Privacy policy
Last updated 19 August 2026
Kist is a personal net worth and spending tracker operated by Jesse Abruzzo. This policy describes exactly what data Kist holds, why, and what it never does with it.
What Kist collects
- Your account details — email address, display name, timezone.
- Financial data from accounts you link — account names, types, balances, and transaction history (date, amount, merchant, category).
- Security records — timestamps and IP addresses for sign-ins, sign-in failures, and changes to your connections, kept to detect misuse.
What Kist never collects
- Your bank username or password. You enter those with Plaid; they never reach Kist.
- Account or routing numbers.
- Social Security numbers or other government identifiers.
- Payment card numbers.
- Your location.
How bank connections work
Kist uses Plaid to connect to financial institutions. You authorise each connection yourself, and you authenticate directly with your bank through Plaid. Access is read-only: Kist cannot move money, make payments, or change anything at your bank.
How your data is protected
- All traffic between the app and the Kist server is encrypted with TLS.
- Bank access tokens and two-factor secrets are encrypted with AES-256-GCM using a key derived separately for each user, so the database alone cannot read them.
- Passwords are stored only as scrypt hashes. Kist cannot recover your password.
- Two-factor authentication is available and recommended.
- Backups are private, encrypted at rest, and retained for 30 days.
What Kist does not do with your data
Kist does not sell, rent, or share your financial data. There is no advertising, no ad tracking, no analytics SDK in the app, and your data is not used to train machine-learning models. Data is shared only with the service providers required to run Kist, listed below.
Service providers
- Plaid — bank connectivity, under your authorisation.
- Google Cloud — hosting and backups, in the United States.
- Cloudflare — DNS lookups only; it does not see your traffic.
- Resend — sends verification and password-reset email. Receives your email address and the message.
Your rights
- Export — request a copy of your data from within the app.
- Delete — delete your account from within the app. Deletion is immediate and removes your accounts, transactions, balances, sessions, and bank access tokens. It cannot be undone. Copies in backups age out within 30 days.
- Disconnect — remove a bank connection at any time without deleting your account.
Retention
Your financial data is kept while your account exists and is deleted when you delete your account. Security records are kept to protect accounts against misuse and contain no transaction detail.
Children
Kist is not intended for anyone under 18 and does not knowingly collect data from children.
Changes
If this policy changes materially, the date above changes and you will be told in the app before the change takes effect.
Contact
Privacy questions: privacy@kist-app.com
Security reports: security@kist-app.com