BooKoo

Privacy Policy

The BooKoo operator, hyo.dev, processes information to provide and secure the service and, only with separate consent, optional country usage statistics.

Effective: 2026-11-04

1. Operator and contact

Operator and privacy contact: hyo.dev · hyo@hyo.dev. Use this address for rights, security, and privacy requests.

2. Purposes and legal basis

We process data to create and authenticate accounts, provide shared ledgers and invitations, synchronize entries, comments and photos, deliver optional notifications, protect the service, support users, and fulfill their requests. Core processing is necessary to perform the service contract; optional features require separate choice.

BooKoo is not available to children under 14. We do not collect a date of birth; users attest that they are at least 14. Refusing an optional feature does not block the core service.

3. Data we process

Account data: provider identifier, verified email when supplied, display name, unique handle, avatar, language, currency, time zone and appearance settings. Service data: ledgers, roles, income and expense amounts, currency, dates, categories, memos, comments, invitations, receipt photos, and a place name, address and coordinates that a user optionally attaches to an entry. Device and security data: push token and essential login, deletion and export events.

Current location is accessed only when the user requests it in the place picker; permission can be refused or revoked in OS settings. We do not collect background location, movement history, contacts, bank accounts, payments, gender, birthdays, or friend lists. The Android advertising ID is blocked and BooKoo does not request iOS ATT permission. For Free-tier ads, Unity LevelPlay/ironSource Ads·Unity Ads and UMP may automatically process IP-derived approximate location, app interactions, diagnostics, app/device identifiers, and advertising data.

For a deterministic 25% sample of release-build installations, EAS Observe processes an anonymous installation identifier, app version, build and environment, country, operating system, device model, language, startup timing, frames, memory, device and network performance diagnostics. It excludes accounts, ledgers, entries, amounts, memos, photos, places, query parameters and custom events.

Receipt scanning reads an amount and date from a photo selected by the user on the device and asks for confirmation before applying them. Android uses Google ML Kit; iOS uses Apple Vision. Recognition images and text are not sent to an OCR server. A photo is uploaded through the existing attachment feature only when the user saves the entry.

3-1. Optional country usage statistics

Only accounts that opt in under Privacy settings use their IP-estimated country code and latest activity time for aggregate active-account counts by country. This is off by default and refusal does not restrict the ledger. The app requests only a country code over HTTPS from the existing website host, Vercel Inc. (United States), without an account identifier, authentication token or cookie. Vercel transiently processes the IP for the estimate; its infrastructure security records follow its own policies. BooKoo application code, functions and database do not store or log IP addresses, cities, coordinates or movement histories, and request no location permission. Only the latest country code is kept with account presence and overwritten by a new reading. Turning this option off immediately deletes the code; account deletion also follows the existing deletion policy. VPNs or proxies can affect the estimate. Failed lookups, no consent and older app versions count as unknown, and past activity is not assigned a country retroactively.

4. Sharing and visibility

Ledger amounts, memos, comments and receipts are visible only to current members of that ledger. Someone who receives an invitation may join with its assigned role. We do not sell personal data or send financial content or account profiles to advertisers. Limited technical and advertising data automatically processed by Unity LevelPlay/ironSource Ads·Unity Ads is described in sections 6 and 9.

5. Retention and deletion

Account and provider data lasts for the account lifetime and is erased after the 30-day deletion recovery period. Deleted entries and ledgers are purged after 30 days. Export files and terminal failures last up to 7 days; security and audit records last up to 180 days or 2 years by purpose; resolved support records last up to one year.

Account deletion removes authored comments and uploaded photos. Shared financial records may remain with the author replaced by a de-identified label so other members retain their ledger. A legal hold keeps only the required scope and period. Electronic data is securely deleted.

6. Processors and international transfers

Convex Labs LLC provides database, authentication, server functions and file storage in the selected deployment region. Data is encrypted in transit and processed for the service lifetime and the deletion periods above. Resend (Plus Five Five, Inc., United States) processes email address, locale and one-time authentication email; standard plans retain email and logs for 30 days. Expo and Apple/Google push services process push tokens and minimal, non-financial notification metadata when notifications are enabled. IAPKit (Hyo Dev) processes an internal app user identifier, store receipts/purchase tokens and purchase and renewal records, only if you use a subscription, in order to determine subscription status. No ledger content, memo, photo or location is sent. Card details are handled by Apple and Google and are held by neither BooKoo nor IAPKit.

