Privacy Policy for iOS

01 Who operates Jarivo

Jarivo is developed and operated by Muhammad Huzaifa Malik under Huzaifa Dev, as an individual operator in Italy and the controller for the processing described here. For support or privacy requests, email hypcheckss26@gmail.com. This notice covers Jarivo on iPhone and iPad and the optional account and Together services used with it. Android integrations have separate platform disclosures; they are not automatically used by the iOS app.

02 Personal and optional account journals

Personal works on your device without an account. Financial entries, labels, notes, jars, budgets, reminders, card and loan records and reports are processed locally. Signing in does not automatically upload or convert Personal into a shared journal. Account journals and shared spaces are separate destinations. Records you save, import or restore into an account journal can synchronize through the account service. Offline changes wait for a successful connection and synchronization.

Local journal, draft and stored receipt files are encrypted in private app storage. Some interface and security preferences are held separately. Earned accomplishments and celebration preferences belong to the private journal, not the shared financial record stream. Hiding amounts changes the display; it is not access control or export redaction.

03 Receipts, imports and copies you choose

Receipt text recognition uses Apple Vision on your device. Jarivo does not upload an image or recognized text to perform OCR. You review the financial details before saving. A stored receipt copy is resized and re-encoded without the source EXIF/GPS metadata. Saved receipt photos in an account journal can synchronize as encrypted private cloud records; this is separate from OCR. Shared receipt-photo replication is not currently offered.

Statement files and row review are processed locally. File import is not bank access. Reports exported as PDF, Excel or CSV are readable files. Portable backups are encrypted using the recovery password you choose. Keep a usable copy and its password separately; account sign-in cannot reset an independent backup password. Restoring a backup replaces the destination journal after validation. Copies you export to Files, iCloud Drive, email or another provider follow that destination's rules and are not removed by deleting your Jarivo account.

04 Accounts, recovery and shared content

The account service processes email, account and session identifiers, authentication proofs and security metadata. Email/password and Sign in with Apple are available only when configured and enabled. Apple sign-in uses a one-use proof; a refresh credential is kept encrypted in restricted server custody for revocation. It is not placed in financial journals or backups.

Account financial payloads are encrypted before synchronization. Restricted server-managed recovery protects account and sharing keys and can return them after the required authentication and current-session checks. Sufficiently privileged service infrastructure has the technical ability to recover those keys and decrypt protected data. This is not a promise of end-to-end encryption accessible only to you.

One active account session is enforced by the service: a new sign-in can replace the previous device's connected access without remotely erasing its local records. Together processes invitations, recipient emails, membership, roles, verification keys, wrapped keys and record/version/operation metadata. Invited members can read permitted shared content. Shared attribution distinguishes the economic participant from the original recorder and time; former-member provenance can remain in financial history. Removing access cannot erase copies already downloaded. Keep unnecessary private or medical information out of shared plans.

05 Subscriptions and Apple services

Apple handles App Store payments. Jarivo receives account-linked product, transaction, original-transaction, environment and verification/status information to establish and maintain Together access. It does not receive your payment-card number from Apple. Minimum purchase ownership and transaction evidence can remain to prevent a purchase being reassigned after account deletion. Deleting Jarivo or its account does not cancel an Apple or Google subscription; manage it with the store where it was purchased.

06 Notifications and operational metadata

Local reminders and optional playful notifications are scheduled on the device. Their scheduling does not upload your journal or usage history. If you enable remote account or shared-update notifications, Apple Push Notification service receives a device token and a generic update hint. Jarivo stores an account/session-bound registration, encrypted APNs device token, app topic, environment, generation and routing/replay metadata. Hints do not contain names, amounts, transaction text or keys. Turning notifications off stops future eligible hints; network revocation can be delayed until connection or expiry.

The iOS app does not offer optional diagnostic or recent-activity reporting or upload those reports. Operational request and security processing still applies to connected services. Connected requests pass through Supabase's gateway. Operational logs retain IP addresses and IP-derived country, city and region, along with technical request/status information, for security, diagnostics and reliable service. This is coarse network location, not GPS access. Jarivo does not use these fields for advertising or cross-app tracking. A private worker ledger records bounded request IDs, times, worker kind, outcome and counters; it excludes account IDs, URLs, credentials, financial payloads and provider diagnostics.

07 Providers, purposes and international processing

Supabase supplies authentication, database, storage and server functions. Under its data-processing terms it processes application data on customer instructions and prohibits sale or cross-context behavioural advertising of that data. Its infrastructure and listed subprocessors can participate in providing the service. The selected primary project is eu-west-1; primary database location is not a promise that all logs, support or processing remain in one country.

Apple provides the iOS services you choose, including sign-in, purchases and notifications. Email-delivery providers support account verification and recovery. Support email uses Gmail, and public website visits use the website's hosting and browser services. Those providers also process their own service information under their terms. Jarivo has no advertising or tracking SDK and does not sell your financial records. Requested features, account security, fraud prevention, reliability and support are the purposes of the processing described here.

Supabase can process covered data outside the European Economic Area through its service and subprocessors. Its Data Processing Addendum incorporates the EU Standard Contractual Clauses under Decision (EU) 2021/914 for covered transfers where applicable; the subprocessor list identifies its providers. This does not mean every Apple, email or website operation uses the same transfer mechanism. Contact us for information or a copy of safeguards relevant to your data.

