# Kivo

> One account for money, school, commute, tasks and local updates, with a home brief that reads all five together and states what the day asks of you.

Kivo is a web application built on Next.js with a SQLite store. A person signs up once and uses
five services: Money (expenses, categories, monthly budgets), School (courses, coursework,
deadlines, grades), Commute (saved routes and departure times), Life (tasks, priorities,
coursework links) and Local (announcements, events, transport notices, weather summaries and
advisories for an area).

The home brief is the product's centre. It reads the nearest open deadline from School, the
default route from Commute, the advisories filed for the account's area in Local, the tasks linked
to that deadline in Life, and the month's totals from Money, then writes a short paragraph per
finding with the services it drew from named on the line.

## What the numbers mean

- Travel times are estimates computed from hour of departure, weekday pattern, travel mode, the
  advisories active for the account's area, and live rain from the weather provider. Transport
  bulletins are displayed as context and do not change the estimate. Kivo reads no live *traffic*
  feed, and every screen showing a travel time labels it an estimate.
- Weather is live from Open-Meteo, refreshed every ten minutes, shown with the observation time.
- Headlines are live from Rappler's public feed and a Google News search for the area, which is how
  ABS-CBN and other publishers arrive. Kivo lists headline, publisher and time, and links out. It
  stores none of it and reproduces no article text.
- Budget bars compare the current calendar month's recorded expenses against the limit set for
  that category.
- Grade averages are the sum of recorded scores over the sum of their maximums, across graded
  coursework only.

## Data handling

- Every read and write is scoped to the signed-in account's user id in SQL.
- Passwords are hashed with scrypt; session tokens are stored as SHA-256 digests.
- Commute start and destination addresses are encrypted at rest with AES-256-GCM.
- Local posts filed by an account are labelled as account submissions, separate from operator
  bulletins.
- An account can export every record it owns as JSON from the privacy page or the account page.
- Changing a password requires the current password and invalidates every other session.
- Location is opt-in per press. The browser's coordinate is rounded to about 11 metres, resolved
  to a place name server-side, and only the resulting text is stored. Coordinates are never saved.

## Pages

- / : what Kivo is, the five services, and an example brief
- /help : how each service works, and how a brief line is assembled
- /privacy : what is stored, how it is protected, and how to export or delete it
- /login, /signup : account access
- /home, /money, /school, /commute, /life, /local, /search, /account : signed-in pages, not indexed

## Contact

The contact support control sits in the corner of every page and reaches the support queue.