Sahulat · Last updated 6 November 2026
Sahulat is a personal finance app. It records what you spend, earn, lend, borrow and save. That is sensitive information, and this policy sets out plainly what happens to it.
The short version: your financial records live on your own phone. They are uploaded to our server only if you have Premium and tap Back up, and only so that you can restore them on another device. You can lock a backup with a password of your own on your phone before it is uploaded, and then we cannot read it. We do not sell your data, we do not share it with advertisers, and there are no ads in the app. Unless you turn it off, the app counts which screens are used — never amounts, names or notes (see "Usage analytics").
Sahulat is developed by Nabeel Ur Rehman. For any question about this policy or about your data, write to support@sahulat.app.
| Information | Where it is kept | Why |
|---|---|---|
| Your financial records — expenses, income, accounts and balances, loans, committees, bills and split groups | On your phone. Copied to our server only when you tap Back up (a Premium feature), locked with your backup password first if you set one. | To run the app, and to let you restore your data if you change or reset your phone. |
| Your email address | On our server, when you sign in with Google. | To identify your account and attach your backup to it. |
| Receipt and bill photos | On your phone only. They are never uploaded — a backup records the file's location, not the image. The one exception is a payment screenshot you add in a committee someone shared with you, which goes to its organizer (see "A committee you join"). | So you can look back at a receipt. |
| Location attached to an expense | On your phone, and in your backup as part of that expense, if you chose to attach it. | Optional. Only recorded when you tap to add a location to an expense; the app never tracks you in the background. |
| What you say in a voice entry | Sent as text to our server, together with the names of your categories and income sources, and read by Claude (Anthropic). Neither the words nor the audio are kept by us. | To fill in the entry for you to check before it is saved. |
| How many voice entries you made each day | On our server, against your account: for each day, the number of voice entries and how much text Claude read for them (counted in tokens). Not the words — only the counts. Each day's count is deleted after 90 days. | To apply the daily limit on voice entries, and to know what the service costs to run. |
| A split group you share | On our server while it is shared: the group's name, the names of the people in it, what was spent and who owes whom. Removed when you stop sharing it or delete your account; people who already joined keep their copy on their own phones. | So the people you give the code to can see the group. |
| A committee you share | On our server while it is shared: the committee's name, monthly amounts and dates, the names of its members and the month each one collects, and which invites have been accepted. Your email address is shown as the organizer to anyone who opens one of its invites. What you paid in or received is never sent. Months its members mark paid in their own app, with any screenshot, are kept with it for you to see. Removed when you stop sharing it or delete your account; members who already joined keep their copy on their own phones. | So the members you invite see the committee and their own turn in their app. |
| A committee you join | On our server: that your account accepted that member's invite, and each month you mark paid in it — the amount, the date, and a payment screenshot if you add one. Only the committee's organizer can see these; no other member can. Which account you paid from, and what you received, are never sent. A month you unmark is removed with its screenshot; all of it is removed when you leave the committee, the organizer removes you or stops sharing it, or you delete your account. | So the organizer knows the seat is yours and who has paid, and your app can show the committee. |
| Purchase information | Google Play holds the purchase; we store the confirmation against your account, with the plan and the price and currency Google reports for it. | To verify a Premium subscription is genuine and still active. |
| Reminder dates and a notification token | On our server, against your account, only while you are signed in. | So a reminder can still reach you when the app is closed. We store the dates you asked to be reminded on and nothing else — not what is due, not the amount, not who it is owed to, not even whether it is a bill, a committee or a loan. The notification itself is written by your phone, from the records already on it. |
| Crash reports | Sentry (sentry.io) | So we learn when the app breaks. Deliberately limited — see below. |
| Your phone's time zone | Read on your phone only, once, when the app is first opened. Never stored or sent anywhere. | To start a new install in the currency of the country you are in (for example dirhams in Dubai). You can change it any time in Settings → Currency. |
| Usage counts | Google Analytics for Firebase, unless you turn off Share usage data in Settings. | To learn whether the app is useful and which ads led to an install. Deliberately limited — see "Usage analytics" below. |
The app is fully usable without an account. Everything works offline, on your device alone. Signing in adds Premium features and the ability to share a split group or a committee. Nothing is backed up on its own: with Premium, a backup is made only when you tap Back up. If you never do, none of your financial records leave your phone, apart from a split group or a committee you choose to share and the words of a voice entry.
When you back up you can add a password. The backup is then locked on your phone before it is uploaded (scrypt and XChaCha20-Poly1305). The password never leaves your phone, so we cannot read that backup — and cannot recover it for you if you forget the password. A backup made without a password is stored as it is, and our server can read it; so were all backups made with versions of the app before 2.1.33. A backup stays on our server until a new one replaces it — a replaced copy is kept for up to 30 days, so it can be restored — or until you delete your account.
Each of these permissions can be refused, and the rest of the app carries on working.
When the app crashes, a report is sent to Sentry so the fault can be found and fixed. It is set up to carry as little as possible: no name, no email, no IP address, and none of your financial data. It contains the error, where in the code it happened, and basic device details such as the Android version and phone model.
Unless you turn off Settings → Share usage data, the app sends usage counts to Google Analytics for Firebase: which screens are opened, and when an entry is added, a committee or split group is made or joined, you sign in, or something is shared. These say only that it happened — never the amount, the names of people or accounts, notes, categories or your email address. Google ties them to a random app-instance ID and to your phone's advertising ID, which lets us see which of our ads led to an install. Ad personalisation is turned off: these counts are not used to show you personalised ads. You can also reset or delete your advertising ID in your phone's Google settings.
These services are used to run the app, and only for the purposes above:
Your backup and account details are kept for as long as your account exists. Delete your account and both are removed from our server; see below. Data on your phone is removed when you uninstall the app or clear its storage. Daily voice-entry counts are deleted after 90 days, or sooner if you delete your account. Crash reports are kept by Sentry for 90 days. Usage counts are kept by Google Analytics for up to 14 months.
Traffic between the app and our server is encrypted with HTTPS. You sign in with your Google account, so we never see or store a password, and a backup password, if you set one, never leaves your phone. Sign-in tokens are kept in the Android Keystore rather than in ordinary app storage. You can also lock the app itself with a PIN or your fingerprint, in Settings.
No system is perfectly secure, and we cannot promise absolute safety. What we can say is that we hold as little as possible in the first place.
Sahulat is meant for adults managing their own money and is not directed at children under 13. We do not knowingly collect their information.
If this policy changes, the date at the top changes with it, and a significant change will be announced in the app before it takes effect.