Effective 1 November 2026
Privacy Policy
This policy covers the ihab budgeting app, the ihab.fyi website, and the beta-interest form. It explains how we access, use, store, share, and protect your information, including data received from Google.
Information We Handle
Account information includes your email address, account identifier, sign-in provider, and information needed to authenticate and maintain your session. Google Sign-In can also provide your Google account identifier, name, email address, and profile picture.
Budget information includes account names and balances, transactions, payees, categories, notes, schedules, currencies, and other information you enter or import. Uploaded or connected documents may contain names, account details, transaction dates, amounts, counterparties, references, balances, and other personal or financial information. Extracted records, source-file metadata, correction history, and review images can become saved evidence.
We also handle support messages, troubleshooting information, trial and plan records, and referral or signup information. Hosting, