BarakahFlow Privacy Policy
Last updated: August 2026
Written to be true, not to be reassuring. Your financial data is yours. It is never sold, never shared with advertisers, and never used for advertising or profiling of any kind. Below is exactly what is held and who can reach it.
1. Who we are
BarakahFlow is a halal personal finance app for Muslims covering everyday budgeting, bills, savings and net worth, built around a Zakat engine. It is a personal finance tool, not a bank or a regulated financial service.
2. Data we collect
- Account data: your email address and, if you sign in with Google, your name and profile picture as Google provides them. Used for signing in and for display.
- Profile settings: your first name, base and display currency, income type and pay day, and your time zone (detected automatically so reminders arrive at a sensible local hour).
- Financial data: the accounts, income, transactions, bills, budgets and savings goals you enter.
- Asset data: gold and silver weights, investment holdings and the tickers you add, and business trading stock.
- Zakat data: the figures and method settings you enter for your calculations, and the calculations you choose to save.
- Push notification tokens: if you enable reminders, a device token is stored so notifications can be delivered to that device. Removing the device or turning reminders off removes it.
- Anonymous usage counts: aggregate counts such as how many people completed setup. No personal information is attached to these.
3. How we use your data
- To provide the app and sync it across your devices.
- To calculate your budgets, bill schedules, net worth and Zakat estimates.
- To send the reminders you have enabled.
- To let you delete your data at any time, and to provide a copy of it on request.
Note: We do not use your financial data for advertising, profiling, or any purpose outside of operating the app for you.
4. Third-party services
These are the only third parties involved in running BarakahFlow.
Services that hold or process your data
- Supabase: our database and authentication provider. Your account and financial data is stored on Supabase servers. See supabase.com/privacy.
- Vercel: our hosting provider. See vercel.com/legal/privacy-policy.
- Google: optional sign-in provider only. If you choose to sign in with Google, we receive your email, name and profile picture from Google. See Google's Privacy Policy.
- Firebase Cloud Messaging (Google): delivers push notifications to Android devices. It receives your device token and the contents of the reminder being sent, which never include your balances or Zakat figures.
- Web Push: delivers push notifications in browsers and on iPhone via your browser vendor's push service, using the same device token arrangement.
- Vercel Analytics & Speed Insights: anonymous technical performance monitoring, described in full below.
What Vercel Analytics actually does
We would rather name this plainly than let it sit behind the word “private”. Vercel Analytics & Speed Insights measures how the app performs on your device: how quickly a page loads and renders, which screens are slow, whether something errored, which page was visited, referrer, and rough device, browser and country class, which is enough to tell a slow phone apart from a slow server, and to find out that a screen is sluggish on older devices before you have to report it.
It uses no cookies and no fingerprinting, builds no profile of you, and is not joined to your account. It never sees a balance, a transaction, a metal weight or a Zakat figure, because those sit behind your login and are not part of what it measures. It is technical instrumentation, not advertising or profiling: we run no ad networks and no third-party marketing pixels, and we do not sell data to anyone.
Market data feeds (no personal data is sent to these)
- Swissquote: live international gold and silver spot prices.
- open.er-api.com: daily foreign exchange rates.
- Twelve Data: market prices for the stock and ETF tickers held by users. Requests carry ticker symbols only and are never linked to an individual account.
- Upstash: rate limiting on our price endpoint, to keep the service available.
We request prices from these feeds from our own servers. They do not receive your identity, your holdings, or any figure you have entered.
5. Data on your device
Your data is cached locally on your device so the app opens instantly. The most sensitive figures (including your income, metal weights, and Zakat inputs) are deliberately stripped out of that local cache.
6. Data retention
Your data is retained as long as you have an account. You can delete your account at any time from Profile → Delete Account, which permanently removes all your data from our systems. If you have uninstalled the app or cannot sign in, you can request account and data deletion at our public account deletion page.
7. Your rights
You can see everything held about you directly in the app. You can delete your account and all associated data at any time from Settings, which removes it permanently, or submit an account deletion request if you no longer have the app installed. You can request a copy of your data by getting in touch.
Depending on where you live, you may also have rights to correct your data, restrict or object to processing, or complain to a data protection authority. Email us and we will help.
8. Data security & access
All data is encrypted in transit (TLS) and at rest. We use row-level security (RLS) to enforce strict per-user isolation, so no user of BarakahFlow can ever see another user's data. Not now, not by accident.
The part most apps don't say out loud: as the operator of the service, BarakahFlow's infrastructure technically permits administrative access to stored data for maintenance, debugging and legal compliance. The team does not look at individual users' data except where it is necessary to fix a technical problem you have reported, or where the law requires it. This is standard across effectively every cloud-based financial app, including major banks, but it is stated here plainly rather than hidden behind a claim that nobody can see your data.
9. Children
BarakahFlow is not directed at children. You must be 13 or older to create an account.
10. International transfers
BarakahFlow is operated from the United Arab Emirates and our providers operate infrastructure in a number of countries, so your data may be stored and processed outside the country you live in.
11. Changes to this policy
We may update this policy as the app evolves. The “Last updated” date at the top will reflect any changes.
12. Contact
Questions about your privacy? Email us at: barakahflowapp@gmail.com