Privacy Policy
In short. Masarif keeps your financial records on your phone. You create no account, and the app contains no advertising, analytics or tracking. The only service we run is one that briefly holds a grocery list you choose to share with a shopkeeper, in encrypted form that we cannot read.
Information leaves your phone only when you choose an action that sends it, such as sharing a grocery list with a shopkeeper, pushing a statement to your own Google Sheet, sending a WhatsApp reminder, or sharing an export. Those actions are listed below.
Who we are
Masarif ("the app") is published by Masarif Finance ("we", "us"). You can reach us at alizubair686@gmail.com.
Information the app stores on your phone
Everything you enter stays in the app's private storage on your device:
- Transactions: titles, amounts, dates, items, budget categories and recurring schedules.
- Budgets and their limits.
- Assets and their recorded values, and automatic contribution settings.
- Loans: the person's name, an optional phone number, amounts, due dates and repayments.
- Money held for others: the person or fund name, notes, entries and items, and an optional Google Sheet link you provide.
- Zakat estimate settings.
- Grocery lists: list names, items, quantities and prices, and, while a list is shared, the link and key needed to read the shopkeeper's answers.
- An unfinished transaction, kept as a draft until you save or discard it.
- A photo you attach to a transaction, such as a receipt. The app keeps its own copy in its private storage. It is not uploaded anywhere and is not included in backups or exports.
- App settings: language, alerts, and app lock. If you set a passcode, it is kept in your device's secure storage.
We cannot see any of this. The app connects to a service operated by us only when you share a grocery list, and what it sends then is encrypted so that we cannot read it (see "Sharing a grocery list" below).
How the stored information is protected
The records are kept in a database inside the app's private storage, which other apps cannot read on a standard, unmodified Android device. The app does not add its own encryption to this database; it relies on the protection Android and your device provide, including your screen lock and device encryption. You can add an app lock with a passcode and, if you choose, fingerprint or face unlock.
Backups you create in the app are encrypted with a recovery passphrase that you choose. CSV and PDF exports are not encrypted.
When information leaves your phone
Only through these actions, each started by you:
| Action | What is sent | Who receives it |
|---|---|---|
| Share a grocery list with a shopkeeper | That list's name and items, encrypted on your phone before it is sent. The shopkeeper's answers (what was taken, quantities and prices) are encrypted in their browser in the same way | Our list-sharing service, which stores the encrypted list until the link expires (1, 6 or 24 hours, as you choose) or you end it. Anyone you give the link to can read and fill in that list |
| Push to Google Sheet (money held for others) | That one person's or fund's name, purpose, entries, items and balance | Google, into a Google Sheet in your own Google account, through a script link you set up |
| WhatsApp loan reminder | The reminder text, including the person's name, the amount and any due date, and the phone number you saved | WhatsApp, on your phone. Nothing is sent until you press send in WhatsApp |
| Share a CSV or PDF export, or an encrypted backup | The file you create | The app or person you choose in the share sheet |
| Dictate a transaction by voice | Your speech, while you are dictating | The speech recognition service of your device (for example Google's), which may process audio over the internet |
Information handled by Google, WhatsApp or your device's speech service is subject to their own privacy policies. If you share a Google Sheet with someone, they can see what is in that sheet.
Sharing a grocery list
When you share a grocery list, the app encrypts it on your phone and uploads the encrypted copy to our list-sharing service, which runs on Cloudflare. The key that unlocks it is part of the link you send and is never sent to the service, so neither we nor Cloudflare can read the list or the shopkeeper's answers.
- The link is the permission: anyone who has it can read and fill in that list until it expires. Send it only to the shopkeeper.
- The encrypted list is deleted when the link expires (1, 6 or 24 hours after sharing, as you choose) or as soon as you end the link in the app. Expired lists are removed from storage within a day.
- To limit abuse, the service counts requests from each network address. It keeps the address only as a scrambled value inside a counter that lasts at most one hour. Cloudflare also processes network addresses to deliver the service, under its own privacy policy.
- If the shopkeeper uses Masarif and chooses "Save to my Masarif", their app downloads the same encrypted list and saves the sale on their own phone.
Permissions the app asks for
- Contacts (optional): only when you tap "Contacts" on a loan, to let you pick one person. The app saves that person's name and number with the loan on your phone. It does not copy your address book, upload contacts, or change them.
- Microphone (optional): only while you dictate a transaction. The app does not keep audio recordings.
- Notifications (optional): to show budget alerts created on your device.
- Fingerprint or face unlock (optional): to unlock the app. Your device performs the check and tells the app only whether it succeeded; the app never receives biometric data.
- Photos: no permission is requested. When you attach a photo, your phone's own photo picker opens and gives the app only the one photo you choose; the app cannot browse your gallery.
- Internet: used for sharing a grocery list, for the Google Sheet push and, if your device's speech service needs it, for dictation.
You can refuse or withdraw any optional permission in Android settings and keep using the rest of the app.
What we do not do
- We do not sell, rent or share your personal or financial information, and we hold nothing of yours that we can read.
- We do not show advertising or use advertising identifiers.
- We do not use analytics, crash reporting or tracking tools.
- We do not read your SMS messages or connect to your bank.
Information about other people
You may record details of other people, such as someone you lent money to or a relative whose money you hold. You are responsible for having a proper reason to keep that information and for whom you share it with, for example through a Google Sheet or a WhatsApp message.
Keeping and deleting your information
Your records stay on your phone until you delete them. You can delete individual records in the app. Clearing the app's data in Android settings or uninstalling the app removes everything it stored on the device. This cannot be undone unless you kept a backup.
Copies you have sent elsewhere, such as a Google Sheet, a shared export or a WhatsApp message, are outside the app. Delete those where they are kept. A shared grocery list is the only thing we hold, encrypted and only until its link expires; end the link in the app to delete it sooner. Because we cannot read it and hold nothing else, we have nothing to hand over on request, but you are welcome to contact us with any question.
Children
Masarif is a finance tool intended for adults. It is not directed at children under 13, and we do not knowingly collect information from children.
Changes to this policy
If the app changes in a way that affects your privacy, we will update this page and its effective date before the change reaches you through an app update.
Contact
Masarif Finance · alizubair686@gmail.com