Legal · Privacy

Privacy Policy

Last updated: 29 May 2026

Plain English Summary - read this first

1.We collect your email address, and - only if you connect your bank - your account balances plus the category and amount of your transactions (e.g. "Salary +$4,000", "Rent −$520"), which we use to work out your income. We do not keep your individual transactions, and we never read merchant names or transaction descriptions.
2.We use your information to run the savings game and show you your own progress. We do not sell it, share it, or use it to advertise to you.
3.You can delete your account any time. When you do, your personal information is removed within 30 days. Game history is kept for 7 years for dispute resolution (required by law).
4.We share your data with nobody. The only third parties involved are Supabase (account login), Stripe (payments), and Akahu (bank connection) - and each of them has their own privacy policy.
5.Questions? Email support@ekko.nz and we will respond within 5 working days.

1. Who we are

EKKO is a product of Immiscible Tech Limited, a New Zealand company. When this policy says “EKKO”, “we”, or “us” it means Immiscible Tech Limited.

We operate under the New Zealand Privacy Act 2020. If you have questions about this policy, email support@ekko.nz.

2. What information we collect

Information you give us

Email address (required to create an account)
Password - stored securely by Supabase. We never see it in plain text.
Age verification confirmation (18+ required)

Information from your bank (only if you connect via Akahu)

Account names and types (e.g., “ANZ Savings”)
Account balances at the time of each Judgment Day
The category and amount of your transactions (e.g., “Salary”, “Rent”) - read only to calculate your Uncommitted Monthly Income. We use the category label and the amount, never the description or merchant name.

What we do NOT collect

Your bank login credentials - ever. Akahu handles authentication directly with your bank.
Individual transaction descriptions or merchant names
Payment card numbers, CVV codes, or expiry dates
Government ID numbers (IRD, passport, driver licence)

Information generated by using EKKO

Game results: Judgment Day outcomes, HWM history, lifelines remaining
Check-in streaks and XP totals
Balance snapshots taken at each Judgment Day (used for the audit log)

3. How Akahu works

Akahu is a CDR-accredited (Consumer Data Right) open banking intermediary. When you connect your bank through EKKO, you authenticate directly with your bank through Akahu’s interface. EKKO never receives, sees, or stores your bank login credentials.

Akahu provides EKKO with read-only access to the account information listed above. EKKO can also initiate transfers between your own connected accounts (e.g., from your Stash to your Arena) - only with your explicit instruction inside the app.

EKKO uses Akahu’s Enduring Connectivity service (for personal-finance apps), not Akahu Apply (for lenders). EKKO is not a lender. Because of this, EKKO works out your usable income from your own transaction categories and amounts - Akahu does not calculate it for us.

Akahu’s own privacy policy is at akahu.nz/privacy-notice.

4. How we use your information

To run your EKKO account and the savings game
To calculate your weekly target, Uncommitted Monthly Income (UMI), and Judgment Day result
To send you notifications about your game (Judgment Day results, warnings)
To process subscription payments via Stripe
To maintain an audit log so any game outcome can be explained or disputed
To comply with our legal obligations

We do not use your information for advertising, profiling for third parties, or any purpose not listed above.

5. Who we share your information with

We do not sell your personal information. We share it only as required to operate the service:

Party	What they receive	Why
Supabase	Email, hashed password	Account authentication
Stripe	Email, subscription tier	Weekly billing
Akahu	OAuth token only	Bank connection

6. Where your data is stored

Your data is stored in Supabase (PostgreSQL) hosted in the AWS Sydney region (ap-southeast-2) - Australian jurisdiction. New Zealand users’ data is therefore subject to both the NZ Privacy Act 2020 and the Australian Privacy Act 1988, which has comparable protections.

We selected the Sydney region to minimise latency for New Zealand users while avoiding US jurisdiction.

7. How long we keep your information

Account data (email, subscription) - retained until you close your account, then deleted within 30 days.
Game audit log (Judgment Day results, balance snapshots) - retained for 7 years from the date of each game event. This is required so any outcome can be disputed and verified.
Akahu-sourced data (balances, spending categories) - deleted immediately when you disconnect your bank in the app.
Payment records - retained as required by the Inland Revenue Act 2005 (minimum 7 years).

8. Your rights

Under the Privacy Act 2020, you have the right to:

Access - request a copy of the personal information we hold about you
Correction - ask us to fix information that is wrong
Deletion - close your account and have your personal information removed (subject to the 7-year audit log retention for game history)
Portability - request your data in a machine-readable format

To exercise any of these rights, email support@ekko.nz. We will respond within 20 working days as required by the Privacy Act 2020.

Security incidents: If EKKO becomes aware of a privacy breach that is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner as soon as practicable, in accordance with our obligations under the Privacy Act 2020. Notification will include what happened, what personal information was affected, and what steps we are taking.

9. Financial crime

EKKO does not hold, receive, or transfer funds on behalf of users. Your savings remain in your own bank accounts at all times. Prize pool payouts are made directly from Immiscible Tech Limited’s ring-fenced reserve account to the winner’s nominated bank account.

EKKO is not a reporting entity under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. EKKO does not provide a designated service as defined in Schedule 1 of that Act, and accordingly has no AML/CFT obligations at this time. We reserve the right to refuse, reverse, or report transactions where we have a genuine suspicion of criminal activity.

10. Acquisition or change of control

If Immiscible Tech Limited is acquired or merges with another company, your data will only transfer under the same terms as this Privacy Policy. Any material change to how your data is handled requires fresh consent under Privacy Act 2020 Principle 3. You will be notified at least 30 days before any such change takes effect.

11. Complaints

If you believe we have breached the Privacy Act 2020, please contact us first at support@ekko.nz. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

12. Contact

Immiscible Tech Limited
New Zealand
support@ekko.nz