Privacy at Otoku

Last updated 13 August 2026. This notice describes what Otoku actually does today, not what it is planned to do. Where something is not built yet, it says so.

The short version

Otoku holds what you type into it: an email address, a name, and the expenses you log. There is no advertising, no tracking, no analytics of any kind, and nothing about you is sold or shared with anyone outside the handful of suppliers listed below that are needed to run the service. There is no bank connection — Otoku never sees an account number, a card, or a transaction feed.

Who we are

Otoku is operated from Singapore. A copy of your data and deletion of your account are both things you can do yourself, in the app, without asking us — see Your rights. For anything else in this notice — a question, a correction, or something the download does not cover — write to otoku@fluffycornie.com and we will handle it ourselves.

What we store

Everything below is something you gave us or something you did in the app.

Your account. Your email address. If you sign in with Google, we also receive the name and profile picture on your Google account, and store the name as your display name and the picture’s address. If you sign in with a code instead, your display name starts as the part of your email before the @, and you can change it.
Settings. Your language and your timezone. The app reads your device’s timezone and language once, on first load, and saves them — the timezone decides when your day ends, which is what a streak is counted in.
Your ledger. Each expense you log: the amount, the date, the category, and — if you fill them in — a note, a merchant name and tags. Whether you marked it private. Which household it belongs to and who paid.
Your household. The household you are in, if you are in one — its name, who else is in it, any nickname you go by there, invitations you created, and any guardian relationship you are part of. Categories are the same nine for everybody and belong to no household.
The game. Your XP, streak (including which days you logged on), level, badges, creatures and Kura balance; your budgets; your savings goals, their names and amounts and any note on a contribution.
Notices. The notifications in your list, including ones about you that were sent to someone else.

Two fields exist in the database and are never filled in: birth year and a minor flag. Nothing in the product asks for your age or writes either of them — see Age, because it has a consequence.

What we do not collect

No bank or card details. No phone number. No address. No GPS or precise location. No advertising or device identifiers. No behavioural analytics — Otoku has no analytics of any kind: no tracking pixel, no product-analytics vendor, no event pipeline, and nothing in the app measures what you tap. No error-reporting service either. The app’s own security policy is the proof rather than the promise: the browser is permitted to talk to Otoku and to our database provider and to nothing else, so a third-party tracker could not load even if someone added one by mistake. We also switch off the browser feature that would let this site become a signal in an advertising interest profile.

Two honest qualifications. Your timezone and language are read from your device and saved, which narrows down roughly where in the world you are — the timezone is what decides when your day ends, and a streak cannot be counted without it. And like every website, our hosting and sign-in providers keep ordinary server logs, which include IP addresses. Otoku itself writes no IP address, no browser identifier and no device fingerprint into its own database.

Why we use it

To sign you in and keep you signed in.
To show you your own ledger, totals, reports and progress.
To show a household what it agreed to share, and a guardian what a dependent agreed to.
To send you the sign-in code you asked for, and to tell you when something happens that concerns you.
To keep the service secure and to fix it when it breaks.

We do not use your data to build a profile of you, to target advertising, or to make any automated decision that has an effect on you.

What other people in your household can see

A household is a shared ledger, so the people in it see the entries in it: the amount, the date and the category of what you logged. Mark an entry private and the note, the merchant, the category and the tags are hidden from everyone else. Be clear about what private does not hide: the amount, the date and the fact that it was you are still visible, and the amount still counts toward the household total, because a total with a hole in it is not a total. Private hides what you spent it on, not that you spent. The hiding happens in the database rather than in the screen drawing it, so there is no version of the app that forgets to do it.

A guardian is someone you have accepted, in a specific household. They can see your spending in that household, your reports, your streak and your category creatures. They cannot see the note, merchant or category of anything you marked private, and they cannot write anything on your behalf — there is no path in the product by which a guardian edits your ledger.

You can always see who watches you. Nothing in Otoku can hide a guardian relationship from the person it is about, and a notice sent about you is readable by you wherever it was delivered. That is a rule the database enforces, not a setting.

