What we keep, and why.

Who we are

Voonyle is built and run by Jacky Voon in Malaysia. Questions or requests about your data go to privacy@voonyle.com. Keep, the money tracker, is part of Voonyle but has its own account and its own privacy policy.

Visiting the public pages

You can read the home page and KiKi without an account. We set no cookies for visitors and run no analytics or advertising trackers. Like any web server, ours records each request (IP address, browser and page) to keep the service secure and working; those logs are kept for up to 30 days. Pages load their fonts from Google Fonts, so Google sees your IP address when they load.

If you have an account

Accounts are by invitation and exist for Cadence. We hold:

• Your account: name, email address, role, and a one-way hash of your password. We never store the password itself.
• Sign-in sessions: for each session, the IP address and browser type, so a session can be checked and ended.
• Your learning: learning paths and progress, study sessions and the notes you add, goals and milestones, review cards and how you graded them, daily plans, and your preferences such as time zone and daily time budget.
• Account history: a record of account changes and sign-ins, with the IP address, used to keep accounts secure.

We do not ask for payment details or government ID, and we do not buy data about you from anyone.

How we use it

To run Cadence for you: your plan, progress, reviews and goals. To keep accounts secure and the service running. Nothing else. Plans and review schedules are worked out by the app itself.

What we never do

Voonyle shows no ads, runs no advertising or analytics trackers, and does not sell, rent or trade your data. We do not use your data to train AI models.

Who processes it for us

Google Cloud

Runs the app and keeps its server logs and encrypted database backups. Servers in the United States.

Supabase

Stores accounts and learning records in a managed PostgreSQL database.

Google Fonts

Serves the typefaces the pages use.

This means your data can be stored or processed outside Malaysia. Everything between your browser and Voonyle is sent over HTTPS.

Cookies

When you sign in, Voonyle sets one cookie, voonyle_session, which keeps you signed in for up to 14 days. It cannot be read by scripts on the page, and signing out removes it. There are no other cookies.

How long we keep it

Your account and records are kept while you have an account. When an account is deleted, it and everything in it are permanently removed after 30 days. Copies in our backups expire on their own: daily backups after 35 days and monthly backups after about 13 months. Server logs are kept for up to 30 days. Invitation links expire after 7 days and password-reset links after an hour.

Your choices and rights

Under Malaysia’s Personal Data Protection Act 2010 you can ask to see the personal data we hold about you, to correct it, or to have it deleted, and we can send you a copy of your data in a machine-readable format. Email privacy@voonyle.com from the address on your account and we will reply within 21 days.

Changes to this policy

If this policy changes in a way that affects you, we will update the date above and, if you have an account, tell you before the change takes effect.