1. Scope and who we are
This policy covers the SARFA mobile app (Arabic: صرفة; formerly My Life OS) on iOS and Android, provided by MLYOS, United Arab Emirates. SARFA includes Home, Finance, the SARFA assistant (MLYOS AI), Notes and Settings. Privacy contact: support@mlyos.com.
The MLYOS website, its forms and its cookies are covered separately by the MLYOS website privacy policy at /privacy/mlyos.
2. Information we process
Account information: name, email address, sign-in provider (email and password, Google or Apple), account identifier, verification status and sign-up and sign-in times. On iOS, guest mode creates an anonymous account identifier with our authentication provider, so guest use is not always without a server account.
Finance information you enter or import: income, expenses, transactions, amounts, merchants, dates, categories and classifications, budgets, savings goals, monthly commitments, net figures, reminders, editable dashboard field names and custom finance fields.
Notes and organiser content you write.
Preferences and settings, such as language, display options and import settings.
Imported transaction text: content from payment notifications on Android or from Shortcuts and shared text on iOS, when you turn these features on (see sections 5 and 6).
Assistant questions: what you ask the assistant and, on Android, the finance summary sent with it (see section 7).
Operational account information: last active time, app version, build, platform and counts of assistant use.
Subscription information: purchase, receipt and access status needed to provide paid features.
Support correspondence: messages and any attachments you choose to send us.
3. Why we use information and legal grounds
To provide the app and your account (performance of our service to you).
To run optional features you turn on, such as notification import, Shortcuts import and the online assistant (your choice and, where required, your consent).
To keep accounts secure, prevent misuse and keep the service working, where permitted by applicable law, on the basis of our legitimate interest in a secure, reliable service.
To manage subscriptions and answer support and privacy requests (performance of our service and legal obligations).
To meet legal obligations and handle disputes where required by applicable law.
Where legitimate interest is not an available basis, we rely on another lawful basis under applicable law, such as processing necessary to provide the service you asked for, or your consent.
We do not sell your personal data and, as an MLYOS policy, we do not use your financial information for advertising.
4. Where your data is stored
Finance records, notes and preferences are stored on your device. SARFA does not currently provide cloud sync or automatic server backup of your full finance history.
Before a financial reset, the app may keep a local recovery copy on your device. A reset is not the same as erasure; remove the recovery copy separately if you no longer want it.
Exports you create, and device backups made by your phone's operating system (such as iCloud or Google backups), are controlled by you and your platform provider, not by MLYOS.
Your account, and the operational account information in section 2, are held with our service providers (see section 9).
Some sign-in information may be cached on your device to keep you signed in.
5. Android: payment notification import
This feature is off by default. It works only after you turn on automatic expense detection in SARFA and grant Android notification access.
Android notification access is broad by design. SARFA processes only notifications from the app sources you have allowed, reading the title, text, source app and time.
SARFA filters out sensitive messages such as one-time passwords, verification codes and card security codes.
Matching notifications are parsed, de-duplicated and categorised on your device and saved as local finance records.
SARFA does not request permission to read your SMS inbox, and notification import does not connect SARFA to your bank account.
You can turn the feature off in SARFA or revoke notification access in Android settings. This stops future imports; records already created remain until you delete them.
6. iOS: Shortcuts and shared transaction import
On iOS, transactions can be imported only through Shortcuts, App Intents or text you choose to share with SARFA. SARFA does not have background access to other apps' notifications or messages.
Amount, merchant, date, type, category and source from that text can become local finance records.
To stop importing, turn off or delete the related Shortcuts automation in the Shortcuts app.
7. SARFA assistant and AI processing
iOS: the current finance assistant works on your device and does not send your chats to an online AI service.
Android: the online assistant sends your question, a summary of relevant finance information, your language and platform to an MLYOS service hosted on Google Cloud. Where configured, that service forwards the question and filtered context to Google Gemini to generate an answer; otherwise a rule-based reply is used. Google processes this information under its own terms as a service provider.