08 Retention and deletion

Support housekeeping targets deletion of resolved conversations after 90 days without an update and other conversations after 365 days without an update. Support operation-retry records and removal tombstones target 30 days. These are bounded cleanup schedules rather than promises of immediate erasure from every provider archive. You can request earlier conversation removal in the app or contact support; verified account deletion removes account-linked support data.

Local records remain until you remove or replace them. Account private records and recovery material are retained to provide the account service and are subject to verified deletion. Shared financial history may remain while its shared space exists so authorized members can retain and verify their records. Subscription expiry is not automatic deletion.

The current Supabase Free allowance exposes API/database operational logs for one day; other provider records and backups have separate deletion cycles. Server cleanup works in bounded jobs, so a timestamp is not an immediate guarantee of physical erasure. Apple capture-operation metadata targets seven days. Active Apple refresh credentials remain for revocation; revocation-only ciphertext targets seven days, with account deletion delayed at most 24 hours by provider revocation outage. Missing or failed Apple revocation can require manual removal of Jarivo access in Apple account settings.

APNs registrations expire after 35 days without refresh; queued hints expire within 24 hours. Stale delivery history targets seven days. Private worker terminal outcomes target seven days and at most 4,096 retained invocations per worker; pending outcomes remain until classified. These schedules require operational cleanup and monitoring.

Restricted pseudonymous purchase-ownership and Apple subject/token/owner hash records do not currently have a fixed automatic expiry. They can remain after credential erasure to prevent reassignment and preserve revocation/security evidence. They are not anonymous. Provider archives, legal/security records and email correspondence can have different retention; contact us for the applicable record and reason.

Request account deletion in Settings → Account & sharing → Profile & sign-in, or email hypcheckss26@gmail.com from the account email, with subject Jarivo account deletion. Do not send passwords, codes or financial records. Ownership and identity must be verified; shared owners may need to transfer or resolve ownership first. We complete verified account-deletion requests within 30 calendar days. Completion is separate from request submission, store cancellation and deletion of local/external copies.

09 Support conversations

When you send a support conversation, Jarivo processes the category, subject, message text, dates, conversation status and read acknowledgments so the authorized support team can reply. Signed-in support is linked to your Jarivo account. Support without an account uses a persistent random device-scoped identity whose proof is protected locally and checked by the service; it is pseudonymous, not anonymous. Support text is stored by the support service and is readable by authorized support staff. Financial journals and receipt photos are not automatically attached.

Explicitly submitted messages waiting for delivery are encrypted on this device, separately for guest and signed-in support. The local queue expires after seven days and is excluded from financial backups and journal synchronization. Unsent composer drafts and downloaded conversation text remain in app memory. Losing the local guest identity, for example by removing app data, can prevent you from reopening those guest conversations. Signing in does not merge guest and account support.

Use Help & support → Support conversations to remove a conversation. When online, removal deletes its active conversation and messages and scrubs stored reply snapshots used for retries; restricted replay-prevention metadata can remain until cleanup. Offline removal waits for an online retry. Account deletion also removes account-linked support conversations; guest conversations are separate. Erasing a financial journal does not erase support conversations. Do not send passwords, payment-card details or private financial documents.

10 Website visits and support

The public website is hosted by Cloudflare. Website delivery and security can process IP address, request time, requested page, browser/device information and errors. Appearance preferences can be stored in your browser. Visiting a page does not send your journal to the website.

The optional Buy me a coffee link opens Ko-fi under its own terms. No payment widget or third-party tracking script is embedded here. A donation does not buy Together access. Support email includes your sender address, message and attachments you choose; avoid unnecessary financial or sensitive information.

11 Choices, support and rights

You can use Personal without account services, control optional camera/notification access, use App Lock, and export records when needed. Face ID verification is handled by Apple; Jarivo does not receive a face template. An invitation can supply your email from another person; it is used for that invitation, access and related security. Contact us if you want to decline or remove it.

For processing subject to the GDPR, necessary account authentication, synchronization, sharing/invitations, support replies and purchase verification are used to perform the services you request or take steps at your request (Article 6(1)(b)). Security logs, session protection, fraud and purchase-reassignment prevention, and fault diagnosis rely on our legitimate interests in protecting users and operating a reliable service (Article 6(1)(f)), subject to your rights and interests; you can object. Records required by applicable law are processed to meet that obligation (Article 6(1)(c)).

Where we ask for consent for a specific optional processing activity, that activity relies on Article 6(1)(a). You can withdraw that consent through its setting or by contacting us, without affecting earlier lawful processing. An iOS device permission is a device control, not blanket consent for every financial or account record. Personal remains available without connected account details; without data necessary for a chosen connected feature, we cannot provide that feature.

To request access and a copy, correction, erasure, portability, restriction or objection, email hypcheckss26@gmail.com and describe the relevant account, conversation or data and your request. We may ask for proportionate identity verification; do not send passwords or unnecessary financial documents. GDPR requests receive a response without undue delay, normally within one month; complex or numerous requests may need up to two additional months, with notice within the first month. The separate verified account-deletion commitment remains 30 calendar days, subject to explained lawful retention.

You may complain to Italy’s Garante per la protezione dei dati personali or another competent supervisory authority, including where you normally live or work or where the alleged infringement occurred. Family is a household plan, not a child-directed service; applicable account-consent ages still apply. Contact us about an underage account.

12 Updates

Material privacy changes will be described with an updated effective date and appropriate notice. A policy update does not itself authorize unrelated processing or charges. Contact Muhammad Huzaifa Malik at hypcheckss26@gmail.com.