What Kivo holds, and what happens to it

What is stored

• Account: your name, email address, area and currency. The password is stored as a scrypt hash with a per-account salt, so the original is never held.
• Kivo Money: expense date, place, category, amount and note, plus your monthly budget limits.
• Kivo School: course names, coursework titles, kinds, due dates, statuses and scores you record.
• Kivo Commute: route names, travel mode, baseline minutes, preparation minutes, and the start and destination. When a route is pinned on the map, its two coordinates are stored as well, so the route can be drawn again and measured along real roads. Addresses and coordinates are both encrypted at rest with AES-256-GCM under a key held in the server environment.
• Kivo Life: task titles, due dates, priorities, statuses and any link to coursework.
• Kivo Local: posts filed for an area. These are visible to every account with that area, and posts you file carry an account-submission label. The weather and the headlines on that page are fetched live and stored nowhere.
• Sessions: a SHA-256 digest of your session token and its expiry. The token itself exists only in the cookie in your browser.
• Email confirmation and password resets: a SHA-256 digest of the link token, its purpose, its expiry and whether it has been used. The link itself exists only in the email. Confirmation links last a day, reset links an hour, and each works once.
• Location: a coordinate is stored only for a route you pin on the map, and only encrypted. Nothing else keeps one. When you press "Use my location", the browser asks your permission, the coordinate is rounded to about 11 metres and sent to Kivo's own server, which looks up a place name and returns it for you to accept or edit. What gets saved is the text left in the field. The lookup runs against OpenStreetMap's Nominatim service, which sees the rounded coordinate and this server's address, never your account. An operator can switch the lookup off entirely, and the control then fills the field with the coordinate. Deleting a route deletes its coordinates with it.
• Notifications: turning them on stores one row per device — the address your browser's push service issued, and the two keys that encrypt what Kivo sends to it. The text is encrypted on Kivo's server before it leaves, so the push service relaying it (Google's, Mozilla's, Apple's) carries a sealed payload it cannot read and an address that names no account. Turning notifications off deletes the row and cancels the subscription in the browser. A device that stops accepting them is forgotten automatically.

How it is protected

• Every query is scoped to your user id in SQL, so another account's rows are unreachable.
• Writes go through a server-side schema that drops fields it does not name.
• The session cookie is HttpOnly, SameSite=Lax, and Secure in production.
• Responses carry a nonce-based Content-Security-Policy, HSTS, and nosniff headers.
• Sign-in, sign-up, support, password changes and local posting are rate limited, and the public forms carry a signed stamp plus a honeypot field.
• Changing your password requires the current one, and signs out every other device on the account.

Visitor log

Kivo records each page request: the time, the page, the IP address it came from, the country and city that address resolves to at the network edge, the browser's user agent, and the referring page. Signed-in requests also record which account made them.

• Why: to investigate abuse and to answer a lawful request. It is not used to profile readers, build an audience, or feed advertising, and it is never sold or shared.
• How long: thirty days, after which rows are deleted automatically.
• Who can read it: administrators of this Kivo instance only.
• What it does not do: Kivo does not attempt to identify whether an address belongs to a VPN. It flags a public Tor exit node and an obvious automated client, and leaves any further judgement to a person.

Requests for assets, scripts and API endpoints are not recorded — only pages.

Services Kivo calls on your behalf

These calls are made by the server, never by your browser, and each one carries your area name or a rounded coordinate — never your account, your email, or anything you have recorded in the five services.

• Open-Meteo for current weather, and OpenStreetMap to turn your area name into the coordinate it needs. Refreshed every ten minutes.
• Rappler's public feed and a Google News search for your area, which is how headlines from ABS-CBN, the Inquirer and others arrive. Kivo shows the headline, the publisher and the time, and links to the publisher. Refreshed every fifteen minutes.
• OpenStreetMap again when you press "Use my location", with the coordinate rounded to about 11 metres first.

None of these responses are written to the database. Each is held in a short-lived cache and re-fetched when it expires.

Cookies

Kivo sets one cookie, which keeps you signed in. Optional analytics cookies stay off until you accept them in the banner, and declining takes the same single click as accepting. Campaign parameters in a landing URL are held in session storage for the length of the visit and attached to a sign-up or support message so a referral can be traced.

Deletion and retention

Records stay until you delete them; deleting a record removes it immediately, and the home brief recomputes on the next page load. Your password can be changed at any time from the account page. For account deletion, use the contact support button on any page and choose the data topic. Deleting the account removes the account row and, through the database's cascade rules, every expense, budget, course, coursework item, task, route and session tied to it.