Privacy policy
Last updated 3 October 2026
Jot it helps you track what you spend against budgets you set. To do that, it has to hold some information about you and the spending you choose to log. This page explains what that is, why we need it, who helps us process it, how long we keep it, and what you can do about it.
Who we are
Jot it is operated by MITA Labs Kenya, its parent company, based in Nairobi, Kenya. MITA Labs Kenya decides how your information is used (it is the “data controller”) and is responsible for Jot it’s data protection registration. Questions about this policy go to support@jotit.money.
What we collect
- Your account: a nickname you choose, your email address, and your passphrase. Your passphrase is stored only as a one-way hash, so nobody at Jot it can read it.
- What you log: the amounts, notes and dates of the spending you enter, the pots and sub-categories you create, your monthly budgets and the amount you allocate each month.
- The WhatsApp waitlist: your email address, only if you ask to be told when WhatsApp logging opens.
- Billing: your plan, what you paid and when, and the payment reference from our payment processor. Your card or mobile money details are entered with the processor, not with Jot it.
- Keeping the service safe: to stop people guessing passphrases or abusing sign-up, we count attempts against network addresses, nicknames and email addresses. These counts are stored as one-way hashes, not as the addresses themselves, and are deleted regularly.
- Error reports: when something breaks, technical details such as the page, the browser and the error, so we can fix it.
What we never do
- We never connect to your bank or mobile money accounts. Jot it only knows what you choose to log.
- We never sell your information or use it for advertising.
- We never send you marketing unless you opt in.
Why we use it
- To run your account and show you your budgets, spending and insights.
- To send emails you need: confirming your address, sign-in and passphrase-reset links, confirming an email change, receipts, trial and renewal reminders, and confirmation if you delete your account.
- To take payment when you choose a plan.
- To protect accounts and the service from abuse, and to find and fix problems.
- If you joined the WhatsApp waitlist, to email you once when it opens. Every such email has an unsubscribe link.
Who processes it for us
We use a small number of providers, each only for the job described:
- Supabase stores your account and everything you log, in the European Union.
- Vercel hosts the Jot it website and app.
- Resend sends our emails, from the European Union.
- Cloudflare runs the “are you human” check on sign-up and log in, and handles our domain and support email.
- Sentry receives error reports, in the European Union.
- Paystack processes payments and holds your payment details.
Some of these providers process information outside Kenya. We choose providers that protect it under their own security and privacy commitments.
How long we keep it
- Your account and everything you log: until you delete your account.
- A sign-up whose email is never confirmed: deleted within about a day.
- Data exports: created when you ask and sent straight to you. We never store a copy or a link to one.
- Billing records: kept for as long as tax and accounting law requires, even after you delete your account, but no longer linked to it.
- Email delivery logs and error reports: kept by Resend and Sentry for their own limited periods, and they can include your email address.
Your choices and rights
- See and take your data: export your transactions, budgets and profile at any time from your Account page.
- Correct it: edit your budgets and pots, delete entries, and change your email from within the app.
- Delete it: delete your account from your Account page. This permanently removes your account and everything you logged, apart from the billing records described above.
- Anything else: to ask what we hold, to object to how we use it, or for help with any of the above, write to support@jotit.money. You also have the right to raise a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke. If something’s wrong, we’d like to hear about it too.
Keeping it secure
Everything travels over encrypted connections. Each account’s data is kept separate inside the database itself, not only in the app. Passphrases are hashed, sign-up and log in are protected against automated abuse, and access to production systems is limited to the people who run Jot it. No system is perfectly secure, and we will tell you if a problem affects your information.
Cookies
We use only the cookies the app needs to work: one that keeps you signed in, and one that remembers whether you chose “keep me logged in”. The “are you human” check may set its own short-lived cookie. We use no advertising or tracking cookies.
Age
Jot it is for adults. You must be 18 or older to create an account.
Changes to this policy
If we change this policy we will update the date at the top. If a change affects how we use your information, we will email you before it takes effect.