Runtut

Legal

Privacy Policy

Last updated: November 3, 2026

Runtut keeps your financial journal on your device by default. Data reaches our servers only when you sign in, turn on Cloud Sync, or use a feature that needs it, such as place search or Cloud Scan. We process Personal Data in accordance with Indonesia's Personal Data Protection Law (Law Number 27 of 2022). Our servers are in Germany and Singapore, and optional analytics are processed in the United States. This Policy sets out exactly what we collect, why, where it goes, and your rights.

1. Scope and Personal Data Controller

This Privacy Policy explains how Khouw Devin Nathanael, an individual domiciled in Bandung, Indonesia ("Runtut", "we", "us" or "our"), collects, uses, stores, transfers, discloses and otherwise processes Personal Data in connection with the Runtut mobile application, the website at https://runtut.app and any related services (together, the "Service").

For the purposes of Law of the Republic of Indonesia Number 27 of 2022 on Personal Data Protection (the "PDP Law"), we act as the Personal Data Controller (Pengendali Data Pribadi) for the Personal Data described in this Policy. We also process Personal Data in accordance with Government Regulation Number 71 of 2019 on the Operation of Electronic Systems and Transactions and other applicable laws and regulations of the Republic of Indonesia.

Capitalised terms not defined in this Policy have the meaning given to them in the PDP Law. This Policy forms part of, and should be read together with, our Terms of Service.

2. Personal Data We Process

(a) Journal data stored on your device

Runtut is offline-first. Your transactions, categories, pockets, installments, subscriptions, reports, notes, attached photos and place details are stored in a local database on your device. This data is not transmitted to us unless you enable Cloud Sync or use a feature described below that requires it. We have no access to data that remains only on your device.

(b) Account data

When you sign in with Google, we receive and store your name, email address, profile photo and a unique account identifier issued by Google and Firebase Authentication. If you upload your own profile photo, we store that photo. We also store your account settings, such as your preferred currency, default category and pocket, and your notification and analytics choices, so they follow you across devices.

(c) Cloud Sync data (Premium)

If you enable Cloud Sync, the journal data described in paragraph (a) is transmitted to and stored on our servers so it can be synchronised across your devices. This includes amounts, currencies, dates, titles, descriptions, item details, categories, pockets, the name and coordinates of any place you attached, photos attached to transactions, and technical sync metadata such as timestamps and record identifiers.

(d) Specific Personal Data

Personal financial data is a category of Specific Personal Data under Article 4(2) of the PDP Law. Where we process your journal data through Cloud Sync, we treat it as Specific Personal Data and apply the safeguards described in Section 9.

(e) Location data

Only when you search for or attach a place to a transaction, and only after you grant location permission, the app reads your device's location and sends it, together with your search text, to our server and on to the Google Maps Platform to return nearby places. If you attach a place, its name, identifier and coordinates are saved with that transaction. We do not track your location in the background.

(f) Receipt images

  • Local Scan: processed entirely on your device using Google ML Kit. The image is not uploaded.
  • Cloud Scan (Premium): the image is sent through our server to the Google Gemini API, which returns the extracted details (such as merchant, items and amounts). We do not store the receipt image on our servers. The extracted details are saved on your device.

(g) Purchase data

When you buy a Premium subscription through Google Play, we receive the purchase token, product identifier, order identifier and subscription status needed to verify and manage your subscription. We do not receive your payment card or bank details, which are handled by Google.

(h) Notification identifiers

When you allow notifications, we store your Firebase installation identifier and the notification topics you are subscribed to, so we can deliver notifications to your device.

(i) Usage, diagnostic and session replay data (optional)

If you choose to share usage data, the app sends the following to PostHog under a random identifier that is not linked to your name or email address: app events and screen views, device model, operating system, app version, error reports, and session recordings of your interactions with the app in which all text and images are masked. Your journal entries are not included.

(j) Technical and log data

When the app or website communicates with our servers, we process your IP address, request timestamps, device and app version, and error logs to operate, secure and troubleshoot the Service.

(k) Communications

If you contact us, we process your email address and the content of your message to respond to you.

