Privacy Policy

1. Scope

This policy governs all data processed when you use the Jibiyar apps (mobile and desktop) and the jibiyar.com website. It forms an integral part of the Terms of Use.

2. Who is responsible for your data

The provider of Jibiyar is responsible for collecting and processing your data. Contact details are in the final section of this document.

3. What we collect

We collect only what the service needs in order to work:

• Account information: your mobile number or email address (for sign-in and authentication) and your display name, if you have entered one.
• Transaction data: the amount, currency, description, category, date and, where recorded, the beneficiary of each expense or income entry.
• Speech and its transcript: when you use voice entry, your audio is sent to our servers to be turned into text.
• Chat messages: the text you write in the chat assistant and the replies you receive.
• Technical information: device model, OS version, app version, language, and a random device identifier that is not tied to your identity.
• Crash reports: when an error occurs, the technical stack trace is sent to our self-hosted system for debugging.

4. What we do not collect

As an explicit commitment, we do not collect any of the following — not for ourselves and not for anyone else:

• Your location. The app requests no location permission.
• Your contacts, SMS messages, photos or device files.
• Banking details: card numbers, account numbers, PINs, or any data from your bank account. Jibiyar does not connect to your bank.
• Advertising identifiers or tracking cookies. There is no third-party advertising or behavioural analytics in the app.
• Crash reports never carry financial content, speech transcripts, phone numbers, email addresses or sign-in tokens.

5. Legal basis for processing

We process personal data only on one of the following bases, and each purpose has its own:

• Performance of the contract — creating and keeping your account, recording and showing your transactions, and providing the subscription you bought. Without this processing the service you signed up for cannot be provided.
• Your consent — for speech processing (section 7) and for notifications. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.
• Legitimate interests — securing the service, preventing abuse, and keeping error reports so faults can be fixed. We have weighed these against your rights, and you may object at any time.
• Legal obligation — where applicable law or an order from a competent authority requires it.

6. Purposes of processing

Your data is processed only to: provide and maintain the service; synchronise transactions across your own devices; build reports and spending analysis for you; authenticate and secure your account; handle your support requests; and fix technical faults.

We do not sell your data. We never sell, rent or otherwise make your personal or financial data available to any third party for advertising.

7. Speech processing and AI

When you record an expense by voice, your audio is sent to an AI provider to be turned into text and to extract the amount and category.

That provider may be established outside the country where your data is held. Today the service uses OpenAI. The transfer relies on standard contractual clauses for international data transfers and is described in section 10.

Your recording is not deleted once it has been transcribed. We keep it so you can hear back what you said, and to improve the accuracy of speech recognition. This rests on your consent, which you give by accepting this document.

If you would rather we did not, you can withdraw that consent: tell us through any channel in section 17 and we will delete your recordings and stop keeping them. The service works without it.

What the AI returns is a suggestion, not a fact. You can always correct the amount, the category and the date, and your correction replaces the suggestion.

8. How long we keep data

This section describes what the system actually does, not what would be ideal:

• Transactions, categories and messages: for as long as your account is active.
• Voice recordings and their transcripts: until you withdraw consent, ask us to delete them, or delete your account. There is no scheduled automatic purge.
• Error reports and server logs: currently kept without an automatic cut-off. We are adding retention limits; until then this sentence states the truth.
• "Delete account" in the app erases your data. Transactions, categories, conversations, corrections, and voice recordings and their transcripts are removed from the server immediately and permanently. It cannot be undone, and we keep no copy to restore from.
• Two things survive the deletion, and neither holds your phone number or email address: our own cost records (what a speech request or an SMS cost us), and a one-way hash of your number or address together with the plan and subscription dates — so the free month cannot be claimed again by deleting and re-registering, and so that days you had already paid for come back with you if you return. The full account is at jibiyar.com/delete-account.
• If you cannot get into the app, ask us through any channel in section 17. We will carry it out within thirty days at the latest and tell you when it is done. This is your right and it is free.

9. Sharing with third parties

We do not sell your data and we do not give it to anyone for advertising. Only to these processors, and only as far as necessary:

• The hosting provider: on whose infrastructure our servers run.
• The AI provider: your audio and expense text, to turn speech into text and extract the details. See section 7.
• The email provider: your email address only, and only to send the one-time sign-in code.
• The SMS provider: your phone number only, and only to send the one-time sign-in code — if you sign in by phone.
• Competent authorities: only under a lawful order.
• Our error-reporting system is self-hosted and runs on our own infrastructure.

10. Where data is stored

All your data is stored and processed on our own servers, in the data centres of our hosting provider.

There is one exception and it matters: speech processing and extracting details from text are carried out by an AI provider that may be established in another country.

That transfer relies on standard contractual clauses for international data transfers and, where applicable, an approved data protection framework. We will send you a copy of the transfer mechanism on request.

Using the service means your data is transferred to those servers to be stored and processed.

11. Security

Traffic between the app and our servers is always encrypted (TLS). Your sign-in tokens are held in the operating system's secure storage on your device — Keychain on iOS, EncryptedSharedPreferences on Android — and are never stored in plain text. Staff access to user data is restricted and granted on a need-to-know basis.

That said, as is true of any system, no method of transmitting or storing information is completely secure. We cannot guarantee absolute security, but we undertake to notify you at the earliest opportunity if a breach puts your data at risk.

12. Your rights

You have the following rights over your personal data, and exercising them is free:

• Access — find out what data we hold about you and get a copy of it.
• Rectification — have inaccurate data corrected.
• Erasure — ask for your data to be deleted. Section 8 explains how.
• Restriction — ask us to pause processing.
• Portability — receive your data in a structured, machine-readable format so you can take it elsewhere.
• Objection — object to processing based on legitimate interests.
• Withdrawing consent — at any time, without affecting the lawfulness of processing before it.
• Complaint to a supervisory authority — if you believe your data has not been handled properly you may complain to the data protection authority where you live or work. That right is independent of our answer to you.
• To exercise any of them, contact us through any channel in section 17. We answer within thirty days at the latest.

13. Children

The service is not designed for people under 18. We do not knowingly collect data from children. If we learn that an account belongs to a minor without guardian consent, we will delete it.

14. Device permissions

The app asks for only these permissions, each solely for its stated purpose:

• Microphone: only for recording expenses by voice, and only while you are holding the mic button. The app does not listen in the background.
• Notifications: only for the daily reminder. Your operating system asks you for this permission once; it is optional, and declining it affects nothing else in the app.
• Internet: to synchronise with the server.

15. Notifications

The daily reminder is on by default: one silent notification a day, and only on days when you have not recorded anything. You can turn it off whenever you like, in the app's settings or in your OS settings. Its scheduling happens on your own device and sends nothing to the server.

16. Changes to this policy

We may update this document. The current version is always available in the app and at jibiyar.com/privacy. For a material change — particularly to what we collect or how long we keep it — we will notify you in the app before it takes effect and ask for your consent again.

17. Contact and complaints

For any privacy question or complaint, reach us through these channels. We aim to answer data-related requests within seven working days:

• Email: ⁦info@jibiyar.com⁩
• Telegram: ⁦@Jibiyar_support_bot⁩
• Support page: ⁦jibiyar.com/support⁩
• If you are not satisfied with our response you may take the matter to the competent data protection authority.