Privacy

Privacy Policy.

Last updated: 15 September 2026

1. Controller

PT DWIPA MESARI GLOBAL, publishing as Dwipt (“we”, “us”), provides the Yelku application and https://yelku.com. Contact: support@yelku.com. Postal address: Br. Tengah, Blahbatuh, Gianyar 80581, Bali, Indonesia. This policy describes processing in connection with Yelku. Checking the acknowledgement on first use, and continued use, signifies agreement to this policy together with the Terms of Use.

2. History on the device

Expenditures, notes, categories, budget updates, saved places, optional member names, optional display name, books, and (if used) group pairing data are stored in a local database on the device. They are not uploaded for advertising. The operating system may include that database and application preferences in the backup or device-transfer account associated with the phone. There is no file export of that history. Plus may let you create a picture or overlay video to share or save; you send that file, not the database. Optional email delivery of such files uses api.yelku.com for that send and we do not keep the files after transmission.

3. Cloud

If you add Cloud (which requires Plus), a backup is encrypted on the device (AES-256-GCM; key derived on-device with PBKDF2) before it is sent to api.yelku.com. Sign-in uses email and a derived secret; the password is not uploaded. We cannot read that backup without the on-device key. Remove Cloud in Settings to delete the server copy and the account; history on the device remains. Cancel billed Cloud in the store. You may also use yelku.com/delete.html or email support@yelku.com.

4. Anonymous spend events

From the first expenditure you log after any in-application demonstration data, we may receive an anonymous spend event if a place name is present or, if that field is empty, if a description or note is present. The event contains that text (normalized), amount, calendar day, coarse time-of-day slice, currency, optional category, and, if a stored location hash exists, a truncated area code of at most four geohash characters. Events do not include your name, email, Cloud account, advertising identifier, device identifier, or precise coordinates. Tour demonstration data is not sent. If both place name and description are empty, that expenditure does not generate an event. Deny location and the area code is omitted; the rest of an event may still be sent. The application may fetch popular place names for the current coarse area from api.yelku.com (widening the cell if empty). The host sees ordinary connection metadata, including IP address, to operate and rate-limit those endpoints; that metadata is not stored in the event record. Events operate nearby suggestions. We retain them to compile aggregated statistics, including statistics we may commercially offer to businesses (retail, consumer packaged goods, restaurants, funds, and other subscribers) through a dashboard, feed, or similar product that is not part of this application. Aggregates use floors or similar measures so an individual cannot reasonably be singled out. We do not sell personal information and we do not license a list of a person’s individual spends, on-device history, or Cloud backups.

5. Location

Coarse location (low accuracy, including last-known position) may be requested once, after any tour, on the first real Add spend. A geohash is stored on the device (about five kilometres at full stored precision) and truncated further before an event is sent. It is used to rank nearby places and to attach an area code. It is not a map pin and we do not reverse-geocode the shop you are standing in. Deny it and the application still works. On older Android, a nearby-network or location permission may also be required by the operating system to find another phone you choose to pair, not to track you.

6. Advertising

Without Plus, a full-screen app-open advertisement from Google AdMob may show when you return to the application, subject to frequency limits. Ads are not built from your history or from spend events. In the EEA, UK, and Switzerland, Google’s consent form may run first. Settings may include Ad choices where that form is offered. On iOS, App Tracking Transparency and an advertising identifier may be used only for ads on the free plan. Plus removes those ads on a device where it is recognized.

7. Pairing, camera, media, and other permissions

Camera is used to scan a pairing code and, for Plus spend reports, to capture a photo or video used as an overlay background. Microphone is used when you record such a video. Photo-library access is used to pick that background and to save report images. Local Wi-Fi pairing exchanges a book on the network you choose (multicast / Bonjour). Overlay video is encoded on the device. Share uses the system share sheet. Switching currency may call a third-party rate host with ISO currency codes only. Support messages include what you write and a short device line (application version, operating system, language, currency, mode), not your spends.

8. Cookies

The application does not use cookies. yelku.com does not use tracking cookies or advertising pixels. Cloud keeps a session token on the device, not in a browser cookie.

9. Retention and processors

On-device history remains until you delete it or reset the device, and may persist in an operating-system backup until you delete that backup. Cloud backups remain until you remove Cloud. Anonymous spend events are retained as reasonably necessary to operate nearby suggestions and to compile and update aggregated statistics. Processors include api.yelku.com (Cloud, events, nearby lists, overlay mail), Apple and Google (stores, billing, and on iOS/Android system services), Google AdMob and consent tooling (ads), a foreign-exchange rate host used at currency switch, and infrastructure needed to run those hosts. Store billing is handled by Apple or Google.

10. Your choices

You may leave both place name and description empty (no event), deny location (no area code), open Ad choices while ads are on, Remove Cloud, or reset this device in Settings. In the EEA, UK, and Switzerland you may also complain to a data protection authority. Email support@yelku.com to access, correct, or delete a Cloud account.

11. Additional notices

The Service is not directed to children under thirteen (13), or the higher digital-consent age where applicable. We do not knowingly collect personal information from children. If we learn we have done so in a manner not permitted by law, we will delete it. This policy may be updated; the date above is the current version. Legal notice: Settings → About and yelku.com/legal.html.