Hasalati Privacy Policy

Last updated 4 September 2026

The short version

Hasalati is offline-first. Everything you log is stored on your device. The only things that reach us are the ones you deliberately send: your records, if you create an account and turn on sync, and a support message, if you write to us from Settings → Help → Contact support.

There is no analytics, no advertising, and no tracking. We do not sell or share your data with anyone.

Who we are

Hasalati is an independent app developed by Esam Jaafar. For any privacy question, write to jfr3sam@gmail.com and we will reply within 7 days.

Data stored on your device

The following never leaves your iPhone unless you turn on sync or export it yourself:

• Transactions — whether each is income or expense, the amount, the category, your free-text note, the date, and whether it repeats monthly.
• Settings — your currency label, monthly and per-category budgets including any month with its own plan, categories you create or rename (their names, icons and colours) and the order you put them in, your appearance preference, and whether reminders are on and at which times.

Data we receive only if you turn on sync

Creating an account stores your email address and a password. The password is hashed by our authentication provider; we never see it in plaintext.

Once sync is on, the transaction fields listed above — including your free-text notes — plus recurrence identifiers, deletion markers, and your settings are stored as rows tied to your user ID.

Row-level security means each row can be read and written only by the account that created it. We do not read your entries.

Service providers

Three companies are involved in delivering the app:

• Supabase — database, authentication, and hosting for sync. Receives your email address, any support message you send, and, when sync is on, your transactions and settings.
• Resend — sends the six-digit verification email and delivers your support messages to our inbox. Receives your email address, the verification code, and the text of any support message you send.
• Apple — distributes the app through the App Store, governed by Apple's own privacy policy.

What Hasalati does not do

• No analytics or telemetry of any kind.
• No advertising and no advertising identifiers.
• No cross-app or cross-site tracking — there is no App Tracking Transparency prompt because there is nothing to track.
• No sale or sharing of personal information.
• No connection to any bank, card, or financial institution.
• No access to your location, contacts, photos, camera, microphone, or health data.

Notifications

The daily reminder is a local notification scheduled by iOS on your device. No push tokens are created and no server is contacted. Turning the reminder off cancels it immediately.

Files you export

Export to Excel (CSV) and Backup file (JSON) both produce unencrypted files that you send wherever you choose through the iOS share sheet. Once a file leaves the app it is outside our control — treat it as you would a bank statement.

Support messages

Contact support, in Settings → Help, sends what you type straight to us. It works with or without an account. Nothing about your transactions, budgets or categories is attached.

We receive the message itself, the request type you chose, the language the app is set to, and the email address you give us so we can reply. If you leave the device details switch on we also receive your app version, iOS version and device model — the screen shows you the exact line before you send it.

Your message is stored so that a mail delivery failure cannot lose your report, and is deleted 90 days after you send it. Deleting your account also deletes any message sent from it, and any message sent from its email address. A message you sent while signed out is not linked to any account, so account deletion cannot find it — write to jfr3sam@gmail.com and we will delete it.

To stop the form being used to send mail in bulk, we count how many messages arrive from a device and from a network address. The network address is stored only as a one-way hash, never in the clear, alongside a number; no message text is kept with it, and the counters are erased after 48 hours.

Retention and deletion

• Signing out stops syncing but leaves your cloud data in place. You are asked whether to keep the copy on this iPhone or remove it.
• Clear all data, in Settings → Data, erases every transaction and resets every setting. With sync on it clears the copy in your account as well, on every device.
• Delete account, in Settings → Account, permanently removes your account together with every transaction, settings row, and support message belonging to it. This is immediate and cannot be undone.
• Support messages are deleted 90 days after you send them, whether or not you have an account.
• Deleting the app removes the copy stored on your device.

Your rights

Access and portability are built in: Export to Excel (CSV) gives you a readable spreadsheet of every entry, and Backup file (JSON) gives you your complete data in a machine-readable file. Erasure is built in: Clear all data, and Delete account.

Because we do not profile, advertise, or sell data, there is no opt-out to offer under CCPA or CPRA. Under GDPR, the lawful basis for handling synced data, for sending the verification email, and for reading and answering a support message you send us is performance of the service you asked for.

Security

All network traffic uses TLS. Cloud access is restricted per user by row-level security, and the key embedded in the app is a public, restricted key that grants no access without a valid signed-in session.

No system is perfectly secure. Hasalati's strongest protection is that you can simply leave sync off.

Children

Hasalati is not directed at children under 13, or under 16 in the EEA and UK, and we do not knowingly collect their data.

Changes to this policy

We will update the date above when this policy changes, and for material changes we will surface a notice in the app before they take effect.