Smetky privacy policy

Your ledger should stay yours.

Last updated: 25 July 2026

This policy explains what Smetky stores, why it is needed, and what happens when you ask us to delete your account. It is a product policy, not a substitute for advice about the law that applies to your organisation.

What we collect

• Account details: name, unique username, hashed PIN, and optional recovery email.
• Workspace content: project settings, transaction details, audit events, proof files, and private voice notes that you choose to add.
• Security data: session expiry information, rate-limit counters, and minimal technical fingerprints used to protect accounts.

Why we use it

We use this information to authenticate you, enforce workspace and project permissions, calculate balances, show your history, store the files you attach, provide exports, prevent abuse, and respond to support or legal requests.

Sharing and storage

We do not sell ledger content. Shared records are visible only to people granted access to the relevant workspace or project. Files are stored in the configured private attachment store. A deployment operator may need infrastructure providers to process data on Smetky’s behalf.

Retention

Active account and workspace data is retained while it is needed to provide the service. When you delete your account, profile data, login access, and sessions are removed immediately. Shared ledger entries and audit information may be retained in anonymised form where necessary to preserve the records of other workspace members or meet a legal obligation. Security logs may be retained for up to 30 days, then removed or aggregated.

Your choices

You may access and correct your account details, export your ledger, change your PIN, and delete your account from Smetky. You may also ask for access, correction, restriction, portability, or erasure where applicable. If a record must remain for another workspace or a legal obligation, we will explain that limitation.

Cookies and sessions

Smetky uses a necessary, HttpOnly session cookie to keep you signed in. It is not used for advertising. Sessions expire and can be revoked by logging out or deleting the account.

Contact

For privacy requests, use the support contact supplied with your Smetky deployment and include the username or workspace reference needed to locate the request.

Data-protection rights vary by jurisdiction. The European Commission describes the GDPR right to erasure and its exceptions; Smetky will assess requests against the law that applies to the relevant processing.