3. Purposes and Legal Bases of Processing

We process Personal Data only on the legal bases set out in Article 20(2) of the PDP Law:

  • Performance of an agreement (Article 20(2)(b)): to create and manage your account, provide Cloud Sync and file storage, verify and manage your Premium subscription, publish reports you choose to share, and provide support.
  • Explicit consent (Article 20(2)(a)): to process location data for place search, to send receipt images to Cloud Scan, to send push notifications, to collect usage, diagnostic and session replay data in the app, and to run analytics on our website.
  • Legitimate interests (Article 20(2)(f)): to keep the Service secure, prevent fraud and abuse, and diagnose server errors, balanced against your rights and interests.
  • Legal obligation (Article 20(2)(c)): to comply with applicable laws, regulations and lawful requests from competent authorities.

We do not sell your Personal Data, use it for advertising, or make decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. Consent and Withdrawal

Where we rely on consent, we ask for it before the processing starts, for a specific purpose, at the point where it is needed. You may withdraw consent at any time, in accordance with Article 9 of the PDP Law:

  • Usage data and session replay: turn off sharing in the app's Settings.
  • Notifications: disable individual channels or all notifications in Settings or your device settings.
  • Location: revoke location permission in your device settings.
  • Cloud Scan: use Local Scan or enter details manually.
  • Website analytics: open Cookie settings in the website footer.

Withdrawing consent stops the related processing from that point and does not affect processing carried out before the withdrawal.

5. Disclosure to Third Parties

We engage the following service providers as Personal Data Processors (Prosesor Data Pribadi). They process Personal Data only on our instructions and under their data processing terms:

  • Neon (Germany): database hosting for account data, settings and Cloud Sync data.
  • netcup (Germany): servers running our application programming interface and cache.
  • Amazon Web Services (Singapore): storage of transaction photos and profile photos in Amazon S3.
  • Amazon CloudFront (global edge locations): delivery of stored files to your device.
  • Google (global, including the United States): Google Sign-In and Firebase Authentication, Firebase Cloud Messaging, Google Play Billing, Google Maps Platform (Places) and the Gemini API.
  • PostHog (United States): product analytics, error tracking and session replay in the app, only if you have opted in.
  • Vercel (United States and global edge locations): hosting of this website and, if you consent, website analytics.

We may also disclose Personal Data:

  • at your direction: when you create a Shareable Report, the transactions, categories, pockets and item details in that report can be viewed by anyone who has the link until you remove it;
  • where required by law, a court order or a lawful request from a competent authority of the Republic of Indonesia; and
  • to a successor in the event of a merger, acquisition or transfer of the Service, subject to the protections in this Policy and notice to you as required by Article 48 of the PDP Law.

6. Transfer of Personal Data Outside Indonesia

Our infrastructure is located outside the Republic of Indonesia. When you use features that send data to our servers or providers, your Personal Data is transferred to and stored in:

  • Germany: account data, settings and Cloud Sync data (Neon, netcup).
  • Singapore: transaction photos and profile photos (Amazon Web Services).
  • United States: usage, diagnostic and session replay data if you opt in (PostHog), website hosting and analytics (Vercel), and data processed by Google services.
  • Other countries: where Amazon CloudFront, Google and Vercel operate infrastructure used to deliver the Service.

In accordance with Article 56 of the PDP Law, before transferring Personal Data we ensure that:

  1. the destination country provides a level of personal data protection equal to or higher than the PDP Law. We consider this to be the case for Germany, which is bound by the EU General Data Protection Regulation, and Singapore, which is bound by its Personal Data Protection Act 2012;
  2. where that is not the case, adequate and binding safeguards are in place, namely the data processing agreements and standard contractual clauses offered by our providers; and
  3. where neither applies, we obtain your consent, which you give by enabling the relevant feature after being informed of the transfer in this Policy.

Journal data that stays only on your device is never transferred.

7. Cookies on Our Website

Our website uses two categories of cookies and similar storage:

  • Strictly necessary: remember your cookie choice and display preferences such as light or dark mode. These are required for the website to work and do not need consent.
  • Analytics (optional): if you consent, Vercel Analytics records anonymous page views, referrers, country and device type to help us improve the website. It is not used to identify you or for advertising.

