Privacy policy

Who provides Sarfak?

The developer of Sarfak provides the service. Use the contact details below for support and privacy requests.

Data we process

• Account information: your name, email, account identifier and account creation time.
• Expense records: the amounts, categories, dates and optional notes you enter, plus monthly and category budgets, recurring schedules, their dates, cadence and active status.
• Authentication information: a secure password hash and time-limited login sessions. Passwords are not stored in plain text.
• The hosting infrastructure may process connection and operational security data such as IP addresses, request times and errors.

The current version does not request bank credentials, contacts, precise location or photos.

How we use data

We use data to create and authenticate your account; save, display, edit and delete your expenses and budgets; protect the service against abuse; and respond to support or privacy requests. Expense data is not used for advertising or tracking across apps.

Where records are stored

Account, expense and budget records are stored in PostgreSQL hosted by CranL. The current backend and database are configured in its Riyadh region. Hosting infrastructure and content delivery networks may process operational connection data according to their settings and policies.

Financial records are loaded into app memory while in use. The app does not save them in local files or a persistent network cache. Only a session token is retained in iOS Keychain to access your account. An internet connection is required to load or change records.

Service providers and sharing

CranL hosts the backend, database and website and may process data needed to provide hosting. We do not sell your data. The current app has no advertising SDKs or third-party analytics integrations. We may disclose information when necessary to meet an applicable legal obligation.

Retention, deletion and backups

We retain account records while the account exists. You can edit or delete expenses, or delete your whole account in the app by confirming your password. A successful account deletion removes the account, expenses, budgets, recurring schedules and occurrence receipts, and login sessions from the active database.

Deleted data may remain in isolated recovery backups during their retention cycle. The last 14 scheduled daily backups are retained; manual backups may remain until removed. Backups are for disaster recovery and cannot be accessed through the app. Hosting operational logs may have separate retention periods.

Uninstalling the app does not delete your server account.

Your choices and requests

You can review, edit and delete your expense and budget records in the app, sign out to revoke your session, or delete the account. Contact us about correcting account details, accessing your information, obtaining a copy or other privacy requests. We may verify account ownership to protect your data.

The informational website does not use marketing analytics, collect expense records through forms, or set optional cookies. Its hosting provider may maintain connection logs needed to deliver and protect the pages.

Security and updates

We use HTTPS, Argon2id password hashing and random session tokens whose hashes are stored on the server. No security method eliminates every risk. Use a strong password and do not share it.

Sarfak is a general expense organizer and is not directed at collecting children’s data. This policy may change as the service changes; the revision date appears above. Your applicable statutory rights are not waived.