Short version. Capi stores what you log (transactions, currency, the odd voice note), uses it to answer you, and keeps it out of anyone else's hands. You can download the lot with /mydata, erase the lot with /forget, and nothing leaves Capi to be sold or advertised against. The long version follows, aligned with GDPR (Articles 6, 13, 15, 17, 20) and Brazil's LGPD where it applies.
The first time you open Capi on Telegram, after you pick a language, a short consent screen links to this page and to the Terms. Tapping "I agree" is the lawful basis under GDPR Art. 6(1)(a), and Art. 6(1)(b) for the subscription contract if you pay. The Capi team records the timestamp and the version of this page you agreed to, nothing else. You can withdraw consent at any time with /forget, which deletes everything Capi holds about you.
Data controller: Capi (trading name operated by the Capi team). Privacy and data requests: privacy@cappi.io. General contact: hello@cappi.io.
On infrastructure the Capi team operates. Transactions sit in an encrypted database. Backups are encrypted at rest and rotate weekly. No third-party analytics vendor has a copy of your transactions.
Capi Together is a paid tier that joins two Telegram accounts into one shared "household" so both people can log into the same month. If you buy Together or accept a Together invite, some extra rules apply:
/together_leave. Transactions already in the shared history stay; anything you log after you leave goes back to your private account./mydata exports only the rows you yourself logged, even inside a household. /forget deletes your user row, your consent record, and the transactions you logged; the household itself and rows logged by the other member stay.If you don't buy or accept Together, none of this applies, and Capi operates as a strictly solo account.
When you log a transaction, a photo, or a voice message, the content you sent (and only that) goes to a language model to categorize the merchant or transcribe speech. The model sees a single input and nothing else: not your name, not your history, not your other transactions. Current providers:
All providers are used under standard API terms that do not retain your content for training. Capi does not fine tune any model on your data.
The landing page uses Rybbit, a privacy-respecting analytics tool the Capi team self-hosts. It records page views and the country the visit came from. It does not use cookies for tracking and does not store an IP address.
Built into the bot so you don't have to email anyone:
/mydata and Capi replies with a single XLSX file: profile, every transaction, chat history. Machine readable, yours to keep./forget, confirm once, and Capi deletes everything: transactions, profile, chat history, consent records, subscription link. Immediately in the live database; within 7 days across backups./history and tap a row.As long as your account is active. If you stop using Capi without sending /forget, the team auto-deletes idle accounts after 24 months of inactivity. Paid subscription records are kept as long as required by tax and accounting law in our operating jurisdiction, but are unlinked from your transactions after erasure.
Capi is not for anyone under 16. If you are under 16, please don't use it, and if you already have, send /forget.
If the rules change, the date at the top changes with them. For material changes, Capi will message you before they take effect and ask you to re-accept.
Privacy: privacy@cappi.io. General: hello@cappi.io.