Dura Privacy Notice

Dura is run by Kudapara Pty Ltd, a company registered in South Africa (registration number 2021/1861529/07), 21 Aquila Roos Street, Sandton, Johannesburg, 2191, South Africa ("we", "us"). We decide how your information in Dura is used. Contact our privacy lead at privacy@muchiround.com, or write to the address above. This notice explains what Dura collects, why, who sees it, and your rights.

What changed in version 1.2: we added savings groups (mukando) (sections 1, 2, 3, 4, 5, 6, 7 and 8, and a new section 6A). Nothing else changed. Version 1.1 added loans from your household piggy.

1. The short version

Dura holds your money records, not your money. It stores what you earn, budget, spend, save, lend and owe, and who you share a household with.
The law treats this as sensitive. We ask for your written agreement before we store it, and you can withdraw it.
Your household sees your shared records. Only you see your private pocket. If you borrow from your household's piggy, your household sees the loan and your repayments, but still not your pocket. We do not sell your information, and we do not use it for advertising.
A savings group (mukando) has its own book. If you join one, its members see the group's records about you by your first name: what you pay in, what you receive, borrow and repay, your payout turn, and any of the group's money you hold. They never see your email address, your households or your private pocket. Dura never sends group records to AI, but members can read the group's book with tools they choose (section 6A).
The AI coach and receipt reading are optional and send records to AI companies outside Zimbabwe and South Africa. You use them only if you turn AI on yourself. But if any one member of your household turns AI on, the household's weekly check-in and emailed receipts are read by AI, and that includes your entries. Settings shows you who has turned it on.

2. What we collect

Your account. Your first name, email address and password (stored only in scrambled form). If you sign in with Muchiround Visa, we receive your Visa ID, email address and name from Visa.
Signing in. For each device you sign in on, and each API token you create, we record the IP address, browser or app type, and when it was last used. A cookie keeps you signed in until you sign out. We use no advertising or analytics cookies.
Your households. The household name, currency, time zone and month start; who is a member and who owns it; and the email address of anyone you invite.
Your money records. Envelopes, budgets, savings goals, money in (and where it came from, for example "Payoneer" or "FNB"), spending, moves between envelopes, who owes whom between envelopes, allowances, cash counts and the reason for any difference, and who recorded each entry and when. Notes you write on entries are stored encrypted.
Loans from the piggy. If your household lends from its piggy: who asked for each loan, whether it is a personal loan to one member or a joint loan to the household, its purpose if one is given, the amount, the interest rate, the repayment plan, who approved, declined or cancelled the request and any note they added, and every repayment, skipped month, new schedule, amount forgiven and undo, with who did it and when.
Savings groups (mukando). If you create or join a group: its name, currency and rules; who keeps its book; who its members are, and when each joined or left; the payout order and any swaps; every contribution, payout, loan from the pool, repayment, handover and share-out; where the group's money is kept (a short label and the member who holds it, for example "Rudo — EcoCash"); who recorded each entry; and each member's confirmation or dispute, with any note (notes are stored encrypted). For an invitation, we store only the invited person's email address.
Receipts. Photos, screenshots, PDFs and receipt emails you add or forward to your private receipt address, and the lines, shop, date and total read from them. Receipt emails without an attachment are stored encrypted.
The coach. The questions you ask it, its answers, and the weekly check-ins it writes for your household.
Your settings. Things like sounds, table layout, whether you have seen the tour, and whether you want the weekly email.
Your agreement. When you agreed to these terms and to this notice, and to join any savings group, which versions, and the IP address you agreed from.

3. Sensitive information and your agreement

Your money records show your financial history. Your households can show your marital or family status. Zimbabwe's Cyber and Data Protection Act treats both as sensitive information, which we may store only with your written agreement. We ask for it in a separate step when you join and keep a record of it, and we email you a copy. If you join a household, the other members' records are covered by their own agreement, not yours.

A savings group needs its own agreement. Before anything about you is recorded in a group, you must accept the invitation yourself and tick a separate agreement for that group. Nobody can record anything about you in a group you have not joined. Each member's records are covered by their own agreement.

You can withdraw your agreement at any time, free of charge, in Settings or by writing to privacy@muchiround.com. After that, we stop storing new records about you. You can export your records, and we will close your account (section 8). Records you made in a shared household stay with that household for the other members, showing only your first name, until the household is deleted. If you want them removed, ask the household owner or tell us. Records in a savings group are kept as section 6A explains.

