Privacy Policy

1. Definitions

"Frichie", "we" and "us" mean the Frichie service: the app for iPhone, our server and frichie.com. An "install" is one installation of the app. An "account" is the record our server keeps when you sign in; you need one to use Frichie. A "masked message" is a bank message after your iPhone has removed the details listed in section 3.

2. Controller

Frichie is the controller of the personal data described here. Contact: support@frichie.com.

3. Data we process

Until you agree, Frichie asks our server only for things that are the same for everyone — the app's settings, the category list and the shop facts for your country. No bank message is read or sent. To use Frichie you sign in: Frichie registers this install (its App Attest key) and sends what you sign in with — Apple's or Google's sign-in token, or the e-mail address you type. Your agreement is recorded only after the sign-in succeeds.

Frichie's AI reads your bank messages to sort them. Card numbers are masked first.

Your bank messages are read by an AI so you don't have to sort them. Before anything leaves your iPhone, card and account numbers are cut to the last 4 digits, and balances and available limits, codes, links, phone numbers, e-mails and names the app recognises are removed. The amount, shop and wording stay.

With each message, the names of your categories are sent so the AI can file it; these can include names you typed.

The masked message is read by Google's Gemini. If Google is unavailable or cannot read a message, Anthropic's Claude reads it instead. Neither trains on your messages. Google keeps requests for a limited period; Anthropic for up to 30 days.

Reading by Anthropic's Claude stays switched off until it passes our accuracy checks.

If a message comes from a sender that exactly matches a bank in the list built into the app, that bank's sender ID from the list is sent with it. No other sender is ever sent.

Your iPhone checks every amount against the message before anything is filed. If it can't confirm the amount, the message waits for you.

Your country (a two-letter code) is also sent with each message. Messages you paste and the text of screenshots, statements and imported backups are read the same way. Our server adds nothing about you to what it passes to the AI, and does not keep the message or its amount.

We don't host your money data. It lives on your iPhone and your private iCloud. Our server keeps counters — how many messages were read, your subscription status and the privacy notice you agreed to — never a message, an amount or a name.

Our server also keeps, for this install, the two-letter country code your iPhone sent with its latest read (the country you chose in Settings, or your iPhone's region) — replaced by each read, never a history. We use it only to count how many iPhones in a country used Frichie in the last 30 days, so shared facts open there only once enough people use it. It is deleted with this install's record.

Your subscription record holds what Apple's signed receipt says about it: Apple's original transaction id, the product (monthly or yearly), whether it is a sandbox or a real purchase, its expiry, grace-period and refund dates, whether it renews automatically, whether it is shared through Family Sharing, the type of offer (such as the free trial), when a paid period was first confirmed, when Apple signed the latest update we applied, when it was last updated, and when and how many times recently it was claimed by an iPhone. It is tied to this install and deleted with it. If you are signed in, it is also linked to your account; Delete my data then removes only its link to this install. Our server also keeps a SHA-256 hash of the store and transaction id, with the one-time import counter described below; that survives Delete my data until 30 days after your subscription ends.

For requests that are not tied to your install — such as fetching the app's settings, shop facts, the category list or shop logos, or registering this install — our server uses your IP address only for a moment, to limit how often requests can be made. Cloudflare, our network provider, sees it as it carries the request. We don't store it, and it is not sent to Google or Anthropic.

If this install doesn't contact our server for 18 months, we delete its record. Your consent record — only which version of the privacy notice you agreed to and when — is part of that record: it is kept until you use Delete my data or until that 18-month deletion.

To check that requests come from a genuine copy of Frichie, our server keeps this install's App Attest key ID and public key, and a counter of its signed requests. They are deleted with this install's record.

You need an account to use Frichie: you sign in with Apple, Google or e-mail when you start. Signing out, or deleting your account, leaves the data on your iPhone and in your iCloud as it is; Frichie asks you to sign in again before you go on.

When you sign in, we keep an account record: a random account id, how you signed in (Apple, Google or e-mail), the user ID Apple or Google gives us for that sign-in, and your e-mail address, stored encrypted and as a one-way hash so we can find your account. We use it to sign you in, to keep your subscription with you on a new phone, and to answer support requests. Your transactions, bank messages and shop names are never linked to it. The account holds no name, and our server does not keep your transactions or bank messages. If you use Apple's Hide My Email, the address is the relay address Apple gives us.

Each iPhone you sign in on has its own sign-in, tied to its install; our server keeps only a one-way hash of its token. A sign-in ends when you sign out, after 90 days without use, or at the latest 365 days after you signed in. When it ends, that install is no longer linked to your account. An account can be signed in on up to 5 iPhones; signing in on a sixth signs out the one used least recently.

If you sign in with e-mail, we send a six-digit code to your address from no-reply@mail.frichie.com, through Cloudflare's Email Service. The code works for 10 minutes, and our server keeps only a one-way hash of it. To limit abuse, our server counts the codes sent to each address and from each install, and uses your IP address for a moment; we don't store your IP address.

If you sign in with Apple, our server also keeps Apple's sign-in token, encrypted, only so that it can ask Apple to revoke Frichie's sign-in when you delete your account.

If you are signed in, your subscription record is also linked to your account, so your other iPhones signed in to it get the subscription too.

To recognise a shop and find its website and logo, only the shop's name and your country are looked up online by AI. Never your message text, amounts or anything about you.

What a shop is — its name, website and category — is researched once per country and shared with everyone. A shop's website is approved automatically when it clearly matches the shop's name; the rest is checked by us. Shop facts are about businesses, never about you.

Shop logos come from Logo.dev or, if it has none, from the shop's own website. Our server fetches each logo once, keeps a copy and shares it with everyone, so your iPhone never contacts Logo.dev or the shop. No message text, amount or anything about you is sent for this.

