Privacy Policy

Who we are

Celepio is operated by PT Anym Network Indonesia ("we"). We are the data controller for the Celepio web and Android app under Indonesia's Personal Data Protection Law (Law No. 27 of 2022).

Data we store

• Account: nickname, email address, a hashed password (bcrypt), and a profile photo if you add or choose one.
• What you record: habits, moods, notes, transactions, bills, savings, assets, and books.
• Connected email: message metadata (sender, recipients, subject, date, labels) and a short snippet. Full email bodies are not stored permanently; they are read temporarily during sync to find bills, transactions, and subscriptions.
• Email credentials: Google OAuth tokens or IMAP passwords, encrypted with AES-256-GCM and only decrypted by the server during sync.
• Technical data: IP address and access times for security and sign-in throttling, and Android notification tokens if you allow notifications.

How we use data

Data is only used to run the features you choose: daily summaries, streaks, finance from email, reminders, and account security. We do not sell data, use it for ads, or train AI models on it.

Google user data (Gmail)

Gmail access is requested separately from sign-in and limited to the permission you pick: read only, modify (for example marking as read), or send. Celepio does not change your email without your action.

Celepio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is never used for ads, never sold, and never read by humans except with your consent for support, for security, or when required by law.

AI processing

When an email cannot be recognised by regular rules, an excerpt is sent to an AI model provider to extract amounts, dates, and biller names. Book cover photos may also be read by AI when the barcode cannot be scanned. The provider processes the data only for that request.

Third parties

• Google: sign-in, Gmail API, Google Books.
• An OpenAI-compatible AI model provider: email extraction and cover scanning.
• Open Library, CoinGecko, Yahoo Finance, and Frankfurter (Bank Indonesia rates): receive only ISBNs or asset symbols, never personal data.
• Expo and Firebase Cloud Messaging: Android notifications.
• A transactional email provider: verification codes.
• Sentry: error reports without request bodies, passwords, or email content.
• Our server (VPS) provider, and encrypted off-site backup storage.

Storage and security

All traffic uses HTTPS. Email credentials are encrypted, passwords are hashed, and server access is restricted. Daily database backups are kept for 14 days. If a breach affects you, we will notify you within 72 hours as required by law.

Your rights

• View and edit your data in the app.
• Export all data as JSON from Settings, Data and account.
• Disconnect an email account at any time; its copies in Celepio are deleted.
• Delete your account and all data from Settings (web or Android). Deletion is immediate in the main database and leaves backups within 14 days. Gmail access is revoked at Google.
• Contact us at halo@celepio.com.

Children

Celepio is not intended for children under 13. Users under 18 should use Celepio with a parent or guardian's consent.

Changes

When this policy changes, the effective date above is updated and material changes are announced in the app before they apply.

Contact

PT Anym Network Indonesia. Email: halo@celepio.com.