Privacy Policy

• Your account — your email address and password (stored only as a secure hash by our sign-in provider) or, if you use Continue with Google, the name, email address and profile picture Google shares with us.
• What you enter — transactions, moods and their tags, notes, journal entries, habits, budgets, goals, bills, wallets, transfers, dhar records, challenges and your to-do and to-buy boards. Recurring incomes and expenses are kept with the time zone they were set up in, so our server can add each one to your ledger at its time.
• Your settings — language, currency, which notifications you get, dashboard sections and the figures you enter in the zakat calculator, kept with your account so the website and the app match.
• AI summaries — summaries you ask for are saved to your account, so they show again without being rewritten.
• Browser reminders — if you turn on notifications in a browser, we keep that browser's push address, its keys and its time zone, only to send your reminders and alerts.
• Daily limits — a count of how many photos and summaries your account used each day (no content), so the free AI features can't be overused.

We use all of this only to run Catalyst for you. We don't show ads, sell or rent your data, or use tracking or analytics tools. Every record is locked to your account in the database, so no other user can see it.

When you scan a memo, a receipt, a screenshot of your notes or a list, the photo is sent from our server to Google's Gemini AI, which reads it. We don't keep the photo — you check what was found, and only the entries you add are saved.

When you ask for an AI summary or recap, a digest of your entries for that period — amounts, categories, moods and the text of the notes, journal entries and tickets in it — is sent to Gemini to write the summary. Google processes this data under the Gemini API terms.

• A copy of your data is kept on the phone so the app works offline. It's removed when you sign out.
• Reminders are scheduled on the phone itself.
• bKash / Nagad messages — when you share a message to the app (or paste one in Settings), it's read on the phone to suggest an entry. The app has no permission to read your SMS; messages are never uploaded, and only the entries you choose to add are saved.
• To tell you about updates, the app asks GitHub for the latest version, so GitHub sees that request.

The website uses a sign-in cookie to keep you logged in, and stores a few preferences in your browser (theme, language, currency, reminder settings and Vault Mode). There are no advertising or tracking cookies.

• Supabase — the database, sign-in, and account emails.
• Vercel — hosts the website and keeps short-lived request logs, such as IP addresses.
• Google — Gemini AI for photos and summaries, and Google sign-in if you use it.
• GitHub — Android app downloads and update checks.

• Change or delete any entry at any time.
• Delete your account in Settings → Delete account (on the website or in the app). It removes your account and everything in it, permanently.
• Turn reminders and browser notifications on or off in Settings.

Catalyst isn't meant for children under 13.

If this policy changes, we'll update this page and the date at the top.

Questions or requests: open an issue at github.com/HAVIC-47/catalyst/issues.