We use your family’s data only to operate KUMBA.

Last updated: August 7, 2026

KUMBA’s approach

KUMBA is a family financial literacy app, not a bank, wallet, or payment provider. It does not store or transfer real money. It shows no ads, reads no advertising identifier, collects no location data, and does not track users across other apps or websites.

Parent and child profile data

For a parent account, we may process a display name, email address, and secure session data. For a child profile, we may process a nickname, birth year, and a login PIN created by the parent. A real name is not required. We do not ask a child for an email address, phone number, home address, school, location, or government identifier. Optional birthday information is processed with separate parental consent and can be removed at any time.

In-app records

Goals, savings and spending records, tasks, allowance plans, XP, streaks, and badges are stored to provide the family experience. Profile and goal photos selected by the user remain on the device and are not uploaded to KUMBA servers. Amounts shown in the app are tracking records only.

Service providers

Data is not sold. KUMBA may use Supabase for authentication and database services, RevenueCat for subscription verification, Apple App Store for payments, email delivery infrastructure for optional family reports, and Cloudflare for hosting withkumba.com and its early access database. These providers act as data processors and your data may be processed in the countries where their servers are located; international transfers are limited to what is necessary to provide the service. KUMBA never sees your card details. Monthly family reports are off by default and are sent only when a parent explicitly enables them.

Early access website

When you submit the early access form, your email address, consent time, consent version, adult/guardian declaration, and form source are stored for the invitation process. The site may record limited, aggregated usage events without personal information or a persistent device identifier; it does not use advertising tracking cookies. To block abuse and automated request floods, your IP address is processed temporarily by Cloudflare and by the site’s rate limit counter; it is not stored permanently.

Cookies

The site uses strictly necessary and functional cookies only. “kumba_locale” remembers your language choice and is kept for one year. “__cf_bm” is set by Cloudflare for bot protection and expires after roughly 30 minutes. No advertising, profiling, or cross-site tracking cookies are used.

Retention, security, and deletion

Data is encrypted in transit and families can access only their own records. An account and its linked child profiles can be deleted from the account deletion area in the app. Early access email records are deleted once the invitation process is complete, or at the latest after 24 months, and the site’s aggregated usage events are deleted after 90 days. Except for limited payment records that must be retained by law, data is deleted or anonymized when it is no longer needed for the service.

Your rights and contact

To access or correct your data, opt out of reports or early access messages, or request deletion, email appkumba@gmail.com. Users in Türkiye may exercise their information, correction, deletion, and objection rights under the KVKK.