Privacy Policy — Masroofi (مصروفي)
- Your financial records are stored on your device. You do not need an account to use the app.
- On iPhone and iPad, the app automatically copies your data to your own iCloud account.
- Cloud backup on Google's servers (Firebase) is optional and needs Apple or Google sign-in. Data is encrypted on your device before upload, and we do not hold the key.
- We use Firebase Analytics and Firebase Crashlytics for usage statistics and crash reports that do not carry your amounts or transactions. You can switch both off in Settings.
- We use Firebase Cloud Messaging for general announcements and RevenueCat to manage subscriptions.
- No ads, no advertising ID, and we do not sell your data.
1. Data stored on your device
The app keeps a local database on your device with: transactions (amount, currency, date, category, wallet, note), categories, wallets, budgets, recurring transactions, debts, loans, savings goals, zakat records and app settings. The app-lock PIN is kept in the system's secure storage.
This data does not leave your device except as described in sections 2 and 3.
Pasting bank SMS
When you copy a bank message and paste or share it into the app, the text is parsed on your device and the resulting transaction is saved. The app does not request SMS-reading permission on Android and cannot read messages on iPhone.
Receipt scanning
You take a receipt photo with the camera or pick one from your photos. It is read on your device (Apple Vision on iPhone, Tesseract bundled in the app on Android), and a copy is saved inside the app's storage on your device. Receipt photos are not included in backups and are not uploaded to any server.
2. Automatic iCloud backup (iPhone and iPad only)
- On iPhone and iPad the app automatically saves a copy of your data (section 1, without receipt photos) in a «مصروفي» folder in your iCloud Drive and updates it after changes. This works automatically when iCloud Drive is on for your device.
- The copy is normally encrypted with a random key kept in your iCloud Keychain. If the key cannot be reached, the copy may be saved unencrypted in your iCloud, and the app shows this on the Backup & Sync screen.
- These copies live in your Apple account and we cannot access them. Delete them in the Files app → iCloud Drive → «مصروفي», or turn off iCloud Drive for the app in your device settings.
3. Cloud Sync (optional)
It only runs if you open Settings → Backup & Sync [النسخ الاحتياطي والمزامنة] → Cloud Sync [المزامنة السحابية] and sign in.
Sign-in
- You sign in with Google (Android and iPhone) or Apple (iPhone and iPad). Authentication is handled by Google's Firebase Authentication.
- Firebase Authentication keeps your account identifier and your email address as sent by Apple or Google, and may include your name and profile photo when you sign in with Google. With Apple you can choose to hide your email.
What is uploaded
- Once on, the app automatically uploads a copy of your data (section 1, without receipt photos) to Google Cloud Firestore whenever it changes.
- The copy is encrypted on your device before upload: AES-256 (CBC mode) with HMAC-SHA256 authentication, using keys derived with PBKDF2-HMAC-SHA256 (600,000 iterations) and a random salt.
- Stored in Firestore under your account ID: the ciphertext, the salt, an encrypted check value, timestamps, a format version and the copy's size. No readable amounts, names or notes, and not the encryption key.
Where the encryption key is kept
- New accounts have no password: the app creates a random key and saves it in your iCloud Keychain on iPhone, or in Google Block Store on Android with backup to your device's Google backup turned on, so the copy can be opened on a new device.
- The key is not sent to our servers or to Firestore, so we cannot read your cloud copy.
- On iPhone the key reaches your other devices through iCloud Keychain when it is turned on. On Android, if the device cannot carry the key over (for example older devices or devices without a screen lock), the app shows you a recovery key to keep.
- If you lose the key and every copy of it, we cannot recover the cloud copy. Older accounts created with a passphrase still use it.
Turning it off and deleting
- More options menu [خيارات أخرى] (⋮ or ⋯ at the top) → Disable Sync [إيقاف المزامنة]: deletes your cloud copy, your account data in Firestore and the saved encryption key, and signs you out. The sign-in account itself remains.
- More options menu [خيارات أخرى] (⋮ or ⋯ at the top) → Delete Account [حذف الحساب]: deletes the sign-in account, the cloud copy and its key. Details on the account deletion page.
- Neither option touches the data on your device.
4. Export and moving data between devices
- Settings → Backup & Sync → Export backup [تصدير نسخة]: creates an unencrypted JSON file on your device; you decide whether to share it.
- … → Advanced [خيارات متقدمة] → Export encrypted [تصدير مشفّر]: creates a
.masroofi-encfile encrypted with a password you choose (AES-256-CBC with HMAC-SHA256, key derived with PBKDF2-HMAC-SHA256, 100,000 iterations). - QR Transfer [النقل بـQR]: moves your data directly to another device through QR codes shown on screen and read by the camera. No server is involved. The content is not encrypted, so do not show the codes to others.
- Family Data Transfer [نقل بيانات الأسرة]: exports an unencrypted JSON file that you share yourself through the system share sheet. It does not pass through our servers.
- Report bank format [بلّغ عن صيغة بنك]: prepares the message text with every run of 4 or more digits masked, and you send it yourself through the share sheet to whoever you choose.
5. Usage statistics and crash reports
Firebase Analytics (Google)
- Records events such as opening the app, adding a transaction (its type and source: manual/SMS/receipt), seeing the subscription screen, using features and backup results, with approximate counts capped at 100.
- The app strips from these events any amount, decimal number or money-like text, and any field about names, merchants, notes or accounts.
