Kisim

Privacy Policy

Effective November 7, 2026

If the two versions differ, the Hebrew version applies. עברית

Kisim is built so that your financial data stays on your phones. This policy explains what is saved and where, what passes through outside services, and what isn't collected at all.

Who we are

The app "Kisim - household budget" and the website kisim.co.il are operated by Guy Yardeni ("we"). Contact: [email protected].

The principle: we don't collect your financial data

  • We have no server that can read transactions, amounts, merchants, categories or budgets. In a shared household they pass between the phones through a relay, encrypted with a key that exists only on your phones, and are deleted from it after the phones have received them (see "Sync between household members").
  • There are no user accounts. We don't keep an email, password, name or phone number for using the app.
  • The app doesn't connect to your bank or card company, and doesn't ask for your login details with them.
  • We don't keep card numbers. The app keeps at most the last 4 digits, as they appear in a notification or in a statement file you imported, and for a payment through the wallet also the card's name as you set it in the wallet. These are saved on your phone, and in a shared household also on the household members' phones.

What is saved on your phone

Transactions (amount, currency, merchant or the recipient's name in a transfer, category, date, last 4 digits and capture source), categories, budgets, recurring expenses, installment plans, income and settings are saved in an encrypted database on the device. The encryption key is protected by the operating system's secure mechanism (Android Keystore on Android, Keychain on iPhone) and doesn't leave the device.

  • A technical record of captured notifications is also saved: from which app, when, and what the result of parsing was. After the transaction is created, the amount, merchant, digits and card name are deleted from this record.
  • With each captured transaction, a record of what was captured is also saved: the source, amount, currency, time, and for a payment through the wallet also the card's name. This record doesn't change when you edit the transaction. It is used so that one purchase arriving from two sources, for example from the wallet and from the card company, is counted once. It is deleted when the transaction is deleted.
  • For each card in the wallet, which card company it belongs to is saved: the card's name and the company. A card whose name mentions a company is linked to it automatically. On iPhone, for any other card Kisim asks once which company it belongs to. You can choose or change this in Settings > Cards in the wallet. The link is kept until you delete it there, even after the card's transactions are deleted. Deleting removes the name and the company from all the household's phones. A card that has transactions and whose name mentions a company stays linked to it, and can be deleted when it has no transactions.
  • Income: Income you added yourself is saved on the phone: name, amount, currency, and the day of the month or the date, and for monthly income also the start and end months. It is used only to calculate the end-of-month forecast on Home. Kisim doesn't read income from your bank or from notifications. Deleting an income deletes its details.
  • Importing a statement file: You can import a transaction statement file you downloaded yourself from your card company (Cal, Max or Isracard). The file is read and processed on your phone only. It isn't saved in the app and isn't sent anywhere. From the file, only the transactions you chose to import are saved: date, merchant, amount, the card's last 4 digits, for an installment purchase also the number of payments, and for a foreign currency transaction also the original amount (as a note). For a transfer in a Max statement, the recipient's name and the description are saved as a note, on the device, and in a shared household also on the household members' phones. The rest of the file, such as the business sector, isn't saved, and the cardholder's name and ID number in the file aren't read at all. With each imported transaction, a one-way fingerprint of the line is saved, protected by a secret key, so that importing the same file again won't record it twice.
  • Exporting to a CSV file: You can export transactions to a file that opens in Excel (Settings > Export transactions). The file isn't encrypted. It contains the date, merchant, amount, category, source, 4 digits and note of each transaction in the range you chose. Kisim doesn't send it anywhere: it opens in your phone's share window, and you choose where to send or save it. From that moment it is in your hands, and anyone who receives it can read the transactions. The temporary copy created for sharing is deleted from the app at the next export or the next time the app opens.
  • Kisim keeps technical counters on the phone for diagnostics, for example how many notifications came from each card company, with no content from the notifications. The counters don't leave the phone.
  • A random device identifier, unrelated to you, is saved to prevent duplicates.
  • Deleting a transaction in the app deletes its details. Only an internal identifier, the deletion date and a one-way fingerprint protected by a secret key remain, which can't be used to recover the details, so that the transaction won't come back from another phone in the household.
  • Deleting the app deletes all the data from the device. On iPhone, the operating system keeps the encryption keys in the Keychain even after the app is deleted. They don't open any data, because the database was deleted, and Kisim deletes them on first launch if it is installed again. A file you exported, or a statement file you saved, stays where you saved it, and is deleted only when you delete it.

