Madriss Privacy Policy

Last updated: October 5, 2026

Madriss is a personal budgeting app for iPhone and Android. This policy explains what data the app handles and how. The short version: your financial data belongs to you, we collect the minimum needed to run the app, and we never sell data or show ads.

No ads. No third-party trackers. We never sell your data.

Data you provide

• Transactions, budgets, and categories you record in the app — amounts, merchant names, categories, and dates, plus any note you add to a transaction.
• Cards you add: the name you give a card and its cashback rates and caps. We do not ask for or store full card numbers, expiry dates, or security codes.
• Bills and planned payments: name, amount, category, how often it repeats, reminder settings, an optional note, and the payments you mark as made.
• Sharing data, if you use it: the display name you choose, group names, and the names of people you split expenses with (see the Qattah and Household sections).
• Account details, if you sign in. On iPhone you sign in with Apple: we receive your Apple user identifier and, if you choose to share them, your name and email address. On Android you sign in with Google (see the next section).

Signing in with Google (Android)

On Android you can sign in with Google. When you do, we receive your Google account's name, email address, and Google account ID, which we store in our backend (hosted on Supabase) to keep your data in sync across your devices. Your Google name is also used as your starting display name — the name friends see on Qattah requests — and you can change it in Settings. We do not receive your Google password, contacts, or any other Google data. You can use Madriss without signing in — tap Continue without an account — and your transactions, budgets, and categories stay on your phone (see How your data is stored).

Automatic logging (iPhone)

Madriss can record purchases automatically through one or both of two optional automations that you create in Apple's Shortcuts app. Neither is enabled by default. iOS gives apps no background access to your messages; a shortcut runs only when the automation you created matches, and you can delete it at any time in Shortcuts, which stops it immediately.

• Apple Pay purchases. A Wallet automation passes the amount, merchant, and card of a tap-to-pay purchase to Madriss, which records it.
• Bank SMS. Purchases made with mada, online, in-app, or by subscription never reach the tap-to-pay trigger, but most banks text you about them. You can create a Messages automation that runs when an incoming message contains a phrase you choose (for example "Purchase"). Shortcuts then passes the text of that message to Madriss.
• SMS read on your phone. Your bank SMS never leaves it. The message text is read on your device to extract the amount, merchant, currency, and the last digits of the card. Only that extracted transaction is saved — and synced if you are signed in. Madriss does not keep the message itself and does not upload it. The text stays in Messages.
• Messages that are not completed purchases — one-time passcodes, transfers, balance and payment reminders, and personal texts — are discarded without being recorded.
• If a bank uses a format Madriss cannot yet read, the app shows an error inviting you to email the message to support so the format can be added. Nothing is kept on the phone for you to correct later. Sending the message is your choice; nothing is sent automatically. If you do send one, please remove your balance, name, and any account numbers first.

Automatic logging from payment notifications (Android)

On Android, Madriss records purchases automatically by reading the payment notifications your bank and wallet apps already show you (for example "Purchase SAR 45.00 at Jahez"). This uses Android's Notification access permission, which you grant in system settings only after Madriss explains the feature in Settings → Automation settings; you can revoke it at any time under Android Settings → Notifications → Device & app notifications. Madriss does not use Android's SMS permissions and cannot open your SMS inbox. It sees a text message only as the notification your Messages app shows, and only if you turn on Purchase alerts from Messages (below).

• Which apps. Notifications from bank and wallet apps are read. Chat, social, and email apps (for example WhatsApp, Telegram, Signal, Messenger, Instagram, and Gmail) are blocked: their notifications are never read, and they cannot be switched on. Your Messages app is closed the same way unless you turn on Purchase alerts from Messages (below); it never appears in the list of apps. Any other app is read only if you turn it on in Settings → Automation settings. If an app that is switched off posts something that looks like a payment, Madriss checks it on the phone, records nothing, and offers that app to you as a possible bank. The list of apps that have posted notifications is kept on the phone and is not uploaded.
• What is read on the phone. The notification's title and text are analysed on your device to decide whether it is a purchase and to extract the amount, currency, merchant, and the last digits of the card.
• What is saved and synced. Madriss creates a transaction from those parsed fields: amount (and original currency for a foreign purchase), merchant, date and time, the card it matched among the cards you added, a category if you picked one on the notification or filed that shop before, and a marker that it was logged from a notification. If you are signed in, that transaction syncs to your account like any purchase you record; if you are using Madriss without an account, it stays on your phone. The card's last digits are used on the phone to match your card and are not saved on the transaction.
• The notification text is not uploaded. It is not saved to the transaction or its note, and it is not synced or shared with your household. Before a notification waits in the phone's capture queue, long runs of digits are masked and any line that mentions a balance or a one-time code is removed; the queue is cleared as soon as the app records the purchase.
• Notifications Madriss cannot read. If a payment notification is in a format Madriss cannot read, it still records a purchase with no amount and asks you to fill it in. To help you, a shortened, redacted copy of that notification (up to 500 characters, with runs of six or more digits masked to their last four and balance and one-time-code lines removed) is kept on the phone only, linked to that purchase. It is not synced and is not visible to anyone you share a household with. Deleting the purchase deletes it.

