The most-asked-for feature when we showed Kinly to our friends was keeping certain expenses private from each other. Therapy. Gifts you’re surprising your spouse with. Personal hobbies. Kinly treats privacy as a first-class property of every transaction — not a workaround.
How visibility works
Every transaction has a visibility attribute with three possible values:
- Shared with household (default for joint accounts and bills): both members see it. Counts toward shared budgets.
- Private to me: only you see it. Doesn’t appear on your spouse’s dashboard, in their daily brief, or in their chat with Kinly. Counts toward your personal budgets (and ignored by household-scope budgets).
Marking a transaction private
When you create a new transaction at Transactions → New transaction, the Visibility selector defaults to “Shared with household.” Change it to “Private to me” before saving.
To change visibility on an existing transaction: open its detail page (click the row in the transactions list), switch the selector, and save. The change is audit-logged.
How private is private?
Kinly enforces visibility at the database query layer, not the UI layer. That distinction matters. Every read in our codebase passes through a helper called scopedFor(userId, householdId) that injects a SQL predicate restricting which rows can come back:
WHERE visibility = 'SHARED'
OR (visibility = 'PRIVATE_A' AND payer_user_id = $userId)
OR (visibility = 'PRIVATE_B' AND payer_user_id = $userId)A lint rule in our continuous-integration build fails the deploy if any query forgets to apply this predicate. Read more in our security overview.
The advisor and chat respect visibility too
The daily advisor writes two briefs each morning:
- A household briefthat’s identical for both spouses. It only references shared transactions. Both of you get the same email.
- A personal brief for each of you, separately, that includes your private items plus everything shared.
The same applies to chat threads. A shared (household) thread is scoped to shared data; private threads are scoped to your data only. Your spouse’s chat history in their personal thread is encrypted under a key your account can’t access.
What about uploaded statements?
When you upload a statement, all the lines default to Sharedif the account is joint. For a personally- held credit card, you can change the account’s default ownership to Private when you create it, and new transactions auto- inherit that. Existing transactions are easy to bulk-edit too — select them in the list and change visibility.
Privacy isn’t a substitute for trust
Kinly’s privacy model exists for legitimately personal spending (therapy, hobbies, gifts, dignity). It isn’t designed to enable financial deception in a relationship — your aggregate spending will eventually show up in the joint dashboard regardless of how it’s tagged, because money is fungible. Use it for what it’s meant for.