Privacy Policy
What ChequeKo collects, what it deliberately does not collect, and what you can do about it.
Draft — pending legal review. This document describes how ChequeKo is built and operated, but it has not yet been reviewed by counsel. It must be reviewed against Philippine data privacy and consumer law before public launch. Measures marked Planned are not live yet.
1. What we never collect
ChequeKo has no field, form, or database column for any of the following, so we cannot hold them:
- Bank usernames, passwords, PINs, or one-time passwords.
- Full bank account numbers. An optional last four digits is the maximum.
- Signature images or signature data of any kind.
- Payment card details. ChequeKo is free and asks for no payment information.
- MICR or routing information.
2. What we collect
Account information:Planned · Phase 4 — described here but not yet available your email address, a bcrypt hash of your password (never the password itself), your display name, and your account preferences. ChequeKo has no accounts yet, so none of this is collected today.
Cheque data you enter: payee names, issue dates, amounts, memos, and your own internal reference fields such as voucher number, category, project, and department. This is stored so your cheque register works. It is yours, it is isolated to your account, and it is never used for advertising.
Setup data: the cheque templates, printer profiles, and payees you save.
Operational data: print job counts and timestamps. Sign-in events and security events such as failed logins and rate limit trips Planned · Phase 4 — described here but not yet available arrive with accounts. IP addresses are stored only as salted hashes, for abuse control.
3. Guest sessions
If you use ChequeKo without an account, we set a signed, HTTP-only cookie to identify your anonymous session so the free print allowance can be enforced on our servers. We store only a hash of that cookie's value. We do not fingerprint your device. If you later registerPlanned · Phase 4 — described here but not yet available, your drafts, templates, printer profiles, and payees move to your account and the guest session is retired.
4. Calibration images stay on your devicePlanned · Phase 5 — described here but not yet available
Alignment overlays are not built yet. When they arrive, a photograph or scan of your own cheque will be processed in your browser only. There will be no upload endpoint for it. It will be discarded when calibration ends, never published or converted into a shared template, and never used for analytics or AI training. We will ask you to cover your account number and MICR line before scanning.
5. What is kept out of logs and analytics
Payee names, cheque amounts, memo text, account nicknames, and calibration images never appear in application logs, analytics events, or administrative reporting. Analytics is limited to counts and aggregates.
6. What administrators can seePlanned · Phase 6 — described here but not yet available
There is no administrative interface yet. When it arrives, Haturiko administrators will manage bank names, cheque templates, help content, announcements, and abuse controls. Administrative queries are to exclude cheque content entirely — administrators will not see your payee names, amounts, memos, account nicknames, or calibration images.
7. Sharing
We do not sell your data and we do not use it for advertising. We share data only with service providers necessary to operate ChequeKo — for example our email delivery provider Planned · Phase 4 — described here but not yet available, which will receive your email address in order to send verification, password reset, and security notifications — and where required by law. ChequeKo sends no email today.
8. Retention
Anonymous guest session records are deleted automatically 90 days after they are created. Templates, printer profiles, and cheque details you saved as a guest become unreachable at that point, because the session that owned them is gone — do not keep anything in a guest session that you need later. Once accounts exist Planned · Phase 4 — described here but not yet available, cheque records will be kept while your account is active, because a cheque register is only useful as a history, and security events will be retained for a limited period for abuse investigation.
9. Your rights
Under the Philippine Data Privacy Act you may access, correct, and erase your personal data, and object to its processing. Self-service export and permanent account deletion from Account SettingsPlanned · Phase 4 — described here but not yet available arrive with accounts; until then, reach us through the Help Center to exercise these rights.
10. Security
Authorisation is enforced on the server for every request, and each session's records are isolated from every other session's. Password hashing with bcrypt, and CSRF protection on top of HTTP-only cookies,Planned · Phase 4 — described here but not yet available arrive with accounts — today's guest cookie is signed, HTTP-only, and SameSite=Lax. See the Security page for detail.
11. Contact
Privacy questions can be raised through the Help Center. Haturiko Services Inc. is the data controller for ChequeKo.