Reading notifications

On Android, after you approve "Notification access", the operating system passes all the notifications arriving on the phone to Kisim. Kisim checks only which app each notification came from. A notification from an unsupported app (currently Cal, Max, Bit, PayBox and Google Wallet are supported) is discarded at once, without its content being read. A notification from a supported app is parsed inside the phone, in an isolated JavaScript engine of the Android System WebView component, with no network connection. Only the result is saved: amount, currency, merchant, last 4 digits and time, and for a Google Wallet notification also the card's name in the wallet. For a transfer with Bit or PayBox, the "merchant" is the recipient's name as it appears in the notification (for example "PayBox · Dana Cohen"), and it is saved on the phone like any other detail of the transaction. When the same purchase comes from both Google Wallet and the card company, it is recorded once. The notification's text itself isn't saved and isn't sent anywhere. You can revoke access at any time in your phone's settings.

On iPhone, capture works through one shortcut in Apple's Shortcuts app, which you install and turn on yourself:

  • A notification from Cal, Max, Bit or PayBox: the shortcut passes the notification's title, text, time and app name to Kisim, inside the phone. It runs only on notifications from the apps you selected in it, and Kisim ignores any other notification that reaches it.
  • A payment with Apple Pay: the shortcut passes the amount, merchant and the card's name in the wallet.

Kisim parses the notification inside the phone, with no network connection, and saves only the result: amount, currency, merchant, last 4 digits or card name, and time. The notification's text isn't saved and isn't sent anywhere. Only a one-way fingerprint of it is saved, on the phone, so that the same notification won't be recorded twice. You can stop at any time: turn off the automation in the shortcut, or delete it.

Sync between household members

If you add several phones to one household, changes pass between them through a relay operated on Cloudflare's infrastructure. Before sending, each change is encrypted on the phone with a key that exists only on the household's phones. Therefore:

  • The relay receives encrypted messages only, and neither we nor Cloudflare can read their content.
  • The household is identified by a random identifier unrelated to any name, email or phone. The relay keeps only this identifier, random identifiers of the household's phones, and the times messages were received.
  • A message is deleted from the relay after all the household's phones have received it, and at the latest after 30 days. A household not used for 180 days is deleted from the relay.
  • To prevent flooding, the relay limits the opening of households by a hashed value of the IP address, with a salt that changes every day. The address itself isn't saved.
  • To pass the messages, Cloudflare processes communication data such as IP addresses, and shows us aggregate counters (such as the number of requests). The relay's logs are off, and we don't keep IP addresses.

What household members see: the transactions, categories and budgets from all the phones, and the nickname you chose for your phone. With each captured transaction, the record of what was captured also passes, including the card's name for a payment through the wallet. The link of each wallet card to its card company (the card's name and the company) also passes. Recurring expenses, installment plans, income and settings shared by the household, such as the day the month starts (Settings > Month starts on), also pass between the phones, encrypted like everything else. The link is kept until you delete it in Settings > Cards in the wallet, and deleting removes it from all the household's phones. When joining, the data on the joining phone merges with the household's.

Leaving and removal: A phone that left or was removed from the household no longer receives updates. What is already on it stays on it. After a removal, the other phones move to a new encryption key.

Camera

The camera works only on the screen that scans the code for joining a household. Scanning is done on the phone, with no network connection, and the image isn't saved or sent.

App lock

You can turn on a lock in Settings > Fingerprint or face lock.

