1. Overview
This Privacy Policy explains how Sarfyaty ("we", "us", "our") collects, uses, and protects your data when you use our expense-tracking service. We take your privacy seriously — your financial data is personal and sensitive, and we handle it with the care it deserves.
By using the app, you agree to the practices described here. If you don't agree, please don't use the service.
2. What we collect
Information you give us directly when you create an account or use the app:
- Name, email address, and password (encrypted).
- Your expenses, income, budgets, savings goals, and debt records.
- Categories, tags, accounts, and wallets you create.
- Notes and descriptions you write.
- Receipt images you upload.
- Currency, timezone, and preferred language.
Information collected automatically:
- IP address, browser, and device type (for security and debugging).
- Access and error logs (for service maintenance).
- Data in your browser's local storage (for UI preferences and offline mode).
Information from third parties if you sign in with Google:
- Your name, email, and profile picture from your Google account.
- Your Google unique identifier (to link future sign-ins).
Subscription and payment information: your plan tier (Free or Premium), its status and expiry date, and — if you purchase Premium — a record of the payment (such as the order reference, amount, currency, provider, and status). Payments are processed by third-party payment providers (for example, ZainCash); we do not collect or store your card or wallet credentials.
3. How we use your information
We use your data exclusively to operate and improve the app:
- Display your expenses, statistics, and personalized recommendations.
- Send reminders, summaries, and alerts you've enabled in settings.
- Scan receipts to auto-fill expense details.
- Sync expenses added while offline once you're back online.
- Protect your account and detect suspicious activity.
- Respond to your questions via the support form.
- Let authorized administrators access or act within your account for support and moderation when necessary — every such action is recorded in an audit log.
We never sell your data. We don't share it with advertisers, data brokers, or any third party for marketing purposes.
4. Data storage and security
Your data is stored on servers hosted through Hostinger. Passwords are hashed using bcrypt. All connections are encrypted via HTTPS/TLS.
We take reasonable steps to protect your data, but no system is 100% secure. If we discover a breach that affects your data, we'll notify you as soon as possible.
5. Third-party services
The app relies on a limited number of third-party services:
- Google OAuth: for sign-in with Google. Subject to Google's Privacy Policy.
- OCR.space: to read receipt text. Only the image file is sent.
- Payment providers (e.g. ZainCash): to process Premium purchases. They receive the payment details needed to complete the transaction; we receive only a confirmation and reference.
- Google reCAPTCHA: to protect the support form from spam.
- Web Push Services (Firebase / Mozilla / Apple): to deliver push notifications.
- Your SMTP provider: to send email (reminders, alerts, password reset).
Each service receives only the minimum data required for its specific function.
7. Push notifications
If you enable push notifications, we store your browser's subscription identifier solely to send alerts. You can unsubscribe at any time from the notifications settings page, and the identifier will be deleted immediately.
8. Data retention and deletion
We retain your data as long as your account remains active.
When you request account deletion: you can choose a 30-day grace period during which you can cancel, or immediate permanent deletion. When deletion completes, your personal data is permanently deleted (expenses, budgets, accounts, goals, debts, tags, settings, notes, receipts).
Records of payments and subscriptions may be retained in anonymized form — detached from your identity — where required for accounting, tax, or legal purposes. Guest accounts created via "Continue as a guest" are temporary and are automatically deleted after a short period if not converted to a full account.
We may also keep anonymized records (without personal information) for service improvement, or legally required information if the law requires it.
9. Your rights
You have the right to:
- Access your data: through the app directly, or by contacting us.
- Correct any information: edit via the settings.
- Export: download your expenses as PDF or CSV.
- Delete: from the "Danger zone" section in settings.
- Object to specific processing: by contacting us.
10. Children's privacy
This service is not directed to children under 13, and we don't knowingly collect information from them. If you're a parent or guardian and discover your child has created an account, contact us to have it deleted immediately.
11. Changes to this policy
We may update this policy from time to time. We'll notify you of any material changes via email or in-app notice at least 30 days before the change takes effect.
12. Contact us
If you have a question about this policy or our privacy practices, email us at support@sarfyaty.com or use the Support button inside the app.