Privacy Policy
Effective date: 30 September 2026
DirhamTracker helps you see where your money went by reading your UAE bank and card statements. Your financial data is personal, so here is the short version of how we treat it:
- Your statement files never leave your device. They are read inside your browser. We never receive or store the PDF or CSV itself.
- We never store statement passwords. They are used once, in your browser, to open the file, then discarded.
- Only you can see your transactions. Our database enforces this for every request, not just the app screens.
- No ads, no analytics, no data selling. We don't use tracking tools, advertising networks or AI services on your data.
- You stay in control. You can export your data or delete your account, and everything in it, at any time.
What we collect
We keep only what the app needs to work.
| What | Examples | Why |
|---|---|---|
| Account details | Email address, your name, how you sign in (email and password, or Google), and when you signed up and last signed in | To create your account and let you sign in |
| Transactions | Date, description, amount and currency of each transaction read from your statements | To show your spending, categories and trends |
| Card and account details | Bank name, the last 4 digits of the card, the nickname you give a card, from each statement its date, payment due date and amount due, and the date you mark it as paid | To group transactions by card and account, show what's due when, and whether you paid on time |
| Statement file names | The name of each file you upload, e.g. "ENBD_Sept.pdf" | So you can see and delete each upload separately |
| Your settings | Categories, their keywords and budgets, merchant names you rename or merge, the category you choose for a merchant, which transactions you moved to a category yourself, and which in-app tips you've already seen | To sort and name transactions the way you want, and not repeat tips |
| Usage counts | How many transactions and statements you add each day | To apply fair-use limits, so the service keeps working for everyone |
If you sign in with Google, we receive your name and email address from Google. We don't get access to your Google account or any other Google data.
File names are stored exactly as they are on your device. If your bank puts an account number or your name in the file name, you can rename the file before uploading.
What we don't collect: the statement files themselves, statement passwords, full card or account numbers, your date of birth, your phone number, your location, or anything from your device beyond what you upload.
Your password for DirhamTracker is handled by our sign-in provider and stored only in a scrambled (hashed) form. We can't see it.
How your statements are handled
Your statement is read on your own device, and only the resulting list of transactions is saved.
- You choose a PDF or CSV statement in the app.
- Your browser opens the file and reads the transactions from it. If the PDF is password-protected, the password you type is used only for this step.
- The app shows you the transactions and sorts them into your categories.
- The transactions, the file name and the card details are saved to your account. The file itself and the password are not.
When you close the page, the file and password are gone from memory. We never see them, and they never pass through our servers.
Where your data is stored and who can see it
Your data is stored in a secure cloud database hosted by Amazon Web Services in Dublin, Ireland. This means your data is stored outside the UAE, in a country covered by the EU's data protection law (GDPR). It travels only over encrypted connections (HTTPS).
You: you can see and change your own data at any time.
Other users: can't see your data. Every request to the database is checked against your signed-in account, so each person can only ever read or change their own records.
Us: as the operator of DirhamTracker, we have technical access to the database in order to run and maintain the service. We don't look at individual users' transactions except when you ask us to help with a problem, or when we're required to by law. To spot and stop misuse, we can see the list of accounts: each email address, how it signs in, and when it signed up and last signed in.
We also protect the site with standard browser security settings that block code from unknown sources and stop other websites from embedding DirhamTracker.
Services we rely on
We use a small number of service providers to run DirhamTracker. We don't sell your data or share it with anyone else.
| Provider | What they do | What they receive |
|---|---|---|
| Lovable Cloud (built on Supabase) | Hosts the app, the database and sign-in, and sends account emails (such as confirming your email or resetting your password) from notify.dirhamtracker.com | Your account details and the data you save; for account emails, your email address and the link in the email |
| Cloudflare | Delivers the website securely and protects it from attacks | Technical request data such as your IP address |
| Google (sign-in) | Lets you sign in with your Google account, if you choose to | Your sign-in request; Google shares your name and email with us |
Cookies and browser storage: we keep you signed in by storing a login token in your browser. The app also remembers a few small choices on your device, such as which tips you've seen and whether you closed the "Install on your phone" hint. Our hosting and security providers also set a few strictly necessary cookies (for example, to block malicious traffic). We don't use advertising or tracking cookies.
No AI services: your statements and transactions are not sent to any AI or machine-learning service.
How long we keep data, and your choices
We keep your data for as long as you have an account. You can remove it at any time:
- Delete a single upload: removes that statement's transactions.
- Clear all data: removes all your transactions, uploads and cards, but keeps your account.
- Delete your account: permanently removes your account and everything linked to it. This can't be undone.
- Export your data: download your transactions as a CSV file whenever you like.
If we block an email address for misusing the service, we keep that address on a block list, even after its account is deleted, so it can't simply sign up again. Nothing else from the account is kept.
Under the UAE's Personal Data Protection Law, you can also ask us to access, correct or delete your personal data, or ask questions about how it's used. Email us at support@dirhamtracker.com and we'll respond within 30 days.
Beta, changes and contact
DirhamTracker is in an open beta. Features may change, and while we work hard to parse statements correctly, please check important figures against your bank statement.
Changes to this policy: if we change how we handle your data, we'll update this page and the effective date. For significant changes, such as adding a new service that receives your data, we'll tell you by email or in the app before the change takes effect.
Who we are: DirhamTracker is operated by Rahul Churiwal, an individual based in Dubai, United Arab Emirates.
Contact: for any privacy question or request, email support@dirhamtracker.com.