  • When the lock is on, Kisim opens only after your phone's lock. On Android: fingerprint (or face recognition, on phones where Android treats it as secure), or the phone's code. On iPhone: Face ID, Touch ID or the phone's code.
  • The operating system does the verification. Kisim receives only an answer as to whether it succeeded. It doesn't see or save fingerprints, face images or codes.
  • Hiding: When the lock is on, the app's content is hidden in the recent apps screen. On Android, screenshots are also blocked.
  • The setting is saved only on the phone.

Outside services the phone contacts

  • Bank of Israel: to get the representative rate for purchases in foreign currency. The phone contacts the Bank of Israel's server directly (edge.boi.org.il) and asks only for a currency code and a one-month range, for example "dollar, September". The request doesn't include an amount, merchant, purchase date or details about the phone, and cookies returned by the server are deleted at once. As with any internet request, the bank's server sees the connection's IP address. The rates are saved on the phone.
  • Apple, version check (on iPhone): up to once a day, the phone asks Apple's server (itunes.apple.com) what the latest version of Kisim on the App Store is. The request includes only the app's identifier, which is the same for all users, and the store in Israel. It doesn't include data from the app or details about the phone, and cookies are deleted. As with any internet request, Apple sees the IP address.
  • Apple and Google: downloading the app, updates, and the Shortcuts app on iPhone are subject to their privacy policies.
  • Cloudflare: the relay for sync, as described above.

Automatic backup and moving to a new phone

Kisim isn't included in Google's automatic backup, in iCloud backup, or in data transfer between devices. So when you move to a new phone, the data doesn't move on its own. It comes from another phone in the household, or from a manual backup file.

Manual backup

You can create a backup file in Settings > Backup.

  • Encryption: The file is encrypted on the phone, with a password you choose, before it is saved. Without the password it can't be opened.
  • Where it is saved: In the place you choose in the phone's file picker, for example on the phone itself, in Google Drive or in iCloud Drive. If you chose a storage service, the encrypted file is kept there under its terms. Kisim doesn't send the file anywhere itself, and we don't receive a copy.
  • The password: Isn't saved anywhere. We have no way to recover the file or the password.
  • What is in the file: The transactions, categories, budgets, recurring expenses, installment plans, income, settings shared by the household, merchant rules, the record of what was captured with each transaction (including the card's name for a payment through the wallet), the links of wallet cards to companies, and a technical key that prevents recording the same purchase twice. The household's encryption key isn't in the file, so the file gives no access to sync.
  • Restoring: Possible only on a new phone, with no transactions and not in a household.

The website kisim.co.il

The website doesn't use cookies, analytics or tracking tools, and doesn't save anything in your browser. All its files, including the font and images, are served from our server, with no request to third-party servers.

The website passes through Cloudflare, which protects it and forwards requests to it, and for this processes communication data such as IP addresses. Our server doesn't keep access logs.

To hide the email addresses on the website from spam scanners, Cloudflare adds a small script of its own to the pages, loaded from the website's address. It doesn't use cookies and doesn't track you.

Contacting us by email

If you write to us, we will keep the message and your email address in order to answer you, and will delete them at your request. If you asked for an update about the launch, we will use the address only for that.

Security

We use accepted encryption libraries. The app has no analytics or crash reporting tools, and doesn't write transaction or notification content to system logs. Even so, the security of the phone itself (lock code, system updates) is your responsibility. You can also lock the app with your phone's lock (see "App lock"): on Android, fingerprint (or face recognition, on phones where Android treats it as secure) or the phone's code, and on iPhone, Face ID, Touch ID or the phone's code.

Your rights

Since the data is with you, you can view, correct and delete it directly in the app. For email correspondence, you can ask to view, correct or delete it at [email protected].

Age

The service is intended for people aged 18 and over.

Changes to the policy

We will update the policy on this page and change the effective date. A material change will also be shown in the app.

Contact

[email protected]