Privacy

Last changed 14 October 2026

Your spending stays on your phone. Nobody else can read it, us included.

There's no sign-up and no account. We don't know your name, email or phone number.

What Munim keeps, and where

Your entries, categories, budgets, accounts and people On your phone. This is the only copy anyone can read.

A locked backup In our vault, on Cloudflare. Your phone locks it before it leaves, with a key only you have. We can't open it, Cloudflare can't, and neither could anyone who broke in.

Your key On your phone, and in the 12-word recovery code the app shows you. It's also kept in your iCloud Keychain, so a new iPhone can restore by itself. It's never sent to us.

Things that stay on your phone

Widgets. The app leaves a small summary for them on your phone: this month's totals, the next few repeats and your category names. Never an entry.
Siri and Shortcuts. What you tell Siri is handed to the app on your phone. Apple handles the listening, as it does for any app.
Spotlight. The names of shops and people you've paid can be searched on your phone, with no amounts, since search works from a locked phone too.
Reminders. Set on your phone. There's no server sending them.
Face ID. Handled by iOS. The app only learns yes or no.

Splitting with friends

A group is a shared, locked log in the vault. Its key travels inside the invite link, after the #, which never reaches any server. Only people with the link can read the group, and we can't. Anyone you send the link to can join, so share it only with the group.

App updates

When it opens, the app asks Expo, the service that delivers its updates, whether there's a newer version. That request carries the app and iOS versions and a random number made on install, which Expo uses to count how many phones it updated. Nothing you've logged is part of it.

What we never get

Anything you've logged, in a form we can read
Your name, email, phone number or contacts
Analytics, ads or trackers. Munim has none

We have nothing to sell and nobody to share it with.

The vault

The vault stores locked bytes under a random ID, plus a fingerprint of the key that wrote them, so only your phone can change them. Like any website, it sees your internet address when your phone backs up. It uses that for a minute to stop floods of requests, and keeps no logs.

Reading bank emails

This isn't in the app yet. When it arrives and you switch on automatic tracking, Munim connects to your Gmail on your phone and reads only alert emails from banks and card companies. It reads them on the phone. Nothing from your mail is sent to us or anyone else, and you can disconnect at any time.

Munim's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting it

Delete the app and everything on your phone goes with it. To delete the locked backup too, open Settings, then Backup, and choose Delete backup, before you delete the app. If the app is already gone, install it, restore with your 12 words, then delete the backup.

If this changes

This page changes first, and the date at the top moves.

Support

Something not working, or a question? Write to us.

design@haxsh.in

Please don't send screenshots of your spending. We'd rather not see it.

I got a new phone

Install Munim, open Settings, then Backup, and choose to restore from your recovery code. Type the 12 words and everything comes back.

I lost my recovery code

If you still have your phone, Settings, then Backup, shows it again. Write it down somewhere safe.

I lost my phone and the code

Then nobody can bring your entries back, us included. That's the price of nobody else being able to read them, and it's why the app asks you to keep the code.

The widget looks out of date

Widgets refresh when you open the app or add an entry. iOS decides the rest, so open Munim once and it catches up.

A bank isn't showing up

Munim can only read alerts your bank emails. Many banks email alerts only once you switch them on. The app shows how for each bank.