Privacy Policy for Masareef

Masareef is a spending tracker that can read your bank's payment notifications on your device, sort your money into wallets, budgets and insights, and find ATMs near you. This page explains exactly what it stores, what it sends, and to whom.

Last updated: 27 July 2026 · Covers app version 1.46.0 and later · Package com.mohamedgado.masareef

1. Who we are and what this covers

Masareef (com.mohamedgado.masareef) is built and operated by one person, Mohamed Gado. This policy covers the Masareef Android app, any future iOS release, the backend the app talks to (masareef-server.vercel.app), and this page itself. The page sets no cookies and loads nothing from another host.

You can open this policy from inside the app at any time: Settings, then Privacy policy. The in-app How it works page describes the same behaviour in plain language.

One design rule drives everything below: the raw material stays local. Your bank's notification text, the drafts parsed from it, and the diagnostics about that parsing never leave your phone. What does leave is the finished record you kept, so your own devices can agree on it.

2. Your account

Masareef requires an account, so signing in is not optional. You can sign up with an email address and password, or sign in with Google. Authentication runs on our backend using better-auth.

Stored on our server for your account:

• Your display name and email address, and whether that email is verified.
• A one-way hash of your password (never the password itself). Google sign-in stores no password at all.
• Sessions: an opaque session token, creation and expiry times, and the user agent of the device that signed in.
• For Google sign-in: the account link Google gives us (a provider account id and the tokens needed to verify it), plus the email, name and profile picture URL from your Google profile. We never see your Google password.
• An optional profile photo, if you upload one (section 9).

Account emails (verify your address, reset your password) are sent through Resend, which processes your email address to deliver them. We do not run newsletters and do not send marketing email.

3. What stays on your device

The app keeps a local SQLite database, a key-value store (MMKV), an app-private files directory, and an encrypted keystore (Android Keystore, through expo-secure-store) for your session. The following lives in those and is never uploaded:

• Auto-track captures: the pending review inbox and the record of already-handled messages, including the message text a capture came from.
• Trusted senders you marked, and the auto-track diagnostics trace (a redacted, truncated snippet per money-shaped message, so you can see what the reader did).
• Every setting: theme, language, currency, country, default wallet, notification preferences, haptics, App Lock and its grace period, screen privacy, hidden balance cards, dismissed hints.
• Your last known coordinates, cached so the ATM screen need not ask again.
• Travel mode trips: trip name, country, currency and the rate you locked.
• Your profile photo's local copy, and the session cookie in the encrypted store.
• Everything derived: insights, subscription radar, duplicate-charge and refund detection, price-creep and personal-inflation numbers, net worth and cash-flow trends, safe-to-spend, no-spend streaks, Wrapped. All of it is computed on your device from your local data. None of it is computed on a server.

4. What syncs to our server

Because the app is account-based, the records you keep are synchronised so your phone, a replacement phone, and a reinstall all see the same data. Sync is automatic and offline first: it runs after sign-in, when the app comes to the foreground, and on a slow background heartbeat while the app is open. There is no manual "sync now" button, and conflicts resolve by last write wins.

So yes: amounts and merchant names are stored on our server. Being straight about that matters more than a nicer sentence. They are sent over TLS, scoped to your user id, and held in a PostgreSQL database (Neon) reached through our Vercel backend. They are never used for advertising, never sold, never shared with a data broker, and never forwarded to the analytics services in section 12.

5. Auto-track and notification access

Auto-track is the feature that saves you daily typing: it reads incoming payment notifications and turns them into transactions. It is enabled in Settings by default but completely inert until you grant Android's notification-access special permission yourself, in the system settings screen the app sends you to. Until then it reads nothing.

What it does once you grant access

• An allowlist decides what is even looked at. A notification is considered only when its sender or package matches a known bank, card issuer or payment wallet, and it is dropped when it matches a denylist (promotions, one-time codes, airtime top-ups). Notifications from chat apps, email, social apps and everything else are never parsed. There is no "any message with a number in it" fallback: that fallback existed once, leaked a non-bank message, and was removed.
• Parsing happens entirely on your device. Amount, currency, direction, merchant, card tail, timestamp and balance are extracted by code inside the app. The message text is never sent anywhere.
• The result is a draft in a local inbox. You review it and confirm, edit or discard it. If you turn on auto-accept, high-confidence captures post themselves and you get an optional confirmation notification. Senders you explicitly mark as trusted post without review until you revoke that trust in Settings.
• It survives the app being closed. A message that arrives while Masareef is killed is written to a durable on-device spool first, then parsed by a background task, so nothing is lost. The spool holds the message only until it has been handled.
• Diagnostics are redacted. Settings has a diagnostics screen listing what the reader did with each money-shaped message. Card numbers and similar identifiers are masked, snippets are truncated, and messages that are not money-shaped are not logged at all. It is a local log; it is never uploaded.

Turning Auto-track off in Settings stops all of it, and revoking notification access in Android settings stops it at the OS level. Neither affects the transactions you already kept.

