Privacy Policy
This policy explains what Mahwarak collects, why, where it is stored, who it is shared with, and how you control it.
1. Introduction
Mahwarak is a personal money organiser for your accounts, transactions, debts, goals, and budgets. By using the app, you agree to this policy.
2. The core idea: financial data on your device
- By default, everything you record stays in an encrypted database on your phone.
- The app works without an account and without internet.
- We can't see or sell your financial data. If you enable optional sync, changes are encrypted on your phone before upload.
3. What we collect
Without an account, no financial data is sent to us. See the exchange-rate and advertising sections.
- Optional cloud account: email address, account ID, linked device names, and last-used times for sign-in, device linking, and recovery.
- Google sign-in gives us only your email and ID. We don't access your Google mail or files.
- Optional sync: changes are encrypted on your phone before upload. You hold the key, and the server can't read the data.
- Subscriptions and codes, when available: activation code, plan, expiry, and an anonymous installation ID. We don't collect card details.
- Referrals, when available: your referral code and activation count. We don't access contacts.
4. Phone permissions
- Camera: to photograph receipts and read QR codes. Processing happens on-device and temporary files are deleted.
- Notifications: for dates you choose.
- Biometrics or screen lock: to lock the app. We don't access your fingerprint.
- Internet: for rates, optional account and sync, and ads.
- Run after reboot: to reschedule reminders.
- The app doesn't request your microphone, location, contacts, or messages.
5. Assistant and receipt reading
Both run on your phone. What you type and receipt photos aren't sent to a server or external AI service.
6. Exchange rates
The app fetches rates from our server, which collects official central-bank rates and public sources. Requests carry no information about you or your money.
7. Advertising
- The free version may show Google AdMob ads in specific places, plus an optional rewarded ad.
- No financial data or record data is passed to ads.
- AdMob uses the advertising ID and technical device data to deliver, measure, and secure ads under Google's privacy policy. Android settings let you control ad personalisation.
- In the EU and UK, consent is requested before personalised ads.
- Plus subscribers see no ads. Ads do not appear on amount entry, payment, lock, or backup screens.
8. Service providers
We do not sell data. We share only what is necessary with these providers or where the law requires.
- Supabase: account and sync hosting in Frankfurt, Germany.
- Resend: verification email delivery.
- Google: sign-in, AdMob, and Google Play services.
- Cloudflare: website hosting and email routing.
9. Data security
The phone database is encrypted. Sync data is encrypted on your device, and you hold the key. If you lose every device and the key, we can't recover encrypted server data.
10. Retention and deletion
- Phone data stays until you delete it from Settings › Data › Delete data.
- Delete a cloud account and its server data from Settings › Account › Delete cloud account, or email privacy@mahwarak.com from the linked address. We complete requests within 30 days.
- Finished items are removed after the period you choose; the default is 12 months.
- Backups are files you keep and control.
11. Your rights
You can access, export, correct, and delete your data, object to processing, and withdraw consent. Email privacy@mahwarak.com.
12. Children
The app is for people aged 18 and over. We don't knowingly collect data from anyone younger.
13. International transfers
Cloud-account data may be processed in other countries, including Germany, by the providers listed above.
14. Changes
If this policy changes, we update the page and date and notify you in the app before material changes take effect.
15. Contact
Privacy: privacy@mahwarak.com
Support: support@mahwarak.com