Your money is private. So is your data.
Last updated · October 14, 2026
Who we are
yen-yen is a household budgeting app made by kensaurus LLC ("we", "us"). This policy covers the yen-yen apps for iPhone and Android and the website at kensaur.us/yen-yen. We decide how your data is used, so we are responsible for it. • Company: kensaurus LLC (ｋｅｎｓａｕｒｕｓ合同会社), corporate number 5011003021894 • Address: Shibuya Dogenzaka Tokyu Bldg. 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan (〒150-0043 東京都渋谷区道玄坂1丁目10番8号 渋谷道玄坂東急ビル2F-C) • Representative: Kenji Sakuramoto (櫻元 賢次) • Email: kensaurus@gmail.com
What we collect
• Account: your email, an optional display name, and an account ID. If you start a purchase or a restore without registering, the app creates an account with an ID only — no email and no name — and moves the entries on your phone into it. You can add an email later. If you add a passkey, we store only its public key — never your fingerprint or face. • Ledger: the accounts, transactions, budgets, payees, categories and notes you or your household enter. • Files you choose to add: receipt photos you attach and statements you import. • Purchases: your plan and the purchase or receipt ID from Apple, Google or Stripe. We never see your card number. • Device: a push token if you turn on notifications, and crash reports with device model, system version and app version. Crash reports are linked to your account ID. Feedback sent from the website goes to Sentry with your email. • Usage: simple events such as sign-up, your first entry and a once-a-day visit, tied to your account or an ID the app creates. These never include amounts, payees or notes. • Bug reports: when you send one from Help → Report a problem, it includes your message, the report type, recent app logs, your account ID, email and display name if you are signed in, and a screenshot of the current screen. The screenshot is attached by default and may show balances or other financial details. Check the preview and remove it before sending if you prefer.
What we never collect
Your bank login or card number. Your contacts. Your browsing history. We don't run ad trackers, record your screen, or sell or rent your data. Smart Suggestions can use your location to suggest a payee, but only if you turn it on. Your location stays on your phone and is never saved. The names, colours and logos we show for card networks, banks and payment services ship inside the app, so showing them sends nothing to anyone.
Why we use it
• To run yen-yen: sign you in, store and sync your ledger, and share it with your household. • To run the AI features described below. • To send the reminders and alerts you turn on. • To handle your plan, purchases and credits. • To find and fix bugs, keep the service secure, and stop abuse. • To reply when you contact us. • To see, in total, which features people use, so we can improve them. We never use your data for advertising. Before we use it for a new purpose, we will tell you, and ask where the law requires it. If the GDPR applies to you: we rely on our contract with you to run the service and the features you use, including AI features; on our legitimate interests for security, bug fixing, usage totals, and for handling entries you added when another member of your household uses a feature; and on your consent for notifications and location.
Your household
Everyone in a household can see and edit that household's ledger, including entries other members add. Invite only people you trust. When any member uses an AI feature, it can send household entries, including ones you added, to the AI services listed below. Background AI features run for a household only when its owner has allowed them. If you own a household and delete your account, the household and everything in it is deleted for every member. If you are a member and delete your account, you leave the household. Entries you added stay in the household's ledger, with their notes and receipt photos, but they are no longer linked to your account. Entries you marked private are deleted. If you don't want to leave an entry behind, delete it before you delete your account.
One account for all our apps
You sign in with one account that works in all our apps. "Our apps" means the apps made by kensaurus LLC, listed at kensaur.us. Those apps share your sign-in, your credits wallet, referral codes and passport stamps. Your yen-yen ledger is not shared with them.
Who helps us run yen-yen
We use these services to run yen-yen. Each one gets only the data its job needs. • Supabase: database, sign-in, file storage and server functions. Our database and files are on its servers in Tokyo, Japan. • PowerSync: keeps the ledger on your phone in sync with the database. • Anthropic: AI for statement and receipt import, reconcile, Ask Anything, category suggestions and the weekly insight. • OpenAI: backup AI for statement import, and merchant vectors. • OpenRouter: yes-or-no matching decisions during reconcile, answered by TypeSafe's model. • Langfuse: AI monitoring. It keeps short excerpts of AI requests and replies, in the United States (Amazon Web Services, Oregon). • Sentry: crash and error reports. • Expo, Apple and Google: push notifications and Live Activities. • Apple, Google and Stripe: payments and subscriptions. They also follow their own privacy policies when they take your payment. • RevenueCat: handles App Store and Google Play purchases for us and keeps their history, linked to your account ID. • Mushi: our own bug-tracking service. It receives the bug reports described above and runs on Supabase in Tokyo.
When AI sees data
Some features send data to outside AI services, which process it to return a result. AI features run only after you allow them in the app, and you can turn them off any time in Settings → Workflow & shortcuts → AI features. Until you allow them, nothing is sent. Background features run for a household only when its owner has allowed them. • Statement and receipt import send the file or text you give them. • Reconcile sends the statement and the ledger entries it is unsure how to match. Pairs it cannot decide (date, payee, amount) go to OpenRouter for a yes-or-no answer. • Ask Anything sends your question and up to 200 entries from the last 90 days (date, payee, amount, class). • In the background, category suggestions send an entry's payee and amount with a few of your past categorized entries, and the weekly insight sends 30 days of totals and your top payee. • Payee and category names are turned into vectors that help match similar merchants. Only the names are sent. Anthropic and OpenAI say they do not use API data to train their models by default. They delete it within 30 days, unless they must keep it longer to stop abuse or to follow the law. OpenRouter says it does not store prompts or replies unless the customer turns that on, though it may sample a few prompts to sort them by topic. It lists TypeSafe, whose model answers our reconcile questions, as keeping no data and not training on it. We keep short excerpts of AI requests and replies in Langfuse to check quality and cost. Langfuse processes them only to provide its service to us. Nothing is added to your ledger until you accept it.
Data outside Japan
Our database and files are stored on Supabase servers in Tokyo, Japan. Supabase, the company that runs those servers, is based in Singapore. Anthropic, OpenAI, OpenRouter, Langfuse, Sentry, Expo, Stripe and RevenueCat are US companies or keep data in the United States, so data you send through their features may be handled there. Sentry stores our crash reports in the United States. PowerSync syncs your ledger through its servers in the United States (Amazon Web Services, Virginia). OpenRouter passes reconcile decisions to the AI model provider it routes them to. Langfuse keeps AI monitoring excerpts in the United States (Amazon Web Services, Oregon). Apple and Google may also handle data outside Japan. The United States has no single national privacy law like Japan's. Protection comes from federal laws for specific sectors and from state laws such as California's. Japan's Personal Information Protection Commission summarizes the US system at https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/ Each provider handles data under its business or API terms with us. Ask us for details of any provider, where it handles data, and the safeguards it uses.
How we protect it
• Data is encrypted in transit and encrypted while stored in the database. • The ledger copy on your phone sits in an encrypted database, and sign-in tokens sit in the phone's secure storage. • Database rules let only members of a household read its rows. Receipt and import files are in private storage. • Crash reports remove payees, amounts, notes and statement text before they are sent. • We check the privacy rules of the countries where our providers handle data, and take them into account when we choose and use those providers.
How long we keep it
• Your account, ledger and files: until you delete them or your account. • Account deletion: 14 days after you ask, unless you cancel first. • AI providers: Anthropic and OpenAI keep API data for up to 30 days (see above). • Crash reports, AI monitoring excerpts and bug reports: kept for a limited time, then deleted. • Purchase records: as long as tax and accounting law requires.
Export and delete
Export the ledger as CSV or QIF from Settings → Data & backup. Delete your account from the bottom of Settings, or at https://kensaur.us/yen-yen/account/delete. Deletion waits 14 days, and you can cancel before then. When it runs, a Stripe subscription for a household you own is cancelled. It does not cancel an Apple or Google subscription, or a Stripe subscription you pay for someone else's household, so cancel those with the store too.
Your rights
You can ask us to: • show you the personal data we hold about you, and how we used and shared it; • correct it; • stop using it, or delete it; • give you a copy in a format you can reuse; • tell you more about the providers outside Japan and their safeguards. You can do most of this in the app. For anything else, email kensaurus@gmail.com from the address on your account. We may need to confirm it is you. We reply as soon as we can, and within one month at the latest. If you are unhappy with our answer, you can complain to Japan's Personal Information Protection Commission (ppc.go.jp) or, in the EU or UK, to your local data protection authority.
Children
yen-yen is made for adults who manage a household budget. You must be 16 or older to use it, and we don't knowingly collect data from anyone younger. If you think someone under 16 has given us data, email us and we will delete it.
Changes
When we change this policy, we update the date at the top. If a change is significant, we tell you in the app or by email before it takes effect. This policy is written in English. If a translation differs, the English text applies.
Contact
Email us at kensaurus@gmail.com. A real person reads every message, usually within a day or two.