Legal
Privacy Policy
Last updated: June 2026
Hebua · Personal finance & expense tracking · Made in Kenya
1. Introduction
Hebua ("we," "our," "the app") is a personal finance and expense tracking application. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and how you stay in control when you use our mobile app and this website.
Hebua is not a loan or credit app. We do not sell your personal data.
2. Data We Collect
2.1 SMS messages (Android) — core feature
On Android, Hebua uses SMS access only to detect personal financial transactions from messages sent by M-PESA, Airtel Money, T-Kash, and supported Kenyan banks and Saccos (e.g. KCB, Equity, NCBA).
| Topic | What Hebua does |
|---|---|
| Purpose | Parse amounts, dates, types, and references for automatic income and expense tracking |
| What we read | Financial transaction SMS from known money senders — not your personal chats |
| Where parsing happens | On your device. Raw SMS text is not uploaded to our servers |
| What we store | Parsed transaction fields (amount, date, category, description) — on your device and, if you sign in, in your cloud account |
| Your control | You grant SMS permission explicitly. You can turn off SMS auto-capture anytime in Settings |
What Hebua does NOT do with SMS:
- Not a loan app — we do not offer loans, credit, or lending services
- Not marketing — we do not use SMS for advertising, profiling, or promotions
- Not sharing SMS — we do not sell, rent, or share raw SMS content with third parties
- Not reading unrelated messages — we target financial transaction SMS only
This use aligns with Google Play's SMS permissions policy and Kenya's Data Protection Act, 2019.
2.2 Account information
When you sign in, we collect your email address and user ID for account creation, cloud sync, and subscription management. Passwords are hashed and never stored in plain text. Data is stored on Supabase (secure cloud database).
2.3 Transaction data
Amounts, dates, categories, descriptions, and transaction types you add manually or that we capture from SMS. This powers budgets, insights, exports, and core tracking. Stored on your device and synced to Supabase if you sign in.
2.4 Payment information (subscriptions)
When you upgrade to Pro or Premium, payments are processed via IntaSend (M-PESA/Airtel) or Paystack (card). We do not store full card numbers — payment processors handle card data directly.
2.5 Device information
We may collect device identifiers, OS version, app version, and crash logs to improve performance and fix bugs. This data is not used to identify you personally for marketing.
2.6 Website analytics
This website uses Vercel Analytics to understand usage patterns. No personally identifiable information is collected through analytics. See Vercel's privacy policy.
4. Data Retention & Deletion
- Local data: Remains on your device until you uninstall or use Erase All Data in Settings
- Cloud data: Stored while your account is active
- Request deletion: Email support@hebua.co.ke with subject "Delete my data" and your account email. We delete within 30 days
5. Security
- Data in transit is encrypted (HTTPS/TLS)
- Supabase uses industry-standard security practices
- SMS parsing runs on-device; raw SMS is not transmitted to Hebua servers
- Passwords are hashed — never stored in plain text
6. Your Rights
Under applicable law (including Kenya's Data Protection Act), you may:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Export your data from the app
- Withdraw consent to SMS access or cloud sync in Settings
Contact support@hebua.co.ke to exercise these rights.
7. Children
Hebua is intended for users 18 and older. We do not knowingly collect data from children.
8. International Transfers
If you use cloud sync, your data may be processed on servers outside Kenya (e.g. via Supabase). By using Hebua with sync enabled, you consent to this transfer. We use providers with appropriate security safeguards.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be communicated in the app or by email. The "Last updated" date at the top reflects the latest revision.
10. Contact
Questions about privacy? Email support@hebua.co.ke