What we know about you

What you give us

• Your email address, to make an account.
• Your password, stored by Supabase, scrambled. When you set or change it, it passes through EKKO’s server on its way to Supabase. EKKO never stores it or writes it to a log.
• Your full name, a username, and your date of birth, which confirms you are 18 or over.
• If you add them: a profile photo, a line about you and where you’re from. Your profile page shows your username, photo, line about you and where you’re from, your saving record, your games and your friends, to anyone with the link, unless you make it private in Your account. The Security page says exactly what it shows.
• If you save them: how often you are paid and one payday, so EKKO can add up the regular payments due before your next pay.
• If you add them on the Budget page: things you are saving for - a name, how much and the day you need it by. EKKO works out what to put away each week. If you press Remove on a subscription there, EKKO remembers to leave it out.
• If you add them on the Budget page: things you owe, like Afterpay, IRD, a fine or a loan - what kind it is, a name, how much is left and, if you pay it off, how much and how often. Only you can see them. They are in your data download, and they go when your account is deleted. EKKO does not lend money and does not share this with anyone.
• Bills you added on the Budget page before 7 October 2026 - a name, how much, how often and the next day each one comes out - are still kept, and they are in your data download.

From your bank, only if you connect one

• Account names and types, like “Kiwibank Savings”, and the name of the bank each one is with.
• Account balances, updated when your bank sends new figures - usually once a day - and read when you open Home, Budget or Your bank, once a day for the reminder email, and at each weekly check. When you open Budget, EKKO asks your bank for new figures first.
• Your transactions: the shop or payer name, the amount, the date and the category. EKKO can read them through Akahu. Home shows you totals made from them: money in and money out each month, and where your money went in a month you pick, sorted by kind and by shop - each shop’s name and logo, how many times you paid there and the total. Money you sent to people shows by the words you typed when you paid, with how many times and the total. These are worked out each time you look and are not saved. Home also shows each of your accounts on its own tab, by the name your bank gives it, with its balance and its own money in and out. Loans and credit cards are not shown there. The Budget page shows what you are saving in your game this week, your next payday, who your regular pay comes from and about how much it is (like ACC or Work and Income), the bills and subscriptions due before it or on the day - each by name, how much and the day - and what is left until then. It also shows your subscriptions, with what each costs a month and the business’s logo from Akahu. It counts payments your bank and Akahu have named as a bill or a subscription, like a direct debit or a gym, and payments that repeat that they haven’t named, on a line of their own that you can remove. It does not ask you about any payment. The Budget page also shows your last four weeks as money in and money out a week, by kind and by shop, and the loan repayments your bank shows, with what is left on any loan or card account you connected. No screen lists your transactions one by one (a shop or person you paid only once shows that one amount, with no date), other than one small line on an invite page that adds up regular payments due before a payday you saved earlier, and the one-page budget you can download from the Budget page. That download is made when you press the button: EKKO reads every payment in your connected accounts over the last 30 days from your bank and sends them to your phone, which makes the page, the way a budgeting service asks for a bank statement. EKKO does not keep it and does not send it to anyone else. The weekly check uses them for one thing: money that moves in or out of your savings account after 5:30pm does not count for that week, so EKKO reads those transactions to leave that money out.

What we never collect

• Your bank login. Ever. You log in at your own bank, through Akahu.
• Card numbers, CVV codes or expiry dates.
• Your account numbers, or the name and address your bank holds for you. EKKO does not ask Akahu for them.
• Government ID numbers - IRD, passport, driver licence.

What using EKKO creates

• Your results each week, the history of your line, and the lifelines you have left.
• Your XP and rank.
• Your friends, your direct messages, the chat in any game you are in, and when you were last online, which only you and your friends can see.
• The balance recorded at each weekly check, which is what lets any result be explained, and the money above your line on the day a game starts.
• One bank total for each week your bank is connected: all your connected accounts added up, leaving out loans and credit cards. It is updated each time EKKO reads a new balance that week. It draws the savings line on Home. It holds no account names and no transactions.
• Your Discipline number, worked out from the weeks you hit, missed or were not checked, and what you saved in each week you hit, counted only up to the Beginner weekly amount. It never uses how much money you have in your bank. Only you see it, on Home. It is not a credit score, and EKKO never gives it or reports it to anyone.
• A scrambled form of your internet (IP) address, kept for between a minute and an hour, depending on what you asked for (most for a minute, a few minutes for changes to your account, and an hour for a download or a question about a result), only to stop anyone sending too many requests. It cannot be turned back into your address. EKKO’s bank connection server also counts requests, and when you are not signed in it counts them by your internet address itself, held in its memory for up to 15 minutes. EKKO never writes your address into its records or logs.

