Privacy Policy

The full text

1. Everything you record in this app (your accounts, transactions, people and debts) is stored on this device, in a database that belongs to the app, and nothing leaves it except as the paragraphs below set out.
2. Using Safi requires an account, and all we ask for it is your email address and a verification code sent to it: no password and nothing else. Your ledger (your accounts, transactions, balances and people) is kept on your device, and nothing from it is sent to our server or to anyone else except in three cases you choose, set out below: shared accounts you create or join, telling a friend you have linked about a particular transaction or about their balance when you link them, and using «Say it».
3. Stored with the hosting provider, Supabase, is your email address, which identifies your account and signs you in, together with the technical details that attend any account and that the provider itself records: when the account was created, when it was last signed in to, and the IP address it was signed in from, kept for account security and to prevent abuse. And if you use shared accounts, whatever is recorded inside a shared account is stored there too (the name you choose for yourself among its members, amounts, notes and dates), so that the members of that account alone can read it. Nothing is uploaded there from your own ledger except what you yourself record against a particular shared account: its amount, its note and its date, and nothing else: not the rest of your transactions, your accounts, your balances or your people. Nothing from a shared account comes down into your ledger.
4. If you link your account with a friend through an invitation code, our hosting provider, Supabase, stores the fact that the two of you are linked, and the name each of you chooses to be shown by to the other. Nobody can find you by searching for your name, email or number: a link is made only through a code you send or accept. Your friend does not see your email address.
5. If you record a debt or a repayment against a person in your ledger whom you have linked to a friend, and choose to tell them, only that transaction’s amount, currency, date and note are uploaded, for that friend alone to see. Any later change or deletion you make to it is uploaded too, so they know it changed.
6. When you link a friend to a person in your ledger whose balance is not zero, the app asks you once whether to tell them that balance. If you agree, that person’s balance in its currency is uploaded, together with your earlier transactions with that person alone, up to 200 of them: the amount, currency, date and description of each, with any older ones combined into a single line. All of it is for that friend alone to see. Nothing else is uploaded: not your transactions with anyone else, not your accounts or which account any money came from or went to, not your balances with anyone else, and not your other people. So do not write anything in the note you would not want your friend to see.
7. Nothing is written into either of your ledgers automatically. What reaches your friend is a notice to read; if they wish, they record it in their own ledger themselves. Their reply (“recorded” or “not right”) reaches you, and neither of you learns whether the other has read a notice. If they record a balance you told them, it is written into their ledger as a single line, added to what that person started with there.
8. Notices and their replies, a balance you told and its transactions among them, are kept by Supabase while the link lasts, and are deleted for both of you at the earliest of: either of you unlinking, either of you deleting your account, or 180 days after the notice was sent.
9. With «Say it» you say or type a transaction instead of filling in its fields, and we only turn it on after you agree the first time you use it. Your data moves like this: Apple’s speech recognition turns what you say into text as you speak, on your device where it can, otherwise on Apple’s servers under Apple’s policy; your voice is not recorded and is not sent to us. The text is then sent to our server and on to Anthropic, together with the names of your accounts, categories and people and today’s date, so the amount, account and category can be read from it. Your device reads the reply aloud itself, without sending it anywhere. We do not keep the text; we keep only the time of each request, to limit how many can be made in a day. Anthropic processes this data under its own terms and may keep it for a limited period. Nothing is written into your ledger until you have checked the result and pressed “Save”. You may choose never to use «Say it»; the app works fully without it.
10. If you report abuse, or someone reports you, we may look at the notices concerned, and only those, as far as needed to consider the report and act on it.
11. Supabase’s servers are in Frankfurt, Germany (eu-central-1), outside the Kingdom of Saudi Arabia, and the account, shared-account, link and notice data described above is processed and stored there. The text of «Say it» is processed by Anthropic on servers that may be outside the Kingdom, including in the United States, and speech recognition is processed by Apple when it does not happen on your device. Each of these parties has its own privacy policy governing its processing.
12. Your sign-in code reaches you through an external email provider, Resend, so your address and the text of that message pass through it on the way to you. It sends from Ireland, inside the European Union. Your address is not used there for anything but delivering the code: no marketing, and no tracking of whether the message was opened or clicked. The provider has its own privacy policy governing that processing.
13. Your name, email and phone number, if you enter them into the app, are kept on the device like any other preference. They are never sent anywhere and never verified against any service.
14. No tracking, no analytics, no advertising, and no third-party tool for crash reporting or usage measurement. The app does not read your contacts, your location or your messages.
15. Reminders are scheduled on the device itself, and no reminder content leaves your phone. A reminder may show its text (including a person’s name and an amount) on your lock screen; you can change that in your device’s notification settings.
16. This version is free and nothing is purchased in it. If a subscription is added in a later version it will go through the app store and nowhere else: the app will never see your card and will store no payment details, and all it will learn from the store is whether a subscription is active. The app store has its own privacy policy, which governs the purchase itself.
17. The app uploads your ledger to no server of ours. But if iCloud Backup is switched on for your device, iOS may include the app’s files, your database among them, in your device’s iCloud backup. That copy sits under your own account and Apple’s policy, and the publisher cannot reach it. Deleting the app deletes its data from the device, and a copy may remain inside the iCloud backup until you delete it from your device settings. Keeping a backup of your own is up to you: Settings will export a file for you to store wherever you like.
18. Every file the app produces (the backup, the Excel sheet, the PDF statement) is unencrypted, and anyone who opens it can read your transactions. The backup file also contains your name, email and phone number if you entered them. Once it leaves the app it is in your hands alone, whether you send it to cloud storage or by email.
19. The connection to the server is encrypted in transit (TLS), and what is on your device is protected by the operating system’s file protection and by your device lock. No one can promise absolute security, but this is what we hold to.
20. From inside the app: “Erase data” clears what you have recorded and keeps the app, and “Erase all data and preferences” also clears your name, email, phone number and preferences. Both happen on the device alone. “Delete account” erases from the server your account and email address, along with what you recorded in shared accounts, your memberships of them, your links with friends, and every notice you sent or received. Any shared account you own is deleted in full for all of its members. Your ledger on this device is erased with it. All of these are final and cannot be undone.
21. Your email address and your account’s technical details are kept for as long as the account exists, and are deleted with it.
22. You may at any time learn what we hold about you, ask for it to be corrected or erased, and object to its processing or ask that processing be restricted. Erasure is in your own hands, from inside the app; anything else you may ask for at support@mysafiapp.com. The party responsible for this data is Bisher.
23. No account is created for anyone under 16, and the app is not intended for them.
24. This policy may be updated, and a new version is shown inside the app before its effective date.
25. If you email us, you share with us whatever you choose to write in that message, and nothing else. Support email is kept in the publisher’s mailbox only in order to reply, and is deleted after 12 months, or within 30 days of your asking at support@mysafiapp.com.
26. Effective: 2026-10-25. Version: 1.7