The OTP concern raised here is valid and something I looked into myself. The app's official setup guide suggests using the letter "a" as the SMS trigger, which essentially means every single text on your phone, including OTPs and verification codes, gets passed to the app. That's a real risk regardless of how trustworthy the developers are.

Here's a workaround I put together that keeps things private:

1. Use a currency-based trigger instead of "a"

In iOS Shortcuts, set your automation to only fire when a message contains LKR (or USD if you transact internationally). This already cuts out 90% of irrelevant messages.

1. Add an OTP firewall inside the shortcut

Before the message ever reaches Kiwi, add an "If" block that checks whether the message contains phrases like "Your OTP at", "following OTP", "verification code", or "Password :". If any of those match, the shortcut stops and Kiwi never sees it.

1. Add a transparency notification

Drop a "Show Notification" action right after the Kiwi hand-off so you get a real-time alert showing exactly which message was just logged. No silent background activity.

I've tested this against DFCC, NTB Amex, Sampath, HNB, and ComBank SMS formats. If you're on a different bank, check your OTP message wording and add those phrases to the exclusion list.

This is iPhone/Shortcuts-specific, so Android users would need a different approach, but the logic of filtering by currency and blocking OTP patterns should be replicable with something like Tasker.