Cookies

Only the ones EKKO needs: the ones that keep you signed in, one that remembers which page to bring you back to while you confirm it’s you with Google (only for an account made with Google), and one that makes sure the bank connection you start is finished in the same browser. Those last two each last ten minutes. No advertising cookies and no tracking across other sites. Your own settings, like having seen the cookie message, are kept in your browser, not in a cookie.

Akahu is an open banking company from Aotearoa. EKKO uses its Enduring Connectivity service, which is read-only, and not Akahu Apply, which is for lenders. EKKO is not a lender. Because of that, Akahu does not calculate anything for EKKO.

When you connect, you log in at your own bank through Akahu. EKKO never receives, sees or stores your bank login. EKKO’s own formal accreditation is still in progress, and we will keep saying so until it is done.

Your bank data is not used to decide whether anyone can borrow. EKKO does not lend. If that ever changes, this page will change first, and EKKO will ask you on its own, separately, before your bank data is used for it. Saying no will change nothing in your games.

Akahu’s own privacy notice is at akahu.nz/privacy-notice.

• To run your account and the savings game.
• To read your savings balance each week and work out your result. Your target is the amount you chose - EKKO never works it out from your income or your spending.
• To show your savings balance, your money in and out, your savings line and your games back to you.
• To show your next payday, what is left until it, your money in and out a week, your subscriptions, what you owe and what to put away for things you are saving for, on the Budget page, and to make your one-page budget when you ask for it. EKKO shows the numbers; it never moves your money.
• To send you emails: the code that confirms your email address, a password reset when you ask for one, a reminder before a check (it shows your savings balance and how much is left to reach your line), a heads-up before a Free bank connection ends and when it is switched off, and when a card payment fails. Your results are shown in the app, not emailed.
• To take your subscription payment through Stripe.
• To keep a record so any result can be explained or questioned.
• To meet our legal obligations.

We do not sell your information, and we never will. We do not use it for advertising, and we do not build profiles for anyone else.

Only the companies EKKO needs to run. This is the whole list - if it ever grows, this page changes with it.

Each of them has its own privacy policy, and each is bound by it.

People in your game see your name and photo, your result each week, and your weekly amount unless you hide it. If you turn on Show my savings, they also see how much your savings went up or down in that game and that week, but never your balance. If you started the game with only a little saved, how much it went up is close to what you have. It is off unless you turn it on, and you can turn it off at any time in Game details.

Your account and game records are kept in Supabase, hosted in Sydney (AWS ap-southeast-2). That puts them under both the Privacy Act 2020 here and the Australian Privacy Act 1988, which has comparable protections. Sydney was chosen to keep the app fast for people in Aotearoa.

Some of the other companies in section 5 are overseas. Vercel runs EKKO’s pages in Sydney, but it, Railway, Stripe, Resend and Upstash are United States companies, and Sentry keeps its error reports in Germany. What each of them gets, listed in section 5, can be held outside Aotearoa and Australia.

Under the Privacy Act 2020 you can ask us to:

• Show you everything we hold about you.
• Fix anything that is wrong.
• Delete your account and your personal details - apart from the game record above, kept for at least 7 years.
• Hand your data over in a format another app can read.

You can download your account details and your game results, and delete your account, yourself from your account page, any time, without asking us. For anything else we hold, email chow@ekko.nz and we will answer within 20 working days, which is what the Privacy Act allows.

If something goes wrong. If there is a breach that could seriously harm you, we will tell you and the Office of the Privacy Commissioner as soon as we can, with what happened, what was affected, and what we are doing about it.

EKKO does not hold, receive or move money for you. Your savings stay in your own bank the whole time. Money from the first Battle Royale’s pool, and any reward you earned before 2 October 2026, are paid through Stripe, from EKKO’s own Stripe balance, to the payout account you connect. There is no separate account holding anyone’s money.

EKKO’s position is that it is not a reporting entity under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. That position is not formally confirmed and may change. We can refuse, reverse or report a payment where we genuinely suspect crime.