Purchase alerts from Messages (optional)

Most banks also text you about each card purchase. Purchase alerts from Messages lets Madriss log those too. It is off by default. You turn it on in Settings → Automation settings, and only after Madriss shows you what it does; turning it off stops it straight away. An update never turns it on for you.

• What is checked. When it is on, Madriss checks the texts your Messages app shows as notifications, on this phone, and keeps only card purchases (amount, merchant, and card digits). Only texts that arrive after you turn it on are checked. Group conversations are skipped.
• What is dropped. One-time codes, transfers, and personal messages are dropped. No message text or sender is saved or uploaded, not even a redacted copy: if a text looks like a purchase but can't be read, Madriss records a purchase with no amount for you to fill in, and keeps nothing of the message.
• What it can't do. It can't open your SMS inbox, and Madriss requests no Android SMS permissions. It works only through the same Notification access described above.
• The purchase itself. A purchase recorded this way is treated like any other: synced to your account if you are signed in, and shared with your household if your sharing covers it. The message it came from is not.

Contacts (Qattah)

When you split an expense, you can pick people from your address book. Madriss asks for the Contacts permission at that moment and reads your contacts only to show the picker. Your address book is not uploaded. For each person you pick, Madriss saves their name, phone number, and other spellings of their name from the contact card (such as a nickname) on your phone, so their balance can be tracked and their name can be kept out of notes your household can see. Phone numbers and the other contact details stay on your phone.

If you are signed in when you split, the name you picked for each person is sent to our server with that split: it is stored on the Qattah request (connected invite) and in the note of the "owed back" entry for their share, which syncs like your other transactions. If you decline the Contacts permission you can still add people by name.

Sharing with friends (Qattah)

If you send a Qattah request while signed in, the friend who opens your link sees the merchant, the amount they owe, and the display name you chose. That request is stored in our backend until it is settled or withdrawn, and expires after 90 days if never opened.

If you create or join a shared group while signed in, the group's name, its members' display names, and its expenses (who paid, merchant, amount, and each member's share) are stored in our backend and visible to the group's members.

Household sharing (optional)

You can create a household and invite a partner with a link. Each member chooses what to share: every purchase they log, or only purchases paid with cards they select. A shared purchase — its amount, merchant, date, category, any note on it, and the sharer's display name — becomes visible to the other members in their Madriss app; nothing else in your account is shared. Only the person who logged a purchase can edit it. Another member can delete a shared purchase, and can change its category only if you allow it. You can change what you share, or leave the household, at any time; leaving removes your purchases from your partner's view immediately. Household sharing requires a signed-in account on each phone, and the shared data is stored in the same backend as the rest of your account.

Notifications

If you are signed in and allow notifications, we store your device's notification token with your app language and platform (iPhone or Android), so we can tell you about Qattah requests and shared expenses. These are delivered through Apple's push service on iPhone and Google's Firebase Cloud Messaging on Android. You can turn notifications off at any time in your device settings.

Appearance and language

Your language, currency, appearance (light/dark), budget start day, and app-lock preferences are stored on your device. Your app language is also sent with usage statistics and with your notification token, so messages reach you in your language.

How your data is stored

• Without an account (guest mode): your transactions, budgets, and categories stay on your device and are not sent to our servers. Usage statistics recorded as a guest (see below) stay on the phone and are sent only if you sign in within 7 days; otherwise they are deleted.
• Signed in: your transactions, budgets, categories, cards, bills, notes, and sharing data are stored in our backend so they can sync across your devices. Data is encrypted in transit (HTTPS) and associated only with your account.
• Where: our backend is hosted by Supabase in its Tokyo, Japan region, so signed-in data is stored outside Saudi Arabia. We transfer it there to provide the service to you.
• Android backups: the Android app opts out of Android's automatic backup and device-to-device transfer, so data kept only on your phone (such as a guest ledger, your Qattah friend list, and redacted notification copies) is not copied to your Google backup or to a new phone.
• Exchange rates: when Madriss converts a foreign-currency amount, it fetches the rate from ExchangeRate-API (open.er-api.com). That request contains only the currency code.