4. Why we use it

Purpose	What we use	Our reason
Run Dura for you and your household: the table, envelopes, entries, pockets, loans from the piggy, receipts, exports	Account, households, money records (including loans), receipts	Your written agreement (section 3) and our agreement with you (the Dura Terms)
Run a savings group: its book, confirmations and disputes, the payout order, loans from the pool, where its money is kept, and the share-out	Savings-group records	Your written agreement for that group (section 3) and our agreement with you (the Dura Terms)
Keep a group's past entries about a member who has left, withdrawn their agreement or closed their account	That member's past entries in the group	Settling and, if needed, proving what members owe each other (section 6A). The law allows this without fresh agreement
Sign you in and keep your account safe, limit abuse, stop break-in attempts	Account, sign-in records	Our agreement with you, and our legitimate interest in keeping Dura secure
The AI coach, weekly check-ins and receipt reading	The records described in section 5	Your separate agreement to AI features (section 5). For a household's weekly check-in and emailed receipts, the agreement of the household member who turned AI on (section 5)
The weekly email (on unless you switch it off)	Name, email, your household's summary and check-in	Our agreement with you. Every weekly email has a one-click unsubscribe link
News about Dura (now and then)	Name, email	Our legitimate interest in telling customers about the product they use. Every email has a link to stop them
Check that the books add up (a nightly check)	Money records	Our agreement with you
Answer your questions and complaints, and meet our legal duties	What you send us, and what we need to answer	Our agreement with you and our legal obligations

We do not sell your information, we do not use it for advertising, and we do not use it to assess your creditworthiness.

5. The AI coach and receipt reading

These features are optional, and you can turn AI on or off for yourself at any time in Settings.

The coach, and reading a receipt you upload yourself, work only if you have turned AI on yourself.
The weekly check-in, and reading receipts that are emailed to a household, run for the whole household if at least one current member has turned AI on. They then include records made by every member, including members who have not turned AI on. They stop from the next run once no current member has AI turned on.
Your private pocket uses AI only if you have turned it on yourself.
Settings shows each household's AI status: whether AI is on, and the first names of the members who turned it on. It also shows whether you have turned it on yourself. If you do not want your household records read by AI and a member has turned it on, you can ask them to turn it off, leave the household, or write to privacy@muchiround.com to object (section 10).

The coach (your questions and the weekly check-in) receives your household's name, members' first names, envelopes, balances, budgets and goals, who owes what between envelopes, the last 60 days of entries (including who recorded each one and the first 80 characters of any note) and recent cash-count differences. Money paid out on a loan from the piggy, and repayments, are entries, so they are included in the same way. The coach for a household never receives anything from a member's private pocket. It does not receive email addresses or account IDs. It can only read, and it cannot change your records.
Receipt reading receives the receipt image or email, your envelope names and budgets, and the envelopes your household chose for similar items before.
We send these to OpenRouter, which passes each request to a company that runs the AI model we use. At present that is a DeepSeek model for the coach and weekly check-in, and a Google (Gemini) model for receipt reading. The company that runs the model may be the model's maker or another hosting company that OpenRouter chooses. We use OpenRouter's setting that routes only to model providers that do not use your requests to train their models. Some providers may keep a request for a limited time to detect abuse or meet legal duties, and then delete it. Do not write passwords, PINs, card or account numbers or ID numbers in notes or coach questions. Dura does not need them.
Savings groups never use Dura's AI. Dura sends nothing from a group's book to the coach, the weekly check-in, receipt reading or any AI company, whatever anyone's AI setting. A member can still read the group's book with an AI tool of her own (section 6A).
The coach does not make decisions about you. Nothing it says changes your records. Receipt lines are recorded only when a person confirms them.

6. Who sees your information

Members of your household see all of its records, including who recorded each entry and the notes and receipts on it. Your private pocket is visible only to you.
Loans from the piggy. Every member of the household sees every loan from its piggy: who asked for it, who approved, declined or cancelled it and any note they added, the amount, the interest rate, the repayment plan, and every repayment, skipped month, new schedule and amount forgiven, with who did it and when. For a personal loan, the money goes into the borrower's private pocket and is repaid from it. The other members see the loan and each repayment (for example "Rudo repaid $50, Phone, 4 of 12"), but never the pocket's balance or anything else in it.
Members of a savings group see the group's book: every member's contributions, payouts, loans from the pool, repayments, payout turn and share-out, where the group's money is kept and who holds it, and who recorded and confirmed each entry. They see members by first name. They never see your email address, your households' records or your private pocket. While an invitation is waiting, only the keeper who sent it sees the email address it went to.
Tools you connect with an API token see what your account can see, until you revoke the token.
Our service providers, which handle information only on our instructions:
- Hetzner hosts our servers, database, file storage and email server in Finland.
- OpenRouter and the AI model providers in section 5, for the coach and receipt reading only.
- Muchiround Visa, which we also run, if you sign in with it. Your Dura records are not sent to Visa or to any other Muchiround app.
Authorities, only where the law requires it, or to protect someone's safety or our legal rights.