Who else handles it

Otoku is a small product and uses a small number of suppliers. They process your data on our instructions and for no purpose of their own.

Supabase — the database and the sign-in system. Everything listed above is stored here.
Vercel — hosting. Every page you load and every action you take passes through their servers, and they keep ordinary request logs.
Resend — email delivery. They handle the messages we send you: your sign-in code, and the weekly summary described below.
Google — only if you choose to sign in with Google. Then Google knows you signed in to Otoku, and sends us your email address, name and profile picture. Nothing is sent to Google if you use an email code instead.

Email we send

There is no marketing email and no mailing list. There is nothing to unsubscribe from, because you were never subscribed to anything.

We send you a six-digit code when you ask to sign in. It arrives from our email provider and is valid for a short time and one use only.

Otoku also sends a guardian a weekly summary of a dependent’s spending by email: the dependent’s name, the household, the week’s total, the largest few categories, the change on the week before, and how many days were logged. It carries no individual entries and no notes. When one is sent, the dependent gets a notice in their own list saying so, naming the guardian it went to — a summary about you is never sent without you being told.

Cookies and storage

Otoku sets one kind of cookie: the one that keeps you signed in, set by our sign-in provider on our own domain. It holds your session, it is strictly necessary — without it you would be signed out on every page — and it is not used for anything else. It is long-lived by design, so that you are not asked to sign in again every week. During a Google sign-in a second, short-lived cookie carries the one-time value that completes the exchange. The app also remembers your light/dark preference in your browser’s own storage, which never leaves your device.

There are no advertising cookies, no analytics cookies and no third-party cookies of any kind, which is why there is no consent banner: there is nothing here to consent to. Signing out clears the sign-in cookie.

Where your data is

Otoku’s database and the servers that run the app are in Singapore, and that is a deliberate choice rather than a default. Two things cross a border anyway, and we would rather name them than imply otherwise: email leaves the region when it is delivered, and the images, fonts and scripts that make up the app are served from a content network with locations worldwide. If you sign in with Google, that exchange happens on Google’s own infrastructure.

Otoku moved to Singapore in August 2026 from a database in Mumbai, India. Until the old database is confirmed destroyed, we cannot honestly tell you that no copy of earlier data remains there, so we are telling you that instead.

How long we keep it

Your account and ledger: for as long as you have an account. Otoku does not expire accounts or delete inactive ones.
A deleted expense: you can restore it for 30 days. After that it cannot be restored or edited by anyone, and it is no longer shown.
Notifications, and your XP and streak history: kept for the life of the account. Nothing prunes them.
Records of an administrator looking at an account: kept indefinitely, on purpose — see below.

Being straight about one gap: an expense you deleted more than 30 days ago is hidden and frozen, but the row is still on disk. The job that erases those rows for good exists and is not yet scheduled to run, so we cannot claim they are gone at 90 days. When it runs, they are.

When a person at Otoku looks at an account

The people who build Otoku can see what you have spent, including the notes you wrote on it. Not through a special screen and not routinely — through the same database the app reads — but the honest answer to “could someone there look?” is yes. What we can promise is not that it never happens; it is that it cannot happen quietly.

Support and operations work is done from aggregate figures wherever possible. Looking at a single person’s ledger requires a written reason, and the tool records that reason, the account, the time and who asked before the query runs. Those records cannot be edited or deleted by anybody, including by us, and they deliberately survive the deletion of the account they name — an audit record that a deletion can erase is not an audit record. They contain your account’s internal identifier and the reason text, and never your expenses.

Your rights, and how to use them today

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask how it has been disclosed, or withdraw your consent. Two of those you can do yourself, in the app, without asking us at all — they are under You in the app, in the Your data section.

Download your data. Two buttons, JSON or CSV. The file is built while you wait and downloads straight to your device — it is not emailed to you, there is no link to expire, and nobody else can fetch it, because it is your signed-in session that gets it. Before you download you can ask what is in it and see a count of each kind of thing.
Delete your account. Under the same section. You type your email address to confirm, and the screen sets out exactly what happens — including the one thing that is kept — before you commit. It is immediate; see below.

