Privacy Policy
Last updated
Qirsh is a manual personal-finance tracker. It never connects to your bank, so the only financial data it holds is what you type in yourself, and the figures it works out from it. Your name and email are encrypted in the database, your password is hashed and cannot be recovered by anyone, and nothing is sold, rented, or used for advertising. You can export your data or delete your account permanently at any time from Settings.
- 1. Who we are
- 2. What we collect
- 3. Why, and our legal basis
- 4. What we do not do
- 5. How it is protected
- 6. Who else processes it
- 7. Where it is stored
- 8. How long we keep it
- 9. Deleting your Qirsh account
- 10. Your rights
- 11. Regional rights
- 12. Children
- 13. Changes
- 14. Contact
1. Who we are
Qirsh (“Qirsh”, “we”, “us”) is a personal-finance application operated by Zaid Haddadin, an individual based in Amman, Jordan. For the purposes of the EU and UK General Data Protection Regulation that individual is the data controller for the personal data described below.
You can reach us about anything in this policy at privacy@qirsh.app.
2. What we collect
Everything below is either something you entered yourself, or something the service records to run your account, to keep the service secure and working, and to understand how the app is used.
Account details
| Data | How it is stored |
|---|---|
| Display name | Encrypted at rest (AES-256-GCM) |
| Email address | Encrypted at rest |
| Password | Hashed with bcrypt. Hashing is one-way — we cannot read, recover, or tell you your password |
| Two-factor secret and recovery codes | Only present if you turn 2FA on. The secret is encrypted at rest; the recovery codes are stored as one-way hashes we cannot read |
| Profile picture | Only if you add one. Stored as you uploaded it |
| Preferences | Currency, language, theme, default account, notification settings |
| Terms of Service acceptance | The date you accepted the Terms of Service and which version, so we know which Terms apply to your account |
Financial data you enter
Accounts and cards you add (name, type, last four digits if you choose to enter them, balances, credit limits, interest rates), transactions, transfers, statement periods and payments, loans and their terms, installment plans, budgets, goals, tags, recurring rules, and saved templates. An entry can hold names you type in, including other people’s, such as a payee or someone who paid you back.
In the Qirsh app on iPhone and Android you can share text to Qirsh from another app, such as a message from your bank. It is read on your phone only to fill in a new transaction’s note and, when the text shows one clear amount, an amount you check before saving. The text is stored only if you save that transaction, like anything you type in, and it is not sent to anyone else or to any AI service. When the app asks you to rate it, the prompt is the App Store’s or Google Play’s own.
Technical and security data
| Data | Purpose |
|---|---|
| IP address | Recorded against sign-in attempts, rate-limited actions, document downloads, and each signed-in session, to detect brute-force and abuse |
| Sign-in attempts | A one-way fingerprint of the email tried, or of your internal account ID when you enter a two-factor code or confirm your current password in Settings — never the address itself — whether the attempt succeeded, and when, so repeated failures can be throttled |
| Signed-in sessions | For each device you are signed in on: the IP address and the browser’s user-agent string it signed in from, so Settings can list your sessions and you can end one you do not recognise |
| Error reports | An error message, the route it happened on, and a stack trace. Your user ID is attached where known so we can tell whether a bug affected one person or everyone. A report about a statement whose figures did not agree also records which account and statement it was, and the two balances that disagreed. Errors that happen in your browser are also sent to PostHog (below) |
| Feedback you send | Stored with the message you wrote |
| Push subscriptions | Only if you enable notifications: the browser push endpoint, its keys, and your browser’s user-agent string |
| Phone notification tokens | Only if you turn on notifications in the Qirsh app: the address Apple or Google gives your phone for notifications, whether the phone is an iPhone or Android, the app version and the language the app is in |
| App update checks | In the Qirsh app: each time it opens, it asks Expo, our app-update provider, whether an update exists. That request carries a random identifier created when the app was installed, your IP address, the platform and the app version, and, if the app failed to start after an update, the error it recorded |
Cookies
Qirsh sets three cookies. Two of them, authToken and refreshToken, are HTTP-only, meaning no script on the page can read them, and both exist purely to keep you signed in. They are strictly necessary: the app cannot function without them.
The third, qirsh_locale, remembers the language you chose. It is written only when you pick one, it holds nothing but that choice, and the page can read it — it has to, to render in your language. A preference you set yourself needs no consent banner either, and it is not used to recognise or track you.