- Google automatically collects: an app-instance identifier, device model and OS, app version, language, a general location derived from the IP address, and may automatically record in-app purchases (product and price).
- We do not link this data to your name, email or sign-in account.
Firebase Crashlytics (Google)
- When a crash or technical error happens, it sends: the technical error log, device model and OS, app version and an installation identifier. The app does not add your financial data to reports, but the technical error text is sent as it is.
Switching off
In Settings (the card with "About App"): Share Usage Statistics [مشاركة إحصاءات الاستخدام] and Send Crash Reports [إرسال تقارير الأعطال]. Both are on by default. Turning crash reports off also deletes reports not yet sent.
Note: the "Help Us Improve" [ساعدنا نحسّن] switch does not currently send any data.
6. Notifications
- Budget, salary, recurring, instalment and zakat reminders are scheduled on your device and do not go through any server.
- After you allow notifications, the app registers your device with Firebase Cloud Messaging, which gives the device a notification token, and subscribes it to a single general topic named
allthat we use to send general announcements about the app to all users, such as new features. These announcements do not contain your data. - To stop them, turn off notifications for Masroofi in your device settings.
7. Subscription (RevenueCat)
Payments go through the App Store or Google Play; we never see your card details. We use RevenueCat to check your subscription. It receives purchase information from the store and an anonymous ID created by RevenueCat. We do not send it your name, email or financial data.
8. Other connections
- Bank message patterns: at most once every 24 hours the app downloads an updated list of bank names from
masroofi-patterns.web.app(hosted on Google's Firebase Hosting). None of your data is sent with this request, but the server sees your IP address as with any internet connection. - QR reading on Android: uses Google's on-device ML Kit library. According to Google, the library sends performance, usage and device information to Google, and does not send images.
- All connections use HTTPS. On Android the app blocks unencrypted connections.
9. Permissions
- Camera: to photograph receipts and read QR codes.
- Photos: to pick a receipt photo.
- Notifications: for reminders and general announcements.
- Face ID or fingerprint: to lock the app. Biometric data never leaves your device and we cannot access it.
The app does not request SMS, contacts, location, microphone or the advertising ID, and it does not connect to your bank account.
10. Who data is shared with
We do not sell your data or share it for advertising. These providers process data on our behalf or to run a feature you use:
- Google — Firebase (Authentication, Firestore, Analytics, Crashlytics, Cloud Messaging, Hosting), Google Sign-In, ML Kit and Block Store: firebase.google.com/support/privacy · policies.google.com/privacy
- Apple — Sign in with Apple, iCloud Drive and iCloud Keychain: apple.com/legal/privacy
- RevenueCat — subscription management: revenuecat.com/privacy
This data may be processed on servers outside your country, under these providers' terms.
11. How long data is kept
| Data | Where | How long |
|---|---|---|
| Your financial records and receipt photos | Your device | Until you delete them or the app |
| Export files and safety copies on the device | Your device | Until you delete the app |
| Automatic iCloud copies | Your iCloud Drive | Until you delete them |
| Encrypted cloud copy | Google Cloud Firestore | Until Disable Sync or Delete Account; removed from our database the moment you confirm |
| Sign-in account | Firebase Authentication | Until the account is deleted. According to Google it is then removed from live and backup systems within 180 days; IP-address logs are kept for a few weeks |
| Usage events | Google Analytics | At most 14 months for event-level data. Aggregated reports that do not identify you may be kept longer |
| Crash reports | Firebase Crashlytics | 90 days, according to Google |
| Notification token and installation ID | Firebase Cloud Messaging | Per Firebase's policy, until the ID is deleted |
| Purchase records | RevenueCat and Apple/Google | Per those providers' policies |
12. Your rights and choices
- Get a copy of your data: Settings → Backup & Sync → Export backup.
- Delete the data on your device: Settings → Delete all data [حذف جميع البيانات] (the last card). It deletes transactions, wallets, budgets, recurring items, debts, loans, goals and zakat records. It keeps currency, language, PIN, subscription status and receipt photos. Before deleting, the app saves an unencrypted safety copy on your device so you can undo; it appears under Settings → Backup & Sync. The app does not currently offer a button to delete on-device copies, so they stay until you delete the app. Deleting the app removes everything in its storage on the device.
- Delete the cloud copy or your account: section 3 and the account deletion page.
- Switch off statistics and crash reports: section 5.
- Access, correction or deletion requests by email: write to support@rkeb.sa. We cannot link analytics or crash data to you, because it carries no name or email.
- You may complain to the data-protection authority in your country; in Saudi Arabia this is the Saudi Data & AI Authority (SDAIA).
Legal basis
Cloud Sync and sign-in: your consent when you turn them on. Subscription management: performing the purchase you asked for. Statistics, crash reports and general notifications: our legitimate interest in running and improving the app, with your right to switch them off at any time.
13. Children
The app is not directed at children under 13, and we do not knowingly collect their data. If you learn that a child created a cloud account, contact us and we will delete it.
14. Security
The database is kept inside the app's storage on your device, and you can lock the app with a PIN or biometrics. Cloud copies are encrypted before they leave your device, and in Firestore only your account can read or write them. No system is perfectly secure, so keep your backups somewhere safe and do not share unencrypted files.
15. Changes to this policy
If what the app does with your data changes, we will update this page and the "Last updated" date at the top.
16. Contact
Any question or request: support@rkeb.sa (Arabic or English).