What Kivo holds, and what happens to it

What is stored

• Account: your name, email address, area and currency. The password is stored as a scrypt hash with a per-account salt, so the original is never held.
• Kivo Money: expense date, place, category, amount and note, plus your monthly budget limits.
• Kivo School: course names, coursework titles, kinds, due dates, statuses and scores you record.
• Kivo Commute: route names, travel mode, baseline minutes, preparation minutes, and the start and destination. Start and destination are encrypted at rest with AES-256-GCM under a key held in the server environment.
• Kivo Life: task titles, due dates, priorities, statuses and any link to coursework.
• Kivo Local: posts filed for an area. These are visible to every account with that area, and posts you file carry an account-submission label. The weather and the headlines on that page are fetched live and stored nowhere.
• Sessions: a SHA-256 digest of your session token and its expiry. The token itself exists only in the cookie in your browser.
• Location: nothing is stored as a coordinate. When you press "Use my location", the browser asks your permission, the coordinate is rounded to about 11 metres and sent to Kivo's own server, which looks up a place name and returns it for you to accept or edit. What gets saved is the text left in the field. The lookup runs against OpenStreetMap's Nominatim service, which sees the rounded coordinate and this server's address, never your account. An operator can switch the lookup off entirely, and the control then fills the field with the coordinate.

How it is protected

• Every query is scoped to your user id in SQL, so another account's rows are unreachable.
• Writes go through a server-side schema that drops fields it does not name.
• The session cookie is HttpOnly, SameSite=Lax, and Secure in production.
• Responses carry a nonce-based Content-Security-Policy, HSTS, and nosniff headers.
• Sign-in, sign-up, support, password changes and local posting are rate limited, and the public forms carry a signed stamp plus a honeypot field.
• Changing your password requires the current one, and signs out every other device on the account.

Services Kivo calls on your behalf

These calls are made by the server, never by your browser, and each one carries your area name or a rounded coordinate — never your account, your email, or anything you have recorded in the five services.

• Open-Meteo for current weather, and OpenStreetMap to turn your area name into the coordinate it needs. Refreshed every ten minutes.
• Rappler's public feed and a Google News search for your area, which is how headlines from ABS-CBN, the Inquirer and others arrive. Kivo shows the headline, the publisher and the time, and links to the publisher. Refreshed every fifteen minutes.
• OpenStreetMap again when you press "Use my location", with the coordinate rounded to about 11 metres first.

None of these responses are written to the database. Each is held in a short-lived cache and re-fetched when it expires.

Cookies

Kivo sets one cookie, which keeps you signed in. Optional analytics cookies stay off until you accept them in the banner, and declining takes the same single click as accepting. Campaign parameters in a landing URL are held in session storage for the length of the visit and attached to a sign-up or support message so a referral can be traced.

Deletion and retention

Records stay until you delete them; deleting a record removes it immediately, and the home brief recomputes on the next page load. Your password can be changed at any time from the account page. For account deletion, use the contact support button on any page and choose the data topic. Deleting the account removes the account row and, through the database's cascade rules, every expense, budget, course, coursework item, task, route and session tied to it.