6. Typing, pasting and sharing a message

Three manual paths exist, and all three parse on the device:

• Quick add: an optional persistent notification with a reply box, so you can log an expense by typing one line. What you type becomes a local transaction.
• Paste: you paste a bank message into the app and the same on-device parser proposes a transaction.
• Share into Masareef: you share a message's text from another app through Android's share sheet. Masareef receives that text, parses it locally, and proposes a draft. Nothing is uploaded by the act of sharing.

A transaction you then save syncs like any other record (section 4). The original message text does not.

7. Location

Location is optional and requested only while you are using the app. Two features ask for it:

• Nearby ATMs: your coordinates are used to look up cash machines around you.
• Region and currency: once during setup, or when you tap it in Settings, your coordinates are turned into a country and city name so the app can pick a sensible currency and bank list. Only the resulting country, city and currency are saved; if you picked a region by hand, GPS never overwrites it.

Coordinates go to two places: our ATM endpoint (section 8) and BigDataCloud for reverse geocoding into a place name. Your last coordinates are cached on your device so the ATM screen does not have to ask again. There is no background location, no location history, no movement profile, and no advertising use.

Deny the permission and the app still works: pick your country by hand in Settings, and search for ATMs at any pinned point on the map or by searching a city name (which is sent to Open-Meteo's geocoding search as the text you typed).

8. Nearby ATMs and the map

The map is rendered natively with MapLibre using vector tiles from OpenFreeMap. As with any map, the tile server sees the tiles your device requests and its IP address. No account, no key and no identifier is attached to those requests.

ATM pins are fetched like this:

• The app asks our own endpoint with a latitude, longitude and radius. That endpoint requires no sign-in and receives nothing that identifies you or your money.
• On a cache miss, the endpoint rounds the point into a coarse cell of roughly a kilometre and queries commercial and open map sources with keys that stay on the server: TomTom, Foursquare and Geoapify, with the public OpenStreetMap Overpass mirrors as a keyless last resort. Only that coarse cell is cached, shared by everyone who looks near the same place, so a repeat search hits our database and no upstream service at all.
• If our backend is unreachable, the app queries the public Overpass mirrors directly. In that fallback the mirror sees your coordinates and your IP address, because it is answering your device directly.
• Tapping Directions hands the ATM's coordinates to Google Maps or whichever maps app you choose. That is a normal deep link, and Google's policy applies from there.

Bank logos and pin artwork are bundled inside the app. No logo is fetched at runtime.

9. Profile photo

A profile photo is optional. Masareef uses Android's system photo picker, so the app never receives photo-library permission and never sees any image other than the one you pick. The chosen image is copied into the app's private directory so it survives.

When you are signed in, that image is uploaded to our backend and stored as a file on Vercel Blob, so the same avatar appears after a reinstall or on another device. The stored URL is not guessable but it is not access-controlled either: treat it as a photo published at an unlisted address, and do not use a picture you would not want at a public URL. Clear the photo in the app to stop using it, and email us to have the stored file deleted.

10. Notifications and reminders

Every notification Masareef shows is a local notification, scheduled and fired on your device: budget alerts, the weekly or monthly spending digest, bill reminders a few days before a recurring item is due, the weekly "count your cash" nudge, auto-track confirmations, and the quick-add reply box.

There is no push server. The app never registers a push token, and nothing about your spending is sent anywhere in order to produce a reminder. Push plumbing ships inside the notification library we depend on, and we send no messages through it.

11. Exchange rates and Travel mode

Travel mode records a trip and converts spending in a foreign currency back to your home currency. Trips are stored on your device only. To get a rate the app calls the public ExchangeRate-API endpoint with a currency code and nothing else. No amounts, no trip details and no identifiers are sent.

12. Analytics and crash reporting

To see which screens are actually used, whether sync and auto-track are working in the field, and where the app crashes, Masareef sends usage events to PostHog (EU region, eu.i.posthog.com) and performance data to Expo EAS (Insights and Observe).

What is sent

• Event names from a fixed list defined in the app's source, for example screen_view, txn_added, sync_completed, autotrack_toggled, capture_reviewed, atm_search, theme_changed, app_lock_toggled.
• Low-cardinality properties beside the event: counts, enums, booleans, a currency or country code, a reason code such as why a capture was held for review.
• Technical context: app version, platform and OS version, device model, launch and navigation timings, and whether an update was downloaded.
• Errors: uncaught JavaScript exceptions and unhandled promise rejections, with stack traces.
• An identifier: while you are signed in, events are attached to your account's random id so one person's events are not counted as many. That id is the internal UUID from our auth system, never your email address. The events are pseudonymous rather than anonymous, and we say so plainly.

What is never sent

• Any amount, balance, running total, merchant name or account number.
• Any notification, SMS or pasted message text, and any parsed draft.
• Your coordinates, your name, your email address, your contacts or your app list.
• No session replay, no screen recording, no keystroke capture, no console capture, no advertising identifier, and no third-party advertising or attribution SDK. The app contains none.

