Privacy Policy

Safi. Last updated 26 October 2026.

Safi is a personal finance app. This policy explains what we collect, why, who we share it with, and how you can get it back or delete it. We have tried to write it in plain language rather than legal boilerplate.

1. Who we are

Safi decides what data is collected here and why, which makes us the controller of it. For any privacy question or request, contact hello@safimoney.com. If you are in a region with a data protection authority, you also have the right to complain to it.

2. What we collect

Data	Why we hold it
Account identity: email address, and name if you provide one	To create and secure your account, and to sync your data across devices
Financial records you create: accounts, balances, transactions, categories, budgets, savings goals, recurring payments, investments, notes and tags	This is the product. It is stored so it is available to you on any device you sign in to
Settings: language, currency, theme, sound and haptics preferences	To present the app the way you configured it
Bank message content, only if you switch on message sync	To read an amount and merchant out of a bank alert and turn it into a transaction. See section 4
Voice recordings, receipt photos, recognized receipt text and screenshots, only when you use voice entry, receipt scanning or screenshot import	To turn what you said or photographed into transactions. See section 5
Subscription status	To unlock paid features. Handled by RevenueCat and your app store; we never see your card
Usage and diagnostics: which features you use, app opens and updates, crash and error reports, the app version, and settings such as language and currency. When you are signed in these are linked to your account ID. They are never linked to your email, and they never include amounts, merchants, notes or other financial content	To understand how the app is used, find and fix crashes, and set paid feature limits. Stored in our own systems and deleted after 90 days

We do not collect your bank credentials. Safi never asks for your online banking username, password, PIN or card number, and has no connection to your bank.

3. Payments

Purchases are processed by Apple or Google, not by us. We receive only a confirmation of what you bought and whether it is still active, via RevenueCat. We never receive or store your payment card details. Manage or cancel a subscription in your app store account.

4. Bank message sync

This feature is off by default and only runs after you explicitly turn it on and grant the relevant permission.

On iOS it works through a Shortcut you install yourself. The Shortcut sends the text of a matching message to our ingest endpoint.
On Android it can read notifications from SMS apps and from bank and wallet apps on Safi's list, using Android's notification access permission. Only notifications from those apps are read.

In both cases we look for an amount, a merchant and a date, create a transaction, and keep a short excerpt of the message so you can see why a transaction appeared. Messages that do not contain an amount are discarded. If our built-in reader cannot make sense of a message, its text is sent to our AI provider to read it instead. See section 5. You can revoke the permission or the sync token at any time from Settings, which stops all further reading immediately.

5. AI features

Some features send data to our AI provider, OpenRouter, which routes it to the underlying model. We do not permit your data to be used to train models. Do not send information you would not want processed by a third party.

The assistant. When you ask it a question, your question and the relevant slice of your financial data needed to answer it are sent. This is what makes an answer about your own spending possible. If you ask by voice, the recording is sent to be turned into text.
Voice entry. Your recording is sent along with the names of your categories and accounts, account types and currencies, the last four digits you saved for an account, the names of people you track lending or borrowing with, your saved merchant shortcuts and your time zone, so the model can file each transaction in the right place. We keep the recording on our backend only until the transaction is added or you dismiss it, then delete it.
Receipt scanning and screenshot import. On supported iOS devices, Scan document straightens a receipt photo and recognizes its text on your device. After you confirm the cloud AI notice, only the recognized text is sent for transaction parsing. Parsing still needs an internet connection. The camera and photo library options remain available and send the receipt photo after you confirm their cloud AI notice. Both paths send your category names. Review the details before saving. If you save the transaction, its receipt photo is uploaded and stored as an attachment. Screenshot import sends the chosen screenshot, your category names and the account's currency. We do not store that screenshot.
Bank alerts we cannot read. If message sync is on and our built-in reader cannot find an amount or currency in a message, or the message is ambiguous, its text is sent to be read by a model. Card and reference numbers we can recognise are masked first.

If you use none of these features, none of your data goes to OpenRouter.

6. Who else processes your data

Processor	Purpose
Clerk	Sign in and account security
Convex	Database and backend hosting
RevenueCat	Subscription status
OpenRouter	AI features described in section 5, only when you use them
open.er-api.com	Currency exchange rates. No personal data is sent, only currency codes
Apple, Google	App distribution and payment processing

We do not sell your data, and we do not share it with advertisers.

7. Where your data is held and for how long

Data is stored on our backend provider's infrastructure, which may be located outside your country. We keep your data for as long as your account exists. If you delete your account, your financial records are deleted. Backups are cycled out within 30 days. Usage events and crash reports are kept for 90 days, then deleted.

iPhone Search

If you opt in to Find in Search, Safi puts saved budget and expense bill names, their Budget or Bill labels, and record identifiers in a private on-device Core Spotlight index. Amounts, income and owner's draws are excluded. Names can appear in iPhone Search outside Safi. The preference is stored on this device separately for each account and starts off for an account that has not opted in.

Safi removes these search records when you turn the feature off, enable App lock, sign out or delete your account. Indexing stays off while App lock is on. If cleanup fails, Safi shows an error and retries on the next launch before indexing again. Search records may remain until cleanup succeeds. See setup instructions.

8. Your rights

Export. Settings has a CSV export of your transactions at any time.
Delete. You can delete your account and all of its data from within the app. This is immediate and cannot be undone.
Access and correction. Everything we hold about you is visible and editable in the app. For anything else, email us.
Withdraw consent. Turn off message sync, or stop using the assistant, at any time.

9. Children

Safi is not directed at children under 13, and we do not knowingly collect their data.

10. Changes

If we change this policy materially we will say so in the app before the change takes effect. The date at the top always reflects the current version.

11. Contact

hello@safimoney.com