Privacy Policy

Last updated: 27 October 2026

This policy is written to align with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). Dirhamly is the data controller for the information described below.

The short version

• We never sell your data, and we never use it for advertising.
• Dirhamly does not connect to your bank or ask for your bank login. On Android, if you give permission, the app can read bank transaction SMS and bank-app notifications to record your spending. Entering expenses yourself works just as well.
• Deleting your account deletes your data.

What we collect

We collect only what the app needs in order to work:

• Account details: your name and email address, and the password hash held by our authentication provider. If you use Sign in with Google, we receive your name and email from Google instead of a password.
• Phone number (optional): a UAE mobile number, only if you choose to add one at sign-up. You can leave it blank and every feature still works.
• Income: your salary amount and the salary day your cycle resets on. When you file a payment as your salary, we also keep a record of that income: its type (for example salary), whether it is your main income, and its pay day or that it has no fixed date.
• Transactions: expenses you record, including amount, category, date and any note you add, and money coming in that you file as Salary, Refund or Extra income, with its amount, date, merchant and, for a refund, the category it was for. An item you confirm from a captured bank message is saved with the merchant name only (see the SMS section below).
• Bills and commitments: recurring bills, rent, subscriptions, and monthly commitments with their amounts and due dates.
• Remittances: transfers you log, including amount, destination country and exchange rate at the time.
• Credit cards: card nicknames, limits, statement dates and balances you enter. We never collect card numbers, CVVs or expiry dates.
• Debit cards: the bank name and a card nickname you choose, so you can say which card paid for an expense. Nothing else: no card numbers, CVVs or expiry dates.
• Spending alerts and budgets: the alerts you set up (category and threshold amount) and any category budgets you set.
• Goals and gold savings: savings goal names, target amounts and contributions, and for gold goals the target weight, karat and amounts you set aside.
• AI chat messages: the questions you ask Dir, the in-app money coach, and the financial context sent with them so it can answer using your real numbers: your name, income, expenses, bills, goals, recent transactions, credit card details and debts. The app asks for your explicit consent before your first Dir conversation, and you can decline and still use every other feature. The same consent covers the AI-written salary-day message and savings-goal suggestions, which use your figures in the same way. You can withdraw it at any time in Profile → AI data sharing.
• Reports on Dir's replies: if you report a reply from Dir, we store which message you reported and the reason you give, so we can review it.
• Expense text you type or speak: when you add an expense by typing a short description (for example “45 Talabat”) or by voice, that text is sent to our AI provider so it can read the amount and merchant. Voice entry uses your phone's built-in speech recognition (Google on Android, Apple on iOS); we receive only the resulting text, never the audio.
• Push notification tokens: a device token so we can send the daily safe-spend reminder and the alerts you opted into. Push messages are delivered through Expo and, on Android, Google's Firebase Cloud Messaging.
• Diagnostics: crash reports and product analytics (screens opened, features used), together with basic device information: operating system, app version and device model. These are linked to an opaque user ID, never to your email or your amounts.

SMS and notification access (Android only, optional)

On Android only, and only if you switch it on and grant permission, Dirhamly can read incoming bank SMS messages and notifications from your banking apps, so it can offer card and account transactions to you to confirm, as expenses or as money coming in. This is entirely optional and the app works fully with manual entry. It does not exist on iOS.

• What is read. For SMS, only messages from the sender IDs of known UAE banks are looked at. For notifications, only notifications posted by a fixed list of UAE banking apps are looked at.
• What is ignored. Messages from personal phone numbers, from shops, telecom providers and any other non-bank sender, notifications from any other app, one-time passcodes, and any message in which no AED amount can be found are all discarded on your phone. They are never sent to us, stored, counted or logged.
• If an SMS with an amount comes from a sender that isn't on our bank list, we record only that sender's name (never the message) in our product analytics, linked only to an opaque user ID, so we can add missing banks.
• What is stored. For each bank message that looks like a transaction, we store on our servers, against your account: the amount, currency, whether it is money in or out, the merchant, the last four digits of the card if the message shows them, the date, a suggested category, and a fingerprint used to avoid duplicates. The full text of the message (for a notification, its title and text) is also stored, but only while the item waits in your review list, so you can check it.
• The message text is deleted once you decide. When you confirm or dismiss an item, its message text is deleted and only the details listed above are kept. Confirming a payment creates the expense with the merchant name as its note. Money coming in never creates an expense: you choose what it is (Salary, Refund, Extra income or Moving my own money), we keep that choice on the item, and the first three are saved as money in. Moving my own money saves nothing else. Nothing counts towards your spending until you confirm it.
• We never send SMS, and we never read your contacts or your message inbox history. We only see messages that arrive after you switch the feature on.
• Turning it off. Switch it off in the app, or revoke the SMS or notification access permission in your phone's settings. It stops reading new messages immediately, and everything else keeps working with manual entry.

