Halala: Privacy Policy
Last updated: 8 November 2026 · النسخة العربية
Halala ("the app", "we") helps you see where your money goes. This page explains what data the app handles, why, and the choices you have. Contact: [email protected].
What we collect
- Account: your email address, the name you enter, and either a password (stored only as a hash by our authentication provider) or, if you use Sign in with Apple, Apple's identifier for you (and the relay email address if you chose to hide your email).
- Your spending data: the purchases, refunds, bills, salary and transfers you add or capture: merchant, amount, date and time, category, the last four digits of a card or account, your budgets, bank accounts you list as your own, and your settings.
- Bank messages you choose to capture: if you set up the optional iOS Shortcut, the text of the bank SMS you send to the app is stored so it can be read again if the format changes. Balance lines are removed before storing, and one-time-passcode messages are not kept. A message can still contain details such as merchant names or account endings.
- Technical: a capture token and a widget token that identify your phone to your own account, and the time of the last capture.
We do not collect your location, contacts, photos or advertising identifiers, and the app has no advertising or analytics tools.
How we use it
- To show your spending, bills, budgets and insights, and to categorize your purchases.
- To sign you in, keep your account secure and send emails you ask for (password reset, email confirmation) or that protect your account (account deletion requested, account active again).
- Optional AI features, only if you turn them on: short pieces of your data (for example merchant names and summary figures) are sent to Anthropic's Claude API to suggest categories, answer your questions about your spending or write tips. Card, account, phone and email details are removed before anything is sent. AI is off unless you enable it.
- Optional AI reading of bank messages (paid plan, separate switch, off by default): for messages from a bank the app does not recognise yet, the text of that one message is sent to Anthropic's Claude API so it can be turned into a transaction. Before sending, balances, account and phone numbers, IBANs, emails and links are removed, and transfer messages (which contain people's names) are never sent. One-time passcode messages are never sent.
We do not sell your data and we do not use it for advertising.
Who processes it for us
- Supabase hosts the database, sign-in and server functions (project region: Mumbai, India).
- Resend delivers the emails listed above.
- Apple provides Sign in with Apple and TestFlight.
- Anthropic processes the optional AI requests described above.
These providers process data only to provide their service to us.
Keeping and deleting your data
Your data is kept while your account exists. In the app, go to Account > Privacy > Delete my account. The account is then closed immediately and permanently deleted, with all its data, after 30 days. Signing in again within those 30 days cancels the deletion. You can also ask us to delete your account by email.
Your rights
You can see and correct your data in the app. You can ask us by email for a copy of your data or for deletion. We will reply within a reasonable time.
Security
Data is sent over encrypted connections and protected by per-user access rules in the database. The app can lock with Face ID. No system is perfectly secure, so please use a strong password.
Children
The app is not intended for children under 13 and we do not knowingly collect their data.
Changes
If we change this policy we will update the date above and, for significant changes, tell you in the app.