Privacy Policy

What we collect

Creating an account and using Amanah involves the following information:

• Account details — your email address and, optionally, your full name. Your password is never stored by us; it's held by our authentication provider, Supabase, in hashed form we can't read.
• Ledger records — whatever you choose to enter: counterparty names, amounts, currency, dates, descriptions, and notes for each amanah you record.
• Trusted people and sharing — the email addresses of people you add as trusted contacts, and which specific records you've chosen to share with them.
• Basic technical data — collected automatically by our hosting and backend providers as part of normal operation, such as IP address and timestamps in server logs. We don't use this for tracking or analytics; it's incidental to running a website.

What we don't collect

We don't run any analytics or advertising trackers, we don't collect device fingerprints or advertising identifiers, we don't ask for or store bank account or card numbers, and we don't request access to your contacts, location, camera, or microphone. Amanah doesn't have a mobile-carrier integration, doesn't buy or sell data about you, and doesn't share your information with advertisers, because there aren't any.

How your data is used

Your information is used for exactly one purpose: running the app for you — authenticating your account, storing and displaying your ledger, and enabling sharing with the specific people you choose. We don't use it for anything else, and we don't analyze it to build profiles, train models, or serve you targeted content.

Who can see your data

By default, every record you create is visible only to you. If you add someone as a trusted person and explicitly share a specific record with them, they can see that one record — not your full ledger, and not anything else you haven't shared. Removing someone from your trusted people immediately cuts off every record ever shared with them.

This isn't just a setting in the app's interface — it's enforced at the database level, so the same rule applies no matter how the data is accessed. We, as the people running Amanah, don't casually browse user data; we'd only access it to investigate a specific reported problem or if legally required to.

Where your data lives

We rely on two service providers to run Amanah, and nobody else:

• Supabase — hosts our database and handles authentication (sign-up, sign-in, password resets, confirmation emails).
• Vercel — hosts the app itself (the pages and code your browser loads).

Neither is an advertising or data-broker company; both are infrastructure providers we pay to run the service, under their own privacy and security commitments.

Invite links

When you add someone as a trusted person, Amanah generates a link for you to send them yourself — we don't email it on your behalf. Before that person signs in, the link shows only a partially masked version of the email address it was intended for (like bo**@example.com), so that anyone who happens to see the link in transit can't read the full address. The invite only connects once someone signs in or creates an account using that exact address.

Data retention and deletion

Deleting a record removes it immediately. If you delete your account, your profile and every record you own are permanently removed along with it — this isn't a soft delete or a "deactivation," it's a real deletion. Records you shared with someone else are removed from their view at the same time, since access to a record only exists as long as the record does. If you'd like your account deleted and don't see a way to do it yourself in the app, contact us using the details below and we'll take care of it.

Security

All traffic to Amanah is encrypted (HTTPS). Passwords are never visible to us — they're managed entirely by Supabase's authentication system. Access to your data is restricted at the database level based on your account and, where applicable, explicit sharing grants you've created — not just by what the app's interface happens to show. No system is perfect, and if we ever become aware of a security issue affecting your data, we'll let you know.

Children's privacy

Amanah isn't directed at children, and we don't knowingly collect information from anyone under 13. If you believe a child has created an account or provided information to us, please contact us and we'll remove it.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page. We'd encourage checking back occasionally if you want to stay current, though we don't expect to change how Amanah handles your data often — the app's whole premise is built around keeping things private by default.

Contact us

Questions about this policy, or requests about your data — including access, correction, or deletion — can be sent to Mutawakkilyusuf@yahoo.com or via WhatsApp.