Why we process it

We process this data to calculate your Safe Daily Spend, run the features you asked for, keep the app stable, and answer your support requests. Our legal bases under the PDPL are performance of our contract with you, your consent (for notifications and the AI coach), and our legitimate interest in keeping the service secure and working.

Who processes data on our behalf

We use a small number of processors. Each is bound to use your data only on our instructions:

• Supabase: database and authentication. Stores your account and all financial records described above.
• Anthropic: powers Dir, the AI coach, plus the salary-day message, goal suggestions and reading the expense text you type or speak. Receives that text plus the financial context needed to answer. Anthropic does not use this data to train its models, and deletes API data within 30 days by default.
• Sentry: crash reporting and diagnostics. Receives error and stack information and basic device information (operating system, app version, device model), tied to an opaque user ID.
• PostHog: product analytics. Receives which screens and features are used and basic device information (operating system, app version, device model), tied to an opaque user ID. Autocapture is switched off so no on-screen text or amount is recorded.
• Expo: push notification delivery and app updates. Receives your device push token (and, when the app checks for an update, its version), never your financial data.
• Google: Sign in with Google, which confirms your identity to us and gives us your name and email; and Firebase Cloud Messaging, which delivers push notifications to Android devices using your device push token.
• Resend: sends account emails (sign-up confirmation, password reset). Receives your email address only.
• Tally: runs the Pro waitlist form, opened from the app and this website. If you join, Tally collects the email address you enter. Joining is optional, and the app does not know whether you joined.

We also fetch live currency exchange rates and gold prices from third-party sources, and logo images for well-known brands (such as Talabat or Carrefour) from apistemic. Those are plain lookups: only a currency, or the brand's public website address, is requested. Your name, account details and amounts are never sent with them. As with any image or page your phone loads, the request comes from your phone's internet connection, so the provider receives your IP address as part of the request.

Some of these providers process data outside the UAE. Where they do, transfers are made under the safeguards permitted by the PDPL and the provider's own contractual commitments.

Security

Your data is encrypted in transit and at rest. Access is scoped per user at the database level, so one account can never read another account's records.

Retention

We keep your data for as long as your account exists. When you delete your account, your personal data is deleted. Backups roll off on their own schedule and are overwritten within 30 days. Aggregated, non-identifying statistics may be retained.

Your rights

Under the PDPL you may:

• Access the personal data we hold about you and ask how it is processed.
• Correct anything that is inaccurate. Most fields are editable directly in the app.
• Delete your account and data, in the app under Profile → Delete my account, or via our deletion request form.
• Withdraw consent for notifications or the AI coach at any time, without losing access to the rest of the app.
• Object or restrict processing, and lodge a complaint with the UAE Data Office.

To exercise any of these, email support@getdirhamly.com. We respond within 30 days.

Children

Dirhamly is not intended for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

If we make a material change we will update the date at the top and notify you in the app before the change takes effect.

Not a licensed financial service

Dirhamly is a personal budgeting tool. It is not a bank, and it is not licensed by the UAE Central Bank, the Securities and Commodities Authority, or any other financial regulator. Nothing in the app is financial, investment, tax or legal advice, and you remain responsible for your own financial decisions.

Contact

Dirhamly is currently operated by Saquib Mohammed Safdar, Sharjah, UAE.

Questions about this policy? Email support@getdirhamly.com.