Privacy policy
Who this is for
Tafra runs on your device and stays fully usable offline and signed out. Google or Apple sign-in is optional. If you sign in, the ledger is stored in your account on our servers (a Supabase instance we run, not Supabase Cloud). It is encrypted in transit (TLS) and at rest (an encrypted disk on the server). Row security lets each account read only its own row. You can delete the account inside the app.
Tafra is operated by Experto Platform, based in Riyadh, Saudi Arabia. Contact: info@experto.sa.
What is stored, and where
The money snapshot lives under tafra.finance.v1 in on-device app storage (AsyncStorage, or localStorage on the web): accounts, transactions, budgets, goals and categories, including names you type. It is sealed with AES-GCM before it is saved. Its random 256-bit key is in the secure store under tafra.finance.key.v1, not inside the snapshot.
Preferences live under tafra.prefs.v1: language, appearance, whether onboarding is done, the name used in the greeting, and the date of the last backup.
The lock record lives under tafra.security.v1 in the device secure store (Keychain on iOS, Keystore on Android). It keeps a salted hash of the passcode, not the passcode, plus the biometrics toggle, auto-lock setting and failure count. On the web this record and the ledger key are in browser storage, which is weaker, because the key and the ciphertext then sit in the same place.
Biometrics stay with the operating system. The app never receives a face image or a fingerprint.
A backup is a file you create and share yourself. The app does not upload that file.
If you sign in, our server keeps one row for the account: the ledger (accounts, transactions, budgets, goals, categories and names), a revision, the update time and a device id. The server can read that row. TLS protects it on the way, disk encryption protects it at rest, and row-level security stops another account from reading it. There is no recovery passphrase. Signing in with Google or Apple on another device restores the account directly.
On the web the device ledger key and the sign-in session sit in browser storage, which is weaker than a phone secure store. That key is only for the local copy and is not required to restore.
Google and Apple receive the sign-in request only. They do not receive a separate copy of the ledger.
No sharing and no tracking
No ads, no analytics and no sale of data. Sync, if you turn it on, sends the ledger to our server over TLS. It is not sent to Google or Apple as part of sign-in. The only exception is the scrubbed crash reports described below, which you can turn off.
If you share a backup or a CSV yourself, you choose the recipient.
Crash reports (Sentry)
If this build was made with a Sentry key (free plan), the app sends a report to Sentry when it crashes. Sentry is an external crash-reporting service whose servers are outside Saudi Arabia. Without that key, and in development builds, the service does not start and nothing is sent.
What is sent: the error type and its scrubbed message, where in the code it happened, the app version, the operating system, device model and language, and a short trail of what came before (screens opened without their parameters, and network requests: method, status and address without the query).
What is never sent: amounts, notes, merchant names, transaction or bank-message text, your name or email, the device name, your IP address, request headers, sign-in tokens or Supabase keys. Scrubbing happens on your device before sending: every number, Arabic text and quoted text is removed from the error message, and console, touch and input logs are dropped. There is no session replay, no screenshots, no performance tracing, and the report is not linked to your account.
Opting out: Settings → Crash reports → Send crash reports. When it is off the service is shut down and nothing is sent; the choice is saved on the device with the other preferences.
Deletion
Settings → Erase all data deletes the ledger and keeps the built-in categories.
Forgot your passcode? on the lock screen erases the ledger, preferences and the passcode record on this device. If you synced, the account copy stays on the server and comes back after you sign in.
Settings → Delete account removes the ledger row and the auth user on the server, through a function that runs on that same server, then erases this device. Sign-out asks whether to keep or erase data on this device. Erasing the device alone does not delete the account copy.
Deleting the app removes app storage. On iOS the Keychain item can outlive the app until the system removes it. Erase data inside the app first if you still have it open and want the passcode record gone.
You read and correct the data in the app. The account copy on the server is deleted from inside the app.
Saudi PDPL
This policy was written with the Saudi Personal Data Protection Law in mind: a limited purpose (running the app and optional account sync), data stored in the account on our servers, encrypted in transit and at rest, access-restricted to that account, and deletable inside the app.