Usage statistics

To improve setup and find what breaks, Madriss records how the app is used and sends it to our own backend (Supabase) once you are signed in. This is our own analytics: no third-party analytics or advertising SDK is in either app, no third party receives it, and it is never sold or used for advertising.

On iPhone:

• What is recorded: which screens and setup steps are opened, taps on setup and tool cards, your optional answer to "How did you hear about Madriss?", whether an automatic capture arrived by bank SMS or Apple Pay, how many purchases were captured, notification opens, and whether each Shortcut run succeeded (for example, recorded, duplicate, or a bank format the app could not read).
• Each record carries your account, the app version, iOS version, language, and a random identifier created on the phone; it is used only to count usage, never for advertising or tracking.
• Turning it off: switch off Settings → Share usage stats in the app. Nothing more is sent, and anything waiting on the phone is deleted.

On Android:

• What is recorded: a fixed list of events — for example which screen was opened, steps in sign-in, onboarding and automatic-logging setup, your optional answer to "How did you hear about Madriss?", that a budget, card, or bill was saved, that a Qattah split or household invite was made, and notification opens. Each event can carry only the fields it declares: counts, yes/no values, the option picked, or a rough range. When purchases are logged automatically we record how many arrived through the notification capture channel, how many still need a category, and roughly how long the notification waited before the app recorded it. We also keep, with your account, how you signed up (an invite link or your answer above) and how far you got in setup.
• What comes with each event: your account, the app version and build number, the build channel (Google Play or a development build), the Android version, the app language, whether you were using guest mode, a session identifier, and the analytics device ID — a random identifier created on the phone when the app is installed. It is not an advertising ID.
• Diagnostics: the app version, build, Android version, and the timing ranges above (such as how long a notification took to be recorded, or how many minutes setup took) are used to find what breaks. The Android app has no crash-reporting SDK and sends no crash logs.
• Turning it off: switch off Settings → Privacy → Share usage stats in the app. New events stop and anything waiting on the phone is deleted at once. The app works the same either way.

On both:

• What is never recorded: your messages or notification text, merchant names, notes, exact amounts, card numbers or names, contact names or phone numbers, or your email address. Where a size matters, only a rough range is kept (for example, a budget of "1k–5k").
• No usage statistics are sent while you use Madriss without an account or are signed out. Events recorded before you sign in wait on the phone and are deleted after 7 days if you never do.

What we don't do

• No advertising, and no data is ever sold or shared with data brokers.
• No tracking across other apps or websites, and no third-party analytics or advertising SDKs.
• No access to your bank accounts or cards. Madriss never sees your full card number, and it never moves money.

We use a small number of service providers to run Madriss, and they process data only to provide their service to us: Supabase (database, sign-in, and notifications backend; Tokyo, Japan), Apple (Sign in with Apple and iPhone notifications), and Google (Sign in with Google and Android notifications).

App Lock and biometrics

If you enable App Lock, authentication happens entirely on your device: through Face ID / Touch ID on iPhone, and through your phone's fingerprint, face, or screen lock on Android. Madriss never receives or stores your biometric data.

Data retention and deletion

Account data is kept while your account exists. Usage statistics are kept for 13 months, then deleted. You can delete individual transactions, or leave or delete households and groups, at any time.

• Delete your account: on iPhone, Settings → Delete account; on Android, Settings → Account → Delete account…. This permanently deletes your account and all associated data, including usage statistics. Deletion is immediate and irreversible. On Android it also clears the Qattah friends, groups, and balances kept on that phone.
• Without an account: Settings → Erase local data deletes the purchases, budgets, and categories on the phone. On Android it also clears your Qattah friend list, groups, and balances.
• Without the app installed: full instructions, including how to request deletion by email, are on the account deletion page (https://madriss.com/delete-account).

Your rights

Under Saudi Arabia's Personal Data Protection Law you can ask to access your personal data and get a copy of it, to correct it, and to have it deleted, and you can withdraw your consent at any time — for example by revoking Notification access or Contacts in your device settings, deleting your Shortcuts automations, switching off Share usage stats, leaving a household, or deleting your account. Email us at the address below, ideally from the address linked to your account. We may ask you to confirm your identity, and we reply within 30 days.

Children

Madriss is not directed at children under 13 and does not knowingly collect data from them.

Changes

If this policy changes, the updated version will be posted at this address with a new "last updated" date.

Contact

Questions about privacy, or a request about your data? Email support@madriss.com.