6A. Savings groups (mukando)

A savings group has its own book, kept apart from every household. Dura keeps the group's records only. The group's money stays with its members.

Joining. A keeper invites you by email. The invitation stores only your email address. It is deleted when you accept or decline it, or 30 days after it was sent. Nothing about you is recorded in the group until you have joined and ticked the group's agreement.
Members outside Zimbabwe. Some members of a group may live outside Zimbabwe. When they open the group's book, they see your group records from there.
Members' own tools. A member can read the group's book in Dura's app or with her own API token, for example with the dura command line, in a spreadsheet or in an AI assistant she chooses. Her token shows no more than she can see in the app, never anyone's email address, and stops working for the group when she leaves it, withdraws her agreement or revokes the token. Dura does not control what those tools do, and cannot change copies a member has already taken out of Dura.
Where the money is. Each place the group's money is kept is recorded as a short label and the member who holds it, for example "Rudo — EcoCash" or "Chipo — CBZ …1234". Dura refuses full account, card or phone-wallet numbers. Never enter a PIN or password.
Leaving. You can leave a group before its first cycle starts or after a cycle has closed, and you can download your own group records at any time.
Withdrawing your agreement or closing your account. You can do either at any time, even during a cycle. From then on nothing new is recorded about you in the group, except entries needed to settle what you and the group still owe each other for the cycle you are in (for example a repayment, your payout or your share-out).
What stays. Your past entries stay in the group's book, because the other members need them to show what was paid and what is owed. Once the cycle you were in has closed and you have left, withdrawn your agreement or closed your account, your name in them is replaced with "Former member" and a number.

7. Information sent outside Zimbabwe and South Africa

Dura's servers are in Finland, in the European Union. The AI providers in section 5 may process requests in other countries, including the United States. If you are in Zimbabwe or South Africa, your information is therefore transferred outside your country. If you are in a savings group with members who live outside Zimbabwe, they see the group's records about you from where they are (section 6A). We do this to provide the service you asked for and with your agreement (sections 3 and 5). We choose providers that protect information to a standard similar to the law where you live.

8. How long we keep it

Information	How long
Household records (including loans from the piggy), receipts and coach check-ins	While the household exists. When its owner deletes it, its records and files are deleted at once. Backup copies are overwritten within 14 days.
Your private pocket	While your account is open
Coach conversations	We keep your 20 most recent messages in each household and delete older ones as you go
Raw receipt emails	Deleted 30 days after they arrive. What was read from them stays with the receipt.
Sign-in records	Until you sign out of that device or revoke that token
Invitations	The invitee's email address stays with the invitation after it is accepted or expires (it expires after 7 days)
Savings-group records	While the group exists. A member's past entries stay with the group after they leave, withdraw their agreement or close their account, under "Former member" and a number once their cycle has closed (section 6A)
Savings-group invitations	Deleted when accepted or declined, or 30 days after they were sent
Your account	Until you close it. We close it within 30 days of your request and delete your account details. Entries you made in a shared household, and loans from its piggy that you asked for, approved or repaid, stay with that household under your first name (section 3). Entries in a savings group stay with the group (section 6A).
Your agreement records	For as long as we hold records based on them, and then up to 3 years, so that we can show that we had your agreement

9. Keeping it safe

Dura uses HTTPS everywhere. Passwords are stored only in scrambled form, notes and receipt emails are stored encrypted, receipt files are kept in private storage and opened only through links that expire after 5 minutes, and each household's and each savings group's records are kept apart from every other household's and group's. If a breach puts your information at risk, we will tell the regulator and, where the risk is high, tell you, as the law requires.

10. Your rights

You can ask us what we hold about you and get a copy, and ask us to correct it, delete it, or stop using it. You can also object to how we use it and withdraw your agreement (section 3). You can export your household's records yourself in Settings, and switch off the weekly email and your own AI setting yourself. For anything else, write to privacy@muchiround.com. We will reply within 30 days and may need to confirm your identity first.

If you are not happy with our answer, you can complain to:

in Zimbabwe: POTRAZ, the Data Protection Authority;
in South Africa: the Information Regulator;
elsewhere: the data protection authority where you live.

11. Children

Dura accounts are for people aged 18 and over. An adult may track a child's allowance in a private pocket, which records amounts, not information about the child. If you think a child has an account, tell us and we will close it.

12. Changes

If we change this notice in a way that matters to you, we will tell you by email or in the app before the change takes effect, and ask for your agreement again where the law requires it. The version and date at the top will change.