13. Exports, backups and restore

You can export your data as a file and restore from one. An export is written to the app's own cache directory and handed to Android's share sheet, so the file goes only where you send it: your drive, a chat, your file manager. We never receive a copy, and after that the receiving app's privacy policy applies.

Restoring reads a file you pick with the system document picker and applies it on the device. An export is deliberately unencrypted so you can read and restore it, which also means it contains your financial detail in plain form. Keep it somewhere you trust.

14. App updates, rating and sharing

• Over-the-air updates: the app can fetch a JavaScript update from Expo's update service. The request carries the app version, the release channel, the runtime version and the platform. No personal or financial data is involved.
• Store updates: when a new version is on Google Play, the app can show Play's own in-app update prompt. That exchange is between your device and Google Play.
• Rating: the rate row opens Google Play's rating dialog. We never see what you type there beyond the public review anyone can read.
• Sharing the app: the share sheet sends a Play Store link, as plain text, to whoever you choose. Nothing about your data is attached.

15. Privacy features inside the app

• App Lock: optional fingerprint, face or device-PIN gate on opening the app, with a grace period you choose. The check is performed by Android; the app receives a yes or no and never any biometric data. If a device cannot satisfy the lock any more, the setting disables itself rather than locking you out.
• Screen privacy: on by default. It blocks screenshots and screen recording and blanks the app's preview in the recent-apps switcher, using Android's secure-window flag. Turn it off in Settings if you need to take a screenshot.
• Hide balances: mask every amount on the dashboard, or hide individual money cards.
• Session storage: your session lives in the encrypted keystore and is excluded from Android's cloud backup, so it cannot travel to another device inside a device backup.

16. Android permissions

17. How we secure data

• All network traffic uses HTTPS with certificate validation. The release build permits no cleartext traffic.
• On the device, your database, settings and files live in app-private storage that Android isolates from other apps. Your session token sits in the OS keystore.
• On the server, passwords are stored only as one-way hashes by better-auth, every sync query is scoped to your own user id, and the API keys for the map and place services stay server side, never inside the app.
• The message text that auto-track reads is the most sensitive material the app touches, which is exactly why it never leaves the device and why the diagnostics log redacts it.
• A file you export yourself is unencrypted by design, so its safety is in your hands (section 13).

No absolute guarantee is honest for any service. What we can say is that the categories of data most likely to hurt you if leaked, message text and raw captures, are not in our database at all. If you find a vulnerability, email us before disclosing it publicly.

18. Retention and deletion

• On-device data is kept until you delete it, uninstall the app, or clear its storage in Android settings. Any of those removes it permanently, including the capture inbox and the diagnostics log.
• Synced records are kept while your account exists. Deleting a record in the app deletes it on the server on the next sync pass.
• Your account and everything synced under it are deleted on request, within 30 days. See the account deletion page.
• Analytics events are held by PostHog and Expo under their own retention windows, keyed to the random account id described in section 12, and deleted on request.
• The ATM cache on our server holds map data for coarse geographic cells. It contains no user id and nothing personal, so there is nothing in it to delete.

19. Your rights

If you are in the EU, the UK, or California, you have rights of access, correction, deletion, portability and objection. In practice:

• Ask us and you get a copy of the rows stored under your account, or their deletion.
• Most of what the app knows about you never reaches us at all, so you can inspect and delete it yourself, on the device.
• We do not sell your personal information, do not share it for advertising, and do not build advertising or credit profiles from it.
• Legal bases: performing the service you asked for (your account and sync), your consent (location, notification access, notifications, uploading a photo), and legitimate interests (keeping the app working, fixing crashes, preventing abuse), which is where the pseudonymous analytics in section 12 sit.

20. Children's privacy

Masareef is a personal finance app intended for adults. It is not directed at children under 13, and we do not knowingly collect their data. If you believe a child created an account, email us and it will be deleted.

21. Third-party services

These are every outside party involved, and the ones your device contacts directly are marked as such:

• Vercel hosts our backend and stores uploaded profile photos on Vercel Blob (device contacts it)
• Neon hosts the PostgreSQL database behind our backend (server side only)
• Resend delivers account emails (server side only)
• Google for optional Google sign-in, Google Play distribution and updates, and Maps directions when you tap them (device contacts it)
• PostHog for usage analytics and error tracking, EU region (device contacts it)
• Expo for over-the-air updates and performance metrics (device contacts it)
• OpenFreeMap for map tiles, built on OpenStreetMap data (device contacts it)
• Overpass API mirrors for ATM data as a keyless fallback (device contacts them only when our backend is unreachable)
• TomTom, Foursquare and Geoapify for ATM and place data (server side only, queried with a coarse location cell)
• BigDataCloud turns coordinates into a country and city name (device contacts it, only with your permission)
• Open-Meteo for city search by name (device contacts it, sends the text you typed)
• ExchangeRate-API for currency rates (device contacts it, sends a currency code)

There is no advertising network, no attribution SDK and no data broker in this list, and none in the app.

22. Changes to this policy

We update this page whenever a feature or a data flow changes. The date at the top reflects the current version, the full history is public in this page's GitHub repository, and material changes are called out in the app's release notes.

23. Contact