Analytics stays off until you accept it. Rejecting is as easy as accepting, and you can change your choice at any time through Cookie settings in the website footer. Your choice is stored for 12 months, after which we will ask again.

8. Retention and Deletion

  • Data on your device: kept until you delete it, clear the app's data or uninstall the app.
  • Account and Cloud Sync data: kept while your account is active. Records you move to the trash are permanently deleted from our servers 30 days later.
  • Account deletion: when you request deletion, your account is scheduled for erasure. You may cancel within 14 days by signing in again. After 14 days, your account data, Cloud Sync data, transaction photos and profile photo are permanently erased.
  • Backups: residual copies may remain in backups maintained by our database provider for a limited period before being overwritten. Backups are not used for any other purpose.
  • Logs: server logs are kept for a short period for security and troubleshooting and then deleted.
  • Usage data: kept by PostHog according to its retention settings. You can ask us to delete it.
  • Cloud Scan images: not stored by us; Google processes them under its Gemini API terms.

We may retain Personal Data for longer where required by law, and only for as long as that requirement applies.

9. Security and Data Breach Notification

We implement technical and organisational measures appropriate to the risk, as required by Articles 35 to 39 of the PDP Law, including:

  • encryption of data in transit using TLS;
  • access controls limiting server access to what is necessary to run the Service;
  • private file storage, with files delivered only through short-lived signed links; and
  • encryption at rest provided by our hosting providers.

Runtut does not use end-to-end encryption. Data stored on our servers can technically be accessed by us, and is accessed only when necessary to provide support you request, maintain security, or comply with the law.

No method of transmission or storage is completely secure. If a personal data protection failure occurs, we will notify you and the competent authority in writing no later than 3 x 24 hours after we become aware of it, as required by Article 46 of the PDP Law.

10. Your Rights

Under the PDP Law, you have the right to:

  • obtain information about the identity of the controller, the legal basis, purpose and use of your Personal Data (Article 5);
  • complete, update or correct your Personal Data (Article 6);
  • access and obtain a copy of your Personal Data (Article 7);
  • end the processing of, delete or destroy your Personal Data (Article 8);
  • withdraw your consent (Article 9);
  • object to decisions based solely on automated processing (Article 10);
  • delay or restrict the processing of your Personal Data (Article 11);
  • sue and receive compensation for violations of the processing of your Personal Data (Article 12); and
  • obtain and use your Personal Data in a commonly used, machine readable format, and transmit it to another controller (Article 13).

You can exercise many of these rights directly in the app (edit your profile, export a backup, change your settings), on the Delete Account page, or by emailing support@runtut.app. We may ask you to verify your identity before acting on a request, and we will respond within the time limits set by the PDP Law. Some rights are subject to the exceptions in Article 15 of the PDP Law.

If you are not satisfied with our response, you may lodge a complaint with the personal data protection institution established under the PDP Law or with the Ministry of Communication and Digital Affairs of the Republic of Indonesia.

11. Children

The Service is intended for persons aged 18 years or older. We do not knowingly process the Personal Data of children. Processing a child's Personal Data requires the consent of a parent or guardian under Article 25 of the PDP Law, which we do not collect. If you believe a child has provided us with Personal Data, contact us and we will delete it.

12. Third-Party Services and Links

Third-party services used through the Service, including Google Sign-In and Google Play, are also governed by their own terms and privacy policies, such as the Google Privacy Policy, the PostHog Privacy Policy and the Vercel Privacy Policy. We are not responsible for the practices of websites or services we do not control.

13. Changes to This Policy

We may update this Policy to reflect changes to the Service or the law. We will post the updated Policy on this page and revise the "Last updated" date. If a change materially affects how we process your Personal Data, we will notify you through the app or by email before it takes effect and, where required, ask for your consent again.

14. Contact

For questions about this Policy or to exercise your rights, contact the Personal Data Controller:

This Policy is governed by the laws of the Republic of Indonesia.