Kerdili is a credit notebook shared between a shop and its customers. This policy explains exactly what we hold, why we hold it, and what you can make us delete. It is written to be read, not to be survived.

Who is responsible

Kerdili is operated by Amine Leben, Griegstraße 122, Hamburg-Altona, Germany. For anything in this policy, write to info@kerdili.app.

What we hold

• Your identity: the name and phone number used to sign in. A shop also holds its shop name, its own phone number and its join code.
• The ledger: every credit sale and payment written by a shop — date, items or description, amount, running balance, and which staff account recorded it.
• Agreements between you: the credit limit a shop set, and any payment plan proposed, countered, approved or refused.
• Family codes: if a customer adds a family member, that person's name and the code they show at the counter.
• Staff accounts: if a shop adds staff, each person's name, the username the shop gave them, and the password the shop set for them.
• Subscription records: the plan a shop chose and the bank transfer reference it sent us, so we can match the payment.
• Technical data: the app version, the kind of phone (Android or iPhone) and an identifier for the installation, used to keep you signed in and to fix faults.

The camera is only used to read a QR code, and a picture you choose is only read for a QR code. Both happen on your phone; no image is ever uploaded.

Where it is held, and who else touches it

Your book is kept on your phone and on our server, so that a shop and its customers see the same page and nothing is lost with a phone. Our server runs on Cloudflare (Cloudflare Workers and D1). Only these services ever receive any of your data, and only what they need:

• Cloudflare hosts the server and the database.
• WhatsApp: when you sign up, move to a new phone or forget your code, our team sends your verification code to your number on WhatsApp, from Kerdili's number. Your number and the message pass through WhatsApp (Meta).

What we never do

• We never move, hold or process money. Cash is handed over at the counter; Kerdili only writes it down.
• We never sell or rent your data, and we do not run advertising.
• We never show one shop what a customer owes at another shop — not a total, not a hint. Every screen is built from that shop's own relationships only.
• We never ask for card numbers, bank credentials or national ID.

Why we are allowed to hold it

We hold your identity and ledger because it is necessary to provide the service you asked for — a shared record of a debt between two people who both agreed to it. Where the law requires consent instead, we ask for it and you can withdraw it at any time by deleting your account.

Who can see what

• A shop sees its own customers, their balances with that shop, and the entries its own staff wrote.
• A customer sees every shop they deal with, and every line those shops wrote about them.
• Staff set to “records only” see the till and the product list — no balances and no ledger — and every entry still records who wrote it.
• We access your data only to keep the service running, to fix a fault you report, or where the law obliges us.

Corrections, not deletions

The ledger is append-only by design. A mistake is fixed by adding a correcting entry, and both lines stay visible to both sides. This is deliberate: a book that can be quietly edited is not worth trusting. It also means individual entries cannot be erased on request — see the next section for what can.

Deleting your account

You can delete your account from inside the app at any time, or ask us to do it — see Delete your account.

What is removed: your profile, your phone number, your family codes, and your ability to sign in. Your account stops being yours.

What remains, and why: the entries a shop wrote in its own book remain in that shop's records, shown against a name and number rather than a live account. Those lines are the shop's own commercial record of money it is owed, and deleting an app account cannot cancel a debt that exists in the real world. If the debt is settled and you want the record gone, ask the shop.

How long we keep things

A shop's book is kept for as long as the shop keeps its account. When a shop closes its account, its book is deleted from our server. Verification codes stop working after 10 minutes. Technical logs are kept for no more than 30 days.

Security

Access is by phone number, proved once by a one-time code, and then a six-digit login code that we store only in hashed form. Data is encrypted in transit and at rest. No system is perfect, and we will tell affected users without undue delay if a breach puts their data at risk.

Children

Kerdili is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child has an account, write to us and we will remove it.

Your rights

You may ask for a copy of what we hold about you, ask us to correct your name or phone number, ask us to delete your account, or object to how we use your data. Write to info@kerdili.app and we will answer within 30 days. You can also complain to a data protection authority.

Changes

If this policy changes in a way that affects you, we will say so in the app before the change takes effect. The date at the top always reflects the current version.