How Google handles this information depends on the Gemini service tier configured and Google's applicable terms. Under Google's terms, paid services are not used to improve Google's products but may be logged for safety and abuse prevention; unpaid services may be used to improve Google's products and reviewed by people. We do not promise that no provider stores or learns from this information. See the provider links below.
Optional processing by a third-party AI service requires a separate, clear notice identifying the recipient and data, and your explicit consent. This privacy policy alone is not that consent.
You can manage your finances manually without using the online assistant.
Never enter banking passwords, one-time codes, card security codes or full card numbers into the assistant.
8. Automatic categorisation and your corrections
Automatic detection and categorisation can make mistakes. You can review and correct detected entries. Your corrections are used on your device to improve merchant and category rules within the relevant feature.
9. Service providers, staff access and disclosures
Google Firebase and Google Cloud: account sign-in, account records, operational information and the Android online assistant service.
Google Gemini: answers for the Android online assistant, where configured.
Apple and Google: sign-in, app distribution and purchases, depending on your platform and choices.
Email provider: support correspondence.
Authorised MLYOS staff can see account information needed for account operations, support and security, such as email, name, account identifier, verification, sign-up and sign-in times, subscription or role status and operational counts. Our operational reporting is designed to exclude finance records, assistant questions, amounts and merchant details.
We may disclose information where required by law, to protect users or our service, or as part of a business transfer subject to this policy.
10. Subscriptions and payments
Purchases are processed by the app store or payment provider that applies to your purchase. They handle checkout and card details; SARFA does not receive your full card number. We receive transaction, receipt and access status needed to manage your subscription. Cancelling a subscription is done in your store account and is separate from deleting the app or your account. You can request account deletion at any time, including while a subscription is active.
11. International transfers
Our service providers may process account, support and assistant information outside the United Arab Emirates, including in Google Cloud regions in Europe. Where personal data is transferred, we rely on the safeguards available under applicable law and our providers' terms.
12. Retention
Finance records, notes and preferences on your device remain until you delete them, clear the app or delete your account. Local recovery copies and exports may need to be removed separately.
Account information is kept while your account is active and as needed to operate it.
Support correspondence is kept as needed to handle your requests and any disputes.
Limited operational, security and legally required records may be kept with restricted use where necessary.
When you make a request, we will acknowledge it, tell you the expected timing and explain any category we must keep and why.
13. Deleting your account
iOS: Settings > Privacy & Data > Delete Account.
Android: use the account deletion option in the app's privacy settings.
Choosing Delete Account starts the deletion process. The app attempts to remove your account with our authentication provider and to clear SARFA data on that device.
If asked to sign in again, complete that step so deletion can continue.
Contact support@mlyos.com if deletion shows an error or does not finish, to get confirmation, or to request removal of related data held by our service providers. Deletion is not guaranteed to remove every copy automatically.
You can also request deletion by email at support@mlyos.com with the subject "SARFA account deletion". See the SARFA account deletion page for steps.
Deletion does not remove exports you made or your platform's device backups, and does not cancel subscriptions.
14. Your rights and choices
Depending on applicable law, including UAE data protection rules, you may ask to access, copy, correct or delete your personal data, restrict or object to certain processing, and withdraw consent where processing relies on it.
Withdrawing consent applies going forward. If you refuse an optional permission, the related feature stops working; manual entry remains available.
Send requests to support@mlyos.com. We may take reasonable steps to verify your identity. Never send passwords or one-time codes.
If you are not satisfied with our response, you may complain to the competent data protection authority.
15. Security
We use access controls, platform authentication and secure network connections to protect information. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. Protect your device with a passcode and keep your sign-in details private.
16. Children
SARFA is not intended for people under 18. If you believe a child has provided personal data, contact support@mlyos.com and we will take appropriate steps.
17. Changes to this policy
We will update this page and its date when this policy changes, and give notice in the app or by email for material changes. We will not treat continued use as consent to use your data for a new, unrelated purpose.
18. Contact
MLYOS, provider of SARFA (صرفة, formerly My Life OS), United Arab Emirates — support@mlyos.com