Security

Your money data, handled carefully. Read-only bank access, encrypted connections, stored in the European Union, and always yours to export or erase.

Bank connections are read-only

When you connect a bank, it goes through PSD2 open banking, the EU's regulated standard for letting an app read your account. We connect through Enable Banking Oy, a licensed account-information provider (AISP) in the EU. You approve the connection inside your own bank's app.

• Read-only, always. It can see balances and transactions. It can never move money. That is how PSD2 access works by law, and there is no payment code in the app.
• Your login stays with your bank. You sign in on your bank's own page. We never see or store your bank credentials.
• You stay in control. The permission expires on its own every few months, and you can disconnect any time.

Encrypted in transit

Your connection to Madeyyat uses TLS (HTTPS), the same encryption standard your bank's own website uses. Data travels encrypted between your device and the app.

Where your data lives

• In the EU. Your data is stored in a Postgres database in Frankfurt, Germany.
• Isolated per person. One user's data is structurally inaccessible to another.
• Stored exactly. Amounts are kept as integer cents, never rounded.

AI is optional and read-only

The built-in assistant only answers questions about your own data. To do that, the figures involved are sent to Anthropic's API to be processed, and they are not used to train Anthropic's models. The assistant can read your numbers, never change them. With no AI key configured, the app runs with every AI feature off.

How you sign in

You sign in with Google, so there is usually no app password at all. If you choose to set an optional password in Settings, we store only a scrambled version of it (a bcrypt hash), never the password itself. Your Google password never touches the app either way.

You are in control

• Export everything. Settings offers exports for setup, transactions, and recorded financial-health history.
• Erase everything. You can wipe your financial data from the app whenever you want.
• Disconnect a bank. Removing a connection stops its sync immediately.

What we never do

• Never see or store your bank login.
• Never move money. The connection is read-only.
• Never sell or share your data. No ads, no trackers.
• Never train AI models on your data.

This page is the plain-language overview. For the full detail, read our Privacy Policy and Terms. Questions? Email ahmedmkhashaba@gmail.com.