How long we keep things

Berapa lama kami menyimpan sesuatu

Version 2026-08-27 · English and Bahasa Malaysia · Operated by Team JUST50, Malaysia

A schedule, per kind of data, with the actual periods — because the PDPA requires personal data no longer needed to be permanently deleted, and a policy nobody can check is not one.Jadual, mengikut jenis data, dengan tempoh sebenar — kerana PDPA menghendaki data peribadi yang tidak lagi diperlukan dipadamkan secara kekal, dan dasar yang tidak boleh disemak oleh sesiapa bukanlah dasar.

The schedule

Your money records — kept while your account is open, because their whole value is the history. Deleted when you close the account.
Receipt and statement images — kept attached to their record while the account is open. Delete an individual image at any time from the record; the record survives without it.
Off-site backups — the last 14 daily backups with Cloudflare R2, encrypted. Older ones are deleted automatically on that rolling cycle.
A closed account — marked deleted immediately, purged permanently within 30 days. Backups taken before that date age out on their own 14-day cycle, so the last trace is gone within about 45 days.
Consent and sharing decisions — kept longer than the data they govern, because they are the evidence that processing was lawful. Held for as long as needed to demonstrate that or to answer a dispute.
The share access log — kept while the account is open, so you can look back at who read what. It cannot be edited or deleted by anyone, including us.
The audit ledger — append-only and permanent for the life of the household, because it is what makes tampering with money records detectable.
Visit counts — the page, country and duration, with no IP and no account link. Kept as aggregate operational statistics.
AI call records — the model, the token count and the cost. Kept so cost is auditable. The content of a request is not stored by us.
Support correspondence — kept for a limited period after the case closes, then deleted.
A sealed vault backup — kept until you delete it. We cannot read it and cannot recover it if you lose the passphrase.

Jadual

Rekod kewangan anda — disimpan selagi akaun anda dibuka, kerana nilainya terletak pada sejarahnya. Dipadamkan apabila anda menutup akaun.
Imej resit dan penyata — disimpan bersama rekodnya selagi akaun dibuka. Padamkan imej individu pada bila-bila masa daripada rekod itu; rekod itu kekal tanpanya.
Sandaran luar tapak — 14 sandaran harian terakhir dengan Cloudflare R2, disulitkan. Yang lebih lama dipadamkan secara automatik mengikut kitaran bergolek itu.
Akaun yang ditutup — ditandakan dipadam serta-merta, dimusnahkan secara kekal dalam tempoh 30 hari. Sandaran yang diambil sebelum tarikh itu luput mengikut kitaran 14 harinya sendiri, jadi kesan terakhir hilang dalam kira-kira 45 hari.
Keputusan persetujuan dan perkongsian — disimpan lebih lama daripada data yang ditadbirnya, kerana ia bukti bahawa pemprosesan adalah sah. Disimpan selama yang diperlukan untuk membuktikannya atau untuk menjawab sesuatu pertikaian.
Log akses perkongsian — disimpan selagi akaun dibuka, supaya anda boleh menyemak semula siapa membaca apa. Ia tidak boleh disunting atau dipadam oleh sesiapa, termasuk kami.
Lejar audit — hanya boleh ditambah dan kekal sepanjang hayat isi rumah, kerana itulah yang menjadikan pengubahsuaian rekod kewangan dapat dikesan.
Kiraan lawatan — halaman, negara dan tempoh, tanpa IP dan tanpa pautan akaun. Disimpan sebagai statistik operasi agregat.
Rekod panggilan AI — model, kiraan token dan kos. Disimpan supaya kos boleh diaudit. Kandungan sesuatu permintaan tidak disimpan oleh kami.
Surat-menyurat sokongan — disimpan untuk tempoh terhad selepas kes ditutup, kemudian dipadamkan.
Sandaran peti bermeterai — disimpan sehingga anda memadamkannya. Kami tidak boleh membacanya dan tidak boleh memulihkannya jika anda kehilangan frasa laluan.

Deleting sooner

You do not have to wait for a schedule. Delete an individual record, an individual receipt image, or the whole account, at any time, from within the app.
Closing your account starts a short grace period during which you can undo it, then the data is purged permanently. That grace period exists because account deletion done in anger at 2 a.m. is the one destructive action people most often regret.
Take your export first — one click, machine-readable JSON, everything you can see.

Memadam lebih awal

Anda tidak perlu menunggu jadual. Padamkan rekod individu, imej resit individu, atau keseluruhan akaun, pada bila-bila masa, dari dalam aplikasi.
Menutup akaun anda memulakan tempoh tangguh yang singkat di mana anda boleh membatalkannya, kemudian data dimusnahkan secara kekal. Tempoh tangguh itu wujud kerana pemadaman akaun yang dilakukan dalam kemarahan pada pukul 2 pagi ialah tindakan memusnahkan yang paling kerap disesali orang.
Ambil eksport anda dahulu — satu klik, JSON yang boleh dibaca mesin, semua yang anda boleh lihat.