How we protect your data
How your bank connection, your data and your results are kept safe, in plain words.
Last updated 6 October 2026
The short version
This is a summary so you can read it in a minute. The sections below are the ones that count, and they are all on this page - nothing is folded away.
- EKKO never holds your money and never sees your bank login. It reads your balances and transactions through Akahu, a read-only connection, and can never move money.
- Your data sits in an encrypted database where the database itself stops other people reading your private records.
- Every weekly result goes into a record nobody signed in to EKKO can change. EKKO never changes a result after the fact, and keeps each one for at least 7 years so it can be checked.
- Found a problem? Email chow@ekko.nz and keep it private until it is fixed.
1. Your bank connection
EKKO connects to your bank through Akahu, an open banking company from Aotearoa, using Enduring Connectivity, a read-only connection. You sign in with your own bank on your bank’s own page. EKKO never receives, stores or sees your bank login. EKKO’s own formal accreditation path is still being finalised.
- EKKO never stores your bank username or password.
- EKKO cannot move money in or out of your bank account.
- EKKO cannot see accounts you have not chosen to link.
- The keys Akahu gives EKKO are encrypted when stored (AES-256-GCM).
- Those keys are never written to logs and never sent to your browser.
- EKKO only reads. It never writes anything to your bank.
You can switch it off at any time from Your bank in the app, or at my.akahu.nz. Switching it off stops every future read straight away. The full detail is on EKKO and your bank.
2. Your data and signing in
Where your data is kept
Your data is kept in a PostgreSQL database run by Supabase. Every table has row-level security, which means the database itself checks who can read and change each record, however it is asked. Your private records, such as your bank accounts, your plan, your payouts, your notifications and the full detail of your weekly results (your balance and your target each week), can only be read by you.
Two things are shared on purpose:
- Your profile page, unless you make it private in Your account. Anyone with the link can open it, even without signing in. It shows your username, photo, line about you, where you’re from and when you joined. It also shows your saving record: whether you hit or missed each week over the last year, your streaks, your highest level, your badges, your games and your friends. It shows no balance and no dollar amount, unless you switch on your money milestones.
- Your seat in a game with other people. The people in that game can see it. Before a Battle Royale starts, anyone with its invite link can also see your username and photo in your seat, unless your profile is private.
- Row-level security is on for every table, with no exceptions.
- Reading your private records needs a signed-in session.
- EKKO’s master database key never reaches your browser.
- Raw database errors are never shown to you or anyone else.
Signing in
Signing in is run by Supabase Auth. Every request that needs you signed in is checked on EKKO’s own servers before anything happens. What your browser says about you is never taken on trust.
- Your sign-in is checked on the server for every request that needs it.
- Your plan is read from your sign-in token, which Supabase signs so it cannot be changed in your browser. Your games are read from the database.
3. The record of every check
Every weekly check - your balance at the time, the most money you have had, and the result - is written to a record that can only be added to. Nobody signed in to EKKO can change a past check or delete one: not you, not anyone else playing, not anyone with your password.
EKKO’s own servers can write to that record, because that is how a week gets judged at all. What EKKO will not do is change a result after the fact - that is a rule we keep, and every entry stays for at least 7 years so any result can be checked against what was actually there on the day.
- Each entry is kept for at least 7 years from the day it happened.
- Any result you question can be checked against it.
- No result can be changed after the fact.
4. What EKKO cannot do, ever
- See your bank login.
- Move money from your bank account.
- Read accounts you have not connected.
- Use AI or chance in the game. Every result follows fixed rules and can be checked.
- Keep what it read from your bank after you disconnect, apart from the name of each account, the bank it is with, the last balance it read, one bank total for each week (removed when you close your account), and the record of each check, kept for at least 7 years.
- Share your data with anyone for advertising.
5. Found a security problem?
Tell us before you tell anyone else, and we will move fast.
- Email chow@ekko.nz with what you found and how to make it happen again.
- We aim to reply to every report within 2 working days.
- We aim to fix a confirmed serious problem within 7 days, and will tell you if it takes longer.
- Please keep it private until it is fixed.
Something not clear?
What EKKO does with your information is in Privacy. What EKKO reads from your bank is in EKKO and your bank.
Email chow@ekko.nzGame rules · Terms · Privacy · Security · Your bank · Help
Immiscible Tech Limited, Aotearoa New Zealand. A real person writes back.