Unity Technologies and its affiliates provide Free banners through Unity LevelPlay/ironSource Ads and Unity Ads. They may process and share IP-derived approximate location, app/device/installation identifiers, ad interactions, performance data, device language/model/screen/network information and purchase/usage-related information listed in the SDK disclosures for ad delivery, measurement, diagnostics and fraud prevention. Data is encrypted in transit to provider locations including the United States and Israel and retained as needed for those purposes and legal obligations. Google LLC (United States) provides UMP for consent management; BooKoo makes no Google Mobile Ads ad requests. Android advertising ID is blocked, iOS ATT is not requested and ads are restricted to contextual delivery. BooKoo does not explicitly send ledger content, account profiles or IAPKit purchase-verification proofs to ad SDKs. The providers disclose their own processing of purchase-related information. Ad Quality, optional developer-data sharing and custom ad events are disabled. Older app versions may retain AdMob until updated.

Expo Application Services provides EAS Observe from the United States. For a 25% anonymous installation sample of release builds, it processes app startup and rendering performance plus device, operating-system, app-version, country, language and network diagnostics. A native crash may also include numeric exception, signal or termination codes and symbolic code-stack frames. Data is hosted in the United States and may be retained for at least 90 days. BooKoo disables router integration, URLs and query parameters, account and ledger identifiers, custom events, user attributes and automatic JavaScript error collection, and strips free-form Android and iOS exception messages.

When chosen, Apple, Google, Kakao or Naver supplies a provider identifier and the minimum profile the user allowed. Current provider policies and subprocessor lists apply. A user can stop email, push or a social provider, but refusing the core Convex processing prevents us from providing the service. Official processor links appear below.

Android ML Kit from Google LLC (United States) may send device and app information, per-installation identifiers, processing time, image format and resolution, input and output size, feature versions, event types and error codes over HTTPS for diagnostics and API usage analytics. Recognition images, text and result content are not sent to Google. Retention and processing follow the Google Privacy Policy; the SDK states that these diagnostics are not shared with third parties.

7. Your rights

You may request access, correction, export, deletion, restriction or withdrawal of an optional choice. Start export and deletion in Settings > Privacy and data, use the public rights/deletion pages, or email us. We verify the account and respond without undue delay. If another member’s rights or law limits a request, we explain the reason and available scope.

Privacy choices: /privacy-choices
External deletion request: /account-deletion
Contact: hyo.dev · hyo@hyo.dev

8. Security

Controls include encryption in transit, least privilege, environment-separated secrets, authenticated photo downloads, membership rechecks, rate limits, scheduled deletion, secret scanning and access records. Financial content, photos, OTPs and invitation codes are excluded from push payloads and ordinary logs. Ledgers, entries and comments use the server response as their source of truth and are not copied to ordinary device storage. Sign-in and app-lock records remain protected in their separate secure stores.

9. Tracking

Free may show one non-personalized Unity LevelPlay/ironSource Ads·Unity Ads banner directly below the four main tabs, between the tab bar and the device bottom Safe Area. The SDK may process IP-derived approximate location, app interactions, diagnostics, app/device identifiers, and advertising data for ad delivery, measurement, analytics, and fraud prevention. BooKoo blocks Android advertising ID access and does not request iOS App Tracking Transparency permission. Financial content, memos, receipts, places, and account profiles are excluded from ad requests. Regional ad privacy choices can be reopened in Settings.

The 25% EAS Observe installation sample measures technical app performance only, not advertising tracking or product-behavior analytics. Its per-installation anonymous identifier is not connected to another app or to an account, and no screen URL, query parameter or ledger content is sent.

Android ML Kit technical diagnostics are separate from advertising tracking and BooKoo custom ledger analytics. The SDK may process technical metrics during initialization or recognition. Receipt scanning is optional; entries can still be entered manually.

10. Changes and versions

Material changes are announced before they take effect. A broader purpose or data type receives separate choice where required. The versions page keeps the change history.

11. Official references

This notice follows the Korean PIPA, Google Play User Data policy, and official Convex, Expo and Resend processing materials. We re-check official sources and obtain professional review when needed before material changes.

Language

한국어 English 日本語简体中文 Bahasa Indonesia