If you ask us for help on WhatsApp, that conversation happens outside the app, under Meta's WhatsApp terms. Never send us a bank message or a screenshot of one there; we only need to know which setup step you are on.

If you join the waitlist on frichie.com, we keep your e-mail address only to tell you when Frichie launches. To be removed, write to support@frichie.com.

4. Data we do not collect

When your iPhone has learned how your bank words a message, it files that message on your iPhone and sends nothing.

A text with no amount and currency near each other is not treated as a bank message: it stays on your iPhone and is never sent, unless you choose Read it anyway.

Screenshots and statements are read on your iPhone. Only the masked text is sent to the AI, and for statements, only the rows the phone can't read or the rows you choose to send.

Voice entries are turned into text on your iPhone, and you check them like a row you typed. Neither your voice nor its text is sent to the AI or to our server.

To use Voice in Arabic, the speech model is downloaded from Apple once; your voice never leaves your iPhone.

The name you enter in the app is used on your iPhone to hide your own name in bank messages. It is never sent to our server or to the AI; like the rest of your Frichie data, it is kept in your private iCloud.

Deleting the app keeps your data in your iCloud. Reinstall on any iPhone signed in to the same Apple Account and it comes back. To erase everything, use Delete my data.

Frichie doesn't track you across apps or websites, shows no ads, and doesn't sell your data or share it for advertising. There are no analytics, crash-reporting or advertising tools in the app. The website sets no cookies.

5. Purposes and legal bases

• Your consent — to have your masked messages read by AI providers, including outside your country. You give it when you sign in, on the screen that says that signing in includes AI reading and shows this notice in full under "What exactly is sent" (or, where Frichie asks again, on the consent screen). If you turned AI reading off, signing in leaves it off. You can withdraw it at any time (section 9). Without it, Frichie keeps your messages on your iPhone and you can sort them yourself.
• Our agreement with you (the Terms of Use) — to run your subscription, counters and install key, your account, and to keep the service secure.
• The law — to keep records the law requires, such as your consent record.

These are our grounds under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where they apply to you, the Saudi Personal Data Protection Law and Egypt's Law No. 151 of 2020.

6. Recipients

Each must protect your data at least as well as this policy describes and use it only to serve us. We don't sell your data or share it with anyone else unless the law requires it.

7. International transfers

Masked messages are processed outside the UAE, including in the United States. We rely on your express consent and each provider's data processing terms: Google's data processing addendum, under which it does not use the messages to improve its products and logs them for a limited period to detect misuse; Anthropic's, which includes the EU standard contractual clauses. Where Saudi or Egyptian law asks for more (transfer safeguards and a risk assessment, or a permit), we put it in place before Frichie is offered there. If you sign in with e-mail, the code e-mail is sent through Cloudflare's Email Service, which may process your e-mail address outside the UAE.

8. Retention

• On your iPhone and in your iCloud: until you delete it.
• Our server's record of your install: until you use Delete my data, or 18 months after it last contacted us.
• Your account: until you use Delete account, or 18 months after it was last used, once no iPhone is signed in to it and no subscription is linked to it.
• A sign-in on an iPhone: until you sign out, 90 days without use, or 365 days after you signed in.
• Sign-in codes: 10 minutes; counts of codes sent: 2 days.
• Apple's sign-in token after Delete account: only if Apple could not be reached, until Apple confirms the revocation, for at most 10 more tries.
• Monthly read counters: 13 months.
• Subscription updates from Apple not tied to an install: 90 days after the subscription ends.

Delete my data erases:

1. everything on this iPhone — transactions, shops, budgets, saved messages;
2. your iCloud copy of Frichie data;
3. our server's record of this install — its key, counters, country and your consent record.

To prevent repeated use of the free one-time import allowance, we keep a one-way hashed code for your subscription — none of your messages, amounts or names — for up to 30 days after it ends. It can't be used to rebuild your transactions.

Your App Store subscription is not cancelled by this — manage it in Settings › your name.

Delete account (Settings › Account) removes the account record and signs you out everywhere. It does not delete the data on your iPhone or in your iCloud unless you also choose Delete my data.

Delete account does not cancel your App Store subscription. Delete my data signs this iPhone out of your account but does not delete the account.

9. Your rights

Depending on where you live, you can ask to access, correct, erase or receive a portable copy of your personal data, to restrict or object to its use, and you can withdraw consent at any time.

To withdraw consent, turn off Settings › AI reading & privacy › AI reading. From then on no bank message is sent; new messages are saved on your iPhone, unread, and nothing is deleted. Reading done before is not undone.

You can see, export and delete your data in the app yourself. Our support can find your account by your e-mail address, and you can delete it yourself in Settings › Account. An install that isn't signed in we can find only through your app. For anything else, write to support@frichie.com. We reply within 30 days, or tell you why we need up to 30 more.

You can complain to the UAE Data Office, Saudi Arabia's SDAIA or Egypt's Personal Data Protection Center.

10. Security

Data travels encrypted, messages are masked on your iPhone, and requests are signed with an App Attest key. Sign-in tokens and codes are kept only as one-way hashes, and your e-mail address is stored encrypted. If a breach is likely to put you at risk, we tell the authority the law requires (in Saudi Arabia and Egypt within 72 hours) and tell you through the app or our website without undue delay.

11. Children

Frichie is for people aged 16 and over, and 18 and over in Saudi Arabia and Egypt. If you believe a child is using Frichie, write to us and we'll help erase the data.

12. Changes

We update the date above when this policy changes. If a change affects what is read or sent, the app asks you to agree again before it reads more messages. This policy is in English and Arabic; if they differ, the English applies unless your local law requires otherwise.

13. Contact

support@frichie.com