Privacy policy

Who is responsible for your information

RandTracker is operated by Mokwatsi Technologies of Midrand, Johannesburg, Gauteng, 1685, the responsible party under POPIA. Our information officer is Motebang Mokwatsi. You can reach us about anything in this policy at [email protected].

What we collect

• Account details: your email address and name, and your password in hashed form. If you turn on two-factor sign-in, we also hold what is needed to check your codes, and your recovery codes in hashed form.
• Financial information you enter or import: accounts and balances, transactions, categories, budgets, schedules, debts, goals, investments, stokvels and rules.
• Bank statements you import: statements are read to show you the transactions they contain. We save the transactions you choose to keep, and we do not keep the statement file.
• Household information: if you create or join a household, its name, its members’ names and email addresses, and the accounts and budgets in it.
• Technical information: sign-in records, which can include your IP address, and error reports containing the error message and the page it happened on.
• Usage statistics: which pages are visited and which features are used, such as finishing setup or importing a statement, with the browser, device type and country. This is counted on our own server, without cookies. It never includes your name, email address, amounts, account details or anything you type, and addresses that contain an account or household number have that number removed first. Your IP address is used to work out the country and is not stored. If your browser sends Do Not Track, nothing is counted.

We do not ask for your banking password or connect to your bank. You must give an email address and password to have an account. Everything else you enter is up to you, though the app can do less without it.

Why we use it

What we don’t do

• We do not sell your information.
• We do not show advertising or share your information with advertisers.
• We do not pass your information to lenders or credit providers.

Sensitive information and children

We do not ask for special personal information, such as health or religious information. Your transaction descriptions or categories could reveal some, for example a medical aid payment. Please avoid adding more detail than you need.

RandTracker is for people aged 18 and over.

Who else handles your information

We use these service providers, who process information on our behalf:

• Hostinger: hosts the server and database, in France.
• Cloudflare: carries traffic between you and the server, protects the site and stores our encrypted backups.
• Resend: delivers our emails, including the contents of any reminders you turn on.

If you join a household, its other members can see that household’s accounts and budgets, along with your name and email address. They cannot see your personal finances. We may also disclose information where the law requires it.

Google Drive and Google user data

RandTracker can save your backup to your own Google Drive. This is optional and only happens when you choose Save to Google Drive in Settings.

• What we access: Google asks your permission each time, for the drive.file scope only. It lets RandTracker create a “RandTracker” folder and save your backup file there, and find that folder again. It does not let us see any other file in your Drive. We do not access your Gmail, contacts or anything else in your Google account.
• How we use it: only to put the backup you asked for in your Drive. The file holds your RandTracker accounts, transactions, categories, budgets, debts and goals.
• How we store it: we don’t. The permission stays in your browser while the file is saved and is withdrawn straight afterwards. Our server never receives it, and it never receives anything from your Drive. The saved file belongs to you, under Google’s terms, and you can delete it at any time.
• Who we share it with: no one. We do not sell or transfer Google user data, use it for advertising, or use it to train AI models.

RandTracker’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can also remove RandTracker’s access at any time in your Google account settings.

Information sent outside South Africa

Your information is stored and processed outside South Africa, including in France, and our service providers may process it in other countries, including the United States. We rely on these providers’ data protection commitments and on POPIA’s allowance for transfers needed to perform our agreement with you.

How we protect it

Traffic is encrypted. The database only returns information to the people it belongs to. Two-factor sign-in is available, and backups are encrypted. No system is completely secure. If we have reasonable grounds to believe your information has been accessed without authorisation, we will notify you and the Information Regulator as POPIA requires.

How long we keep it

• We keep your information for as long as you have an account.
• When you delete your account, it is removed from the live system straight away.
• Encrypted backups containing it expire within 35 days. Until then it may still exist in those backups, and we do not use them except to recover from a failure.
• If you leave a household, its data stays with its remaining members. When its last member leaves, the household and its data are removed.
• Technical logs are kept for a short time and overwritten as new ones are written.
• Usage statistics don’t identify you and stay on our server. They aren’t linked to your account, so they aren’t removed when you delete it.

Your rights

Under POPIA, you have the right to:

• ask whether we hold your information and request a copy of it
• ask us to correct or delete it
• object to processing based on our legitimate interests
• withdraw consent where we rely on it
• complain to the Information Regulator

You can correct most information yourself in the app, and export your data or delete your account in Settings. For anything else, contact [email protected].

You can contact the Information Regulator of South Africa through inforegulator.org.za.

Cookies and browser storage

We use cookies only to keep you signed in. Your browser also stores your theme and which set of books you last opened. We do not use advertising or tracking cookies, and our usage statistics work without cookies.

Changes to this policy

If we make a significant change, we will tell you by email or in the app before it takes effect.