Privacy Policy

Effective September 7, 2026 · KOINI Global, LLC (“KŌINI”, “we”, “us”) is the data controller for KŌINIbōōks

The short version. We collect the least we can: your email to sign you in, the public wallet addresses and exchange exports you add, the decisions you record about them, and the calculations we make from both. We never ask for private keys or exchange API secrets. We do not sell your data and we show no ads. You can delete a client file, or your whole account, in one step.

1. What we collect

Data	Why	Kept
Email address	Sign-in (one-time codes), invitations you send or accept, service and security notices	Until you delete your account
Public wallet addresses and the names you give accounts and groups	To read the on-chain history the books are built from	Until you delete the account or client file
Evidence rows: transactions read from chains, files you upload (Coinbase exports, CSVs), manual entries — including the raw provider record for each	The books themselves; evidence is kept unedited so every figure can be traced	Until you delete the client file
Your assertions: categories, transfer matches, funding sources, cost-basis overrides and reasons, lot selections, rules, notes, period closes, adjustments	They are your books; the audit log records every change (who, what, when, old and new value)	Until you delete the client file
Calculations: lots, disposals, income events, closing snapshots, reports you generate	Derived from the above on request	Until you delete the client file
Country, reporting currency and cost-basis method you select	To apply the right calendar, threshold and currency	With the client file
People you invite to a client file (email, role, acceptance)	So a CPA can work in the same books with you	Until you remove them or delete the file
Technical logs (IP address, browser, request timing, errors)	Security, rate limiting, keeping the service working	Rolling 30 days, longer only to investigate abuse

We do not collect private keys, seed phrases, exchange API keys or passwords, government identifiers or payment card numbers, and nobody acting for KŌINI will ever ask you for them.

2. How we use it

To provide the service: importing evidence, recording your assertions, computing lots and reports, and exporting them to you and the people you invite.
To keep the service secure and lawful: authentication, abuse prevention, and responding to valid legal requests.
To improve the service using aggregate, de-identified usage statistics.

We do not sell or rent personal data, we do not use it for advertising, and we do not use your books to build profiles of your wealth or trading for any purpose other than the service you asked for. No language model or automated classifier writes to your books; suggestions are drafts you accept or dismiss.

3. Who we share it with

Only processors needed to run the service, each bound by contract to use the data solely for that purpose:

Supabase — database and authentication (United States region).
Cloudflare — application servers and network security.
Blockchain data and price providers (Alchemy, Helius, Blockstream, DefiLlama, and the European Central Bank reference rates via Frankfurter) — they receive the public wallet address, token identifier or date being looked up, never your identity.
People you invite to a client file see that file's books, not your account.
Authorities, where the law requires it and after we have checked the request is valid.

4. Cookies and local storage

We use no advertising or tracking cookies. Your browser keeps a sign-in session in local storage so you stay signed in; it is removed when you sign out. We may use a privacy-respecting analytics tool that records page views without identifying you.

5. Security

Data is encrypted in transit and at rest. Your books are visible only to accepted members of the client file; the database enforces this, not just the application. Evidence rows and the audit log are append-only at the database level; closed periods cannot be changed in place. Access to production systems is restricted and audited.

6. Retention and deletion

You can delete a client file at any time from the app, which removes its accounts, evidence, books, calculations and audit log. To delete your entire account, email support@koini.io from your sign-in address; we confirm and complete deletion within 30 days, except for records we must keep by law. Backups are purged on their normal cycle.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to a supervisory authority. Every export in the app is also your data-portability export. Email support@koini.io to exercise any right; we answer within 30 days.

8. International transfers

We are a United States company and process data in the United States. Where data comes from the EEA, the UK or Switzerland, we rely on standard contractual clauses with our processors.

9. Children

The service is for adults. We do not knowingly collect data from anyone under 18.

10. Changes and contact

We will post changes here and, for material changes, notify you by email before they take effect. Questions: support@koini.io, KOINI Global, LLC.