The download holds what the app’s own database has about you: your profile and settings, your households and memberships, the entries you paid for, your budgets, savings goals and contributions, your creatures, XP, streak and badges, your guardianships, the invites you made, your activity and your notices.

Being straight about the edges of it, because a file that quietly leaves something out reads exactly like a complete one. It contains your entries — spending other members of a household paid for is theirs, not yours, and is not in it. It cannot reach a household you have already left, because your access to that household ended when you left. It does not include the invite codes you created, which are live credentials and do not belong in a downloaded file. And it comes from the app’s database, so it does not include your sign-in record, the access records described above, or our suppliers’ server logs. For any of those, or to correct something, or to ask how your data has been disclosed, write to otoku@fluffycornie.com — we will answer within 30 days, and tell you sooner if it will take longer.

You can change your display name, language and timezone yourself at any time in the app, and you can leave a household without deleting your account.

What deleting your account does

Deletion is immediate and there is no grace period — there is nothing to cancel afterwards, and no window in which we still hold it. Your login, profile, avatar, settings, game progress, badges, creatures, budgets, savings goals, guardianships and notifications are removed, and there is no way to sign in as you afterwards. If you were the only person in a household, that household and everything in it goes too. Signing up again with the same email address gives you a new, empty account; nothing comes back.

The screen that does it offers you the download first, and shows you — for your account, not in general — which of your entries would be kept and which would go, before you type anything.

One thing is kept, and only in one case. If you logged spending in a household you shared with other people, the figures of those entries stay — the amount, the date and the category — because they are also the household’s own record and removing them would silently change totals other people rely on. Everything you wrote on them is erased: the note, the merchant and the tags. Your name is replaced with “Someone who has left”, and what remains is not an account and cannot be signed in to. When the last other member of that household leaves, those rows go too.

If you are the last guardian of a managed account, deleting yours deletes that account as well. Managed accounts exist in the database and are not offered in the product today, so this cannot currently arise — it is here because the rule is real and would apply the day they do.

Age

Otoku is built for families and expects teenagers to use it. Every account is held by its own person with their own email — there are no child accounts operated by a parent.

Otoku does not ask your age and cannot tell how old you are. We do not knowingly collect data from anyone under 13. If you are under 18, please use Otoku with a parent or guardian’s knowledge. If you believe a child under 13 has an account, write to otoku@fluffycornie.com and we will delete it.

We say “cannot tell” literally: nothing in the product asks for a birth date and nothing sets the age flag the database has for it. So we apply the stricter handling to every account, because there is no way for the app to know who a minor is: no third-party analytics for anyone, no marketing email for anyone, no public sharing of anyone’s activity, and deletion carried out immediately rather than after a waiting period. That is what we do rather than what it satisfies — the minimum age for an account is still being decided.

Security

Traffic is encrypted in transit and data is encrypted at rest by our database provider. There are no passwords to steal — sign-in is a one-time code by email, or Google. Every table in the database denies access by default and is opened only by an explicit rule, and those rules are tested from an attacker’s seat rather than assumed.

No system is perfectly safe. If something happens that puts your data at significant risk, we will tell you and the relevant authority.

Which law applies

Otoku is operated from Singapore and its data is held there, so Singapore’s Personal Data Protection Act 2012 is the framework this notice is written to. If you are in a country whose own law gives you more, we will not use our location as a reason to give you less — write to us and say so.

Otoku’s launch market has not been fixed, and much of the product is written with Malaysian users in mind. If Otoku establishes itself in Malaysia or moves any processing there, Malaysia’s Personal Data Protection Act 2010 applies as well, and this notice must then also be published in Bahasa Malaysia. It has not been translated, because a machine translation of a legal notice is a liability of its own.

Changes

If this notice changes in a way that matters, we will say so in the app before it takes effect. The date at the top always tells you which version you are reading.