, deletion, or other action available under applicable law.
- Object or complain about how personal data is processed.
9. Cookies and device storage
Piko uses cookies or device storage needed for sign-in sessions, security, language/theme preferences, and application features. We do not state that advertising cookies are used as of this policy date. If that changes, this policy and consent choices will be updated where required.
10. Children and policy changes
People under 18 may use Piko with a parent or guardian’s consent and supervision. Parents/guardians should make sure the data entered is necessary and understand how Piko processes it. Do not provide another child’s data unless necessary.
We may update this policy for service or legal changes. Material changes will be announced through the app, email, or another reasonable channel before taking effect where required.
11. Contact
For privacy questions or data requests, use the official support channel shown in the app or the official Piko channel through which you received access. Include your account email and request type, but never send a password or sign-in code.