There are no advertising cookies, no tracking pixels, and no third-party cookies of any kind. Our analytics are configured to store nothing at all on your device — no cookie, no local storage — so they keep no identifier of their own there. When you are signed in, the app tells PostHog your internal account ID (see below), which links your signed-in visits to it.
Product analytics
We use PostHog (EU-hosted) to understand which screens are used and where the app breaks. It is configured deliberately narrowly:
- We identify you to PostHog by your internal account ID only. We do not send your name or email.
- PostHog records which pages you open and when you leave them, and errors that happen in the app in your browser, with the error message and a stack trace.
- With each of these it receives technical details from your browser: the browser and operating system and their versions, the type of device, the screen size, your language and time zone, the address of the page you came from, and random identifiers that last only until the page is closed or reloaded. It may also receive measurements of how quickly pages load. In the Qirsh app it is also told that the page is open in the app, on iPhone or Android, and the app’s version.
- Session recording is switched off.
- Analytics requests are proxied through our own domain, so they are first-party and are not shared with an ad network. The proxy passes on your browser’s user-agent string and language setting, but not your IP address or your cookies.
- Automatic capture of the text of buttons and links you click is switched off, and query strings are stripped from recorded page addresses — so a search you ran, or a payee name, is not sent.
- Nothing is stored on your device: no analytics cookie, no local storage.
3. Why, and our legal basis
Under the EU/UK GDPR we must state a lawful basis for each purpose. Ours are:
| Purpose | Legal basis |
|---|---|
| Running your account and storing the finances you enter | Performance of a contract — this is the service you signed up for |
| Sign-in throttling, abuse prevention, error monitoring | Legitimate interests — keeping the service secure and working, balanced against your rights |
| Feedback you send | Legitimate interests — keeping the service secure and working, balanced against your rights |
| Product analytics | Legitimate interests, minimised as described above. You may object at any time |
| Transactional email (verification, password reset, alerts you asked for) | Performance of a contract |
| Push notifications | Consent — off unless you enable it, withdrawable in Settings, your browser or your phone’s settings |
4. What we do not do
- We do not sell your personal data. We never have, and there is no mechanism in the product to do so.
- We do not share it with advertisers, data brokers, or credit-reference agencies.
- We do not use your financial data to train AI models.
- We do not build profiles of you for advertising or for anyone else, and we make no automated decisions about you that have legal or similarly significant effects.
- We do not connect to your bank or hold credentials for any financial institution.
5. How it is protected
- All traffic is served over HTTPS only.
- Your name and email are encrypted at rest with AES-256-GCM, so a stolen database file or backup does not yield a readable directory of who uses Qirsh.
- Your password is hashed with bcrypt — a one-way function. Nobody, including us, can reverse it.
- When you choose a password — when you sign up, reset it, or change it in Settings — we check it against Pwned Passwords, Have I Been Pwned’s list of passwords exposed in known data breaches, and refuse it if it appears there. Only the first five characters of a one-way hash of it leave our servers — never the password, the full hash, or anything that identifies you — so that service cannot learn your password or who you are. We also check it against a list of common passwords held on our own servers, and that check still applies if the breach list cannot be reached.
- Two-factor authentication is available, and its secret is encrypted at rest.
- Sessions use HTTP-only cookies. Signing out ends your session, resetting your password ends all of your sessions, and changing your password signs out your other sessions.
- In the Qirsh app on iPhone and Android you can choose to lock the app with Face ID, a fingerprint or face unlock, with your phone’s passcode as the fallback. Your phone does the check: Qirsh does not receive your face, your fingerprint or your passcode, and our servers are not told whether the lock is on. The app also hides its screen in your phone’s app switcher.
Our access to your data
We do not look at your individual entries unless you ask us in writing, by email to support@qirsh.app, to look into a problem, or where the law requires it (section 6), and then only as far as that problem or that requirement needs. This is a promise about how we work, not a technical lock: as the note above says, your entries are protected by access controls, and the person who runs Qirsh (section 1) holds that access.
The owner-only pages in the app show usage figures — how many entries an account has logged, and when — and the error reports described in section 2. None of them lists your entries.
6. Who else processes it
We use a small number of infrastructure providers (“sub-processors”), listed in the table below. Each of them that is enabled, except GitHub and Expo, is bound by a data-processing agreement and may use your data only to provide their service to us. GitHub runs our backup job, and the maintenance jobs we start by hand on the database, under its own terms of service and privacy statement. Expo answers the Qirsh app’s update checks under its own terms and privacy policy.
| Provider | Role | Region |
|---|---|---|
| Vercel | Application hosting and delivery | EU; a request can first pass through a Vercel location near you (section 7) |
| Neon | Database, including a rolling restore history kept for recovery | EU |
| Resend | Transactional email: verification, password reset, notices about your account, and the reminder emails you can turn on. A reminder can contain an account name, an amount due, and a payee or description you entered | EU/US |
| PostHog | Product analytics and browser error reports, as described in section 2 | EU |
| Cloudflare | Storage for our encrypted backups | EU |
| GitHub | Runs our weekly backup job, and maintenance jobs we start by hand on the database. While the backup job runs, its server briefly holds an unencrypted copy of the database, then encrypts it and deletes that copy. While a maintenance job runs, its server reads the records the job works on, and the job can leave a log naming the records it changed (section 9) | Varies; may be outside the EU |
| Expo | Delivering updates to the Qirsh app on iPhone and Android: the update check described in section 2 | May be outside the EU |
| Sentry | Error monitoring — not currently enabled | EU |
A provider marked not currently enabled is wired into the app but switched off, and receives nothing at all today. We list it because it can be turned on by configuration rather than by a release, and you should not have to read a changelog to find out. We will not turn one on without a data-processing agreement in place and this page updated first.
If you turn on notifications, reminders reach you through the push service your browser or phone uses (for example Google’s for Chrome and Android, Apple’s for Safari, or Mozilla’s for Firefox). A reminder can contain an account name, an amount due, and a payee or description you entered. It is encrypted for your browser before it leaves our servers, so what the push service passes on is the encrypted message, not its text.
In the Qirsh app, reminders are sent from our servers through Apple’s push service to an iPhone and through Google’s (Firebase Cloud Messaging) to an Android phone, using the token your phone gave the app. These services can read what they deliver, so an app reminder never contains an amount, an account name or a payee: it says only what kind of reminder it is and, for a payment, when it is due, for example “A card statement is due in 3 days”.
Emails you send to our @qirsh.app addresses are forwarded through Cloudflare’s email routing to a mailbox we keep with Google (Gmail), so that we can read and answer them. We keep them there only as long as we need them to deal with what you asked.
We will also disclose data where we are legally required to — a binding court order or a valid request from a competent authority. Where the law allows, we may tell you about it.
If Qirsh is ever transferred to someone else, your data would go to them only as part of the service, never on its own, and only so that they can keep running the service under this policy. We will tell you before that happens, so that you can export your data or delete your account first.
7. Where it is stored
Our database, which holds your account and all your financial data, is in the European Union, and so are the encrypted backups we keep of it. A request you send to Qirsh can first pass through a Vercel location near you, which may be outside the EU, and some of the work is done there, such as checking that you are signed in and passing analytics events on to PostHog. Those requests and email delivery may use infrastructure outside the EU; where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses. In the Qirsh app, its update checks with Expo and the notifications Apple and Google deliver may also use infrastructure outside the EU; Expo, Apple and Google handle that part under their own terms. The job that produces our backups, and the maintenance jobs we start by hand on the database, run on GitHub’s servers, which may be outside the EU, under GitHub’s own terms (section 6).
8. How long we keep it
| Data | Retention |
|---|---|
| Account and financial data | Until you delete your account |
| Sign-in attempt and rate-limit records | Deleted by a daily clean-up once they are more than 24 hours old (35 days for records that count use over a month) |
| Error reports | Deleted automatically 30 days after the error was last seen, or with your account if they carry your account ID |
| Feedback you send | Until you delete your account |
| Phone notification tokens | Until you sign out of the Qirsh app on that phone or end one of your sessions, or until you delete your account; sooner if Apple or Google tell us the token no longer works, or if the app is not opened on that phone for 31 days |
| Session records and reset tokens | Sessions expire automatically and are then cleared, taking the device details recorded against them with them; reset tokens are single-use |
| Product analytics | Kept by PostHog. When you delete your account, we ask PostHog to erase what it holds under your account ID (section 9) |
| Encrypted backups | Taken weekly and deleted automatically 90 days later |
| Database restore history | A rolling history our database provider keeps for recovery, currently no more than the last 7 days; data leaves it as the history moves on |
Section 9 sets out what deleting your account removes straight away, and what remains for a while.
9. Deleting your Qirsh account
The app Qirsh: Know What You Owe and the website at qirsh.app use one and the same account. You can delete it from any web browser, without the app:
- Sign in at https://qirsh.app.
- Open Settings. On a phone, tap your picture or initials at the top of the screen, then Settings.
- Choose Delete account (on a phone, tap Delete beside it), type
DELETE, enter your current password, and confirm.
If you have forgotten your password, reset it first with Forgot? on the sign-in page. If you cannot sign in at all, email privacy@qirsh.app from the email address on the account and ask us to delete it.
Deleted straight away
Your account and everything in it: your name, email address, password, two-factor settings, profile picture and preferences; your accounts and cards, transactions, statements, loans, installment plans, budgets, goals, tags, recurring rules and templates; your sessions, notification subscriptions, phone notification tokens and notification history; the feedback you sent; and the error reports that carry your account ID. Deletion cannot be undone, and we do not restore deleted accounts, so export a copy first if you want one.
What remains for a while
- Encrypted backups. Deleted data can remain in our weekly encrypted backups until each one is deleted, 90 days after it was made.
- Our database provider’s restore history. Neon keeps a rolling history of the database so that it can be recovered after a failure; on our plan it currently covers no more than the last 7 days. Deleted data leaves it as that history moves on.
- Security records. These are records that limit how often sign-ins, downloads and other actions can be repeated. They hold a one-way fingerprint of your email address or account ID, or your account ID itself, with the IP address the request came from. A daily clean-up deletes them once they are more than 24 hours old (35 days for records that count use over a month).
- Other error reports. An error report that does not carry your account ID is deleted automatically 30 days after that error was last seen.
- Maintenance logs. A maintenance job we start by hand on the database (section 6) can leave a log naming the records it changed and the values it replaced, so that the change can be undone. GitHub keeps that log for no more than 14 days, and less if we delete it sooner.
- Analytics. Deleting your account automatically asks PostHog to erase the analytics it holds under your account ID, including any session recordings. PostHog carries out the erasure on its side. Until PostHog accepts the request, your account ID stays on our list of pending erasure requests so that the request can be sent again, and it is removed from that list once PostHog accepts.
- Email. Emails you have sent us, our email provider’s records of the emails we sent you, and any alert about a fault in the app that was emailed to us with your account ID in it are not deleted with your account.
- App update checks. Expo’s records of the Qirsh app’s update checks (section 2) are not deleted with your account.
- Hosting logs. Our hosting provider keeps short-lived logs of requests and server errors, which can include your IP address, your account ID or other details of a request. They expire on the provider’s schedule and are not deleted with your account.
10. Your rights
Wherever you live, you can:
- Access your data — export it from Settings at any time: a JSON file holding your profile and your main records, or a CSV of your transactions. For anything else we hold, ask us and we will send it.
- Correct it — your accounts, transactions and other entries are all editable in the app. Your name and email address are not editable in the app; email us and we will change them for you.
- Delete it — section 9 explains how, what is deleted straight away, and what remains for a while.
- Take it elsewhere — the JSON export is a machine-readable file you own.
- Object to or restrict processing based on legitimate interests, including analytics.
- Withdraw consent for notifications, without affecting anything before that.
Most of these you can exercise yourself, immediately, without asking us. For anything else, email privacy@qirsh.app; we respond within 15 working days of receiving your request. If we need longer for a good reason, we will tell you why before those 15 working days are up, and take no more than 15 working days more. We do not charge for this, and we will not treat you worse for exercising a right.
11. Regional rights
European Union and United Kingdom
You have the rights in Articles 15–22 GDPR, as summarised above. You also have the right to lodge a complaint with your supervisory authority — your national data-protection authority in the EU, or the Information Commissioner’s Office in the UK — and you may do so without contacting us first.
United States
Wherever you live in the United States, you have the rights described in section 10. We do not sell or share personal information, as US state privacy laws define those terms, and we do not process it for cross-context behavioural advertising, so there is no “Do Not Sell or Share My Personal Information” action to take.
Middle East and North Africa
Where the Jordanian Personal Data Protection Law No. 24 of 2023, the Saudi Personal Data Protection Law, or UAE Federal Decree-Law No. 45 of 2021 applies to you, you have rights of access, correction, deletion, and objection substantially as described above, and you may complain to your national regulator.
12. Children
Qirsh is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from anyone under 16. If you believe someone under 16 has created an account, email us and we will look into the report and, where appropriate, delete the account.
13. Changes to this policy
If we change how we handle your data in a way that materially affects you, we will notify you by email or in the app before it takes effect. The date at the top of this page always reflects the current version.
14. Contact
Privacy questions, requests, or complaints: privacy@qirsh.app. See also our Terms of Service.