Privacy Policy

1. Information We Collect

We collect the following types of information:

Financial data

Amount, merchant, category, and balance - extracted on your device from your bank's SMS alerts. The raw text of the message itself is never collected; Masarefi keeps only these extracted fields, plus a one-way cryptographic hash of the message used solely to detect duplicates.

Account data (optional)

If you create an account, we store your account identifier and your categorized transactions, backed up automatically - which may include a counterparty's name for a person-to-person transfer you've received.

Device diagnostics

If the app crashes, a diagnostic report may be sent to help us fix the bug. It is stripped of transaction data and your IP address before it leaves your device.

What we don't collect

We have no bank API access and no email account access. We never read contacts, photos, location, or the microphone. Masarefi is currently iOS-only; SMS access works through a Shortcut you configure yourself.

2. Why We Process Your Data

• To provide the app - turning your bank's SMS alerts into categorized transactions is the core function you installed Masarefi for.
• With your consent - for Smart categorization and for creating an account with cloud backup. You can withdraw this consent at any time.
• Legitimate interest - for crash diagnostics that keep the app working, stripped of transaction data and your IP address.

3. How We Use Your Information

We use the information we collect to:

• Turn a bank SMS into a categorized transaction
• Show you a running picture of your spending by category and month
• Guess a category for a message our own parser couldn't classify, only if you've turned Smart categorization on
• Back up your categorized transactions so you can restore them on a new device, only if you have an account
• Fix bugs, using crash reports

We do not sell, rent, or trade your personal or financial data to any third party. We do not show ads and have no advertising SDK.

4. SMS & Transaction Data

Masarefi reads incoming bank SMS alerts on your device and extracts the amount, merchant, category, and balance from them. Here is exactly how it works:

• Masarefi is currently iOS-only; SMS reading requires your explicit setup, through a Shortcut you configure yourself
• The raw text of your bank's message is never stored or transmitted anywhere
• Masarefi works fully signed out, with your transaction data stored only on your device
• Besides the optional services described below, only two limited network calls happen without an account - fetching a public catalog of merchant logos, and looking up a currency exchange rate when converting a non-Jordanian-dinar transaction - and neither ever includes your transaction data, message content, or any personal information
• You can stop this at any time by disabling or deleting the Shortcut in the iOS Shortcuts app

5. Data Storage & Security

Your transaction data lives only on your device unless you create an account. If you have an account, your backup is stored in a database row that only your account can access. Before anything is sent to Google's Gemini API for Smart categorization, every digit in the message is masked - amounts, balances, account numbers, and dates are removed by shape. A message containing a person's name, such as a CliQ transfer, is excluded from that path entirely. No system is perfectly secure, but no raw SMS text is ever transmitted or stored anywhere, which removes the biggest exposure this kind of app could have.

6. Third-Party Services

Masarefi integrates the following third-party services, each strictly limited to what it needs:

• Google Gemini - optional, off by default; guesses a category for a redacted, digit-masked message our own parser couldn't classify
• Supabase - hosts a public, read-only catalog of merchant logos (no account needed), and your optional account and cloud backup
• A currency exchange-rate API - looked up only when converting a non-Jordanian-dinar transaction; no personal data is sent
• Sentry - crash diagnostics, stripped of transaction data and your IP address
• Apple, via RevenueCat - subscription management, tied to your Apple ID, not to any Masarefi account

We do not use any analytics SDK, advertising network, or data broker.

7. Analytics & Tracking

Masarefi does not use any analytics SDK, cookies, advertising trackers, retargeting pixels, or fingerprinting technologies.

8. International Data Transfers

The third-party services listed above are global infrastructure, so data may be processed on servers outside Jordan - Google's, if you turn on Smart categorization; Supabase's, for the merchant logo catalog and any optional backup; and Sentry's, for crash diagnostics.

9. Data Retention

Local data on your device stays until you delete a transaction or uninstall the app. If you delete your account, our account-deletion function removes your account and its server-side data immediately, and removes this device's copy of it too. Transactions you saved before signing in are not part of the account and stay on the device.

10. Your Rights

• Access & correct - view and edit your transactions and categories at any time in the app
• Erase - permanently delete your account and its server-side data from Profile → Account, or uninstall the app to remove everything stored on your device
• Withdraw consent - turn Smart categorization on or off at any time

To exercise any of these rights, contact us at the address below.

11. Managing Your Consent

• Smart categorization - toggle it in Profile
• Account & cloud backup - sign out or delete your account from Profile → Account

Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

12. Children's Privacy

Masarefi is not directed at children and is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children.

13. Changes to This Policy

If this policy changes in a material way, we'll update the effective date above and, where practical, note it inside the app.

14. Contact Us

Questions about this policy, your data, or exercising your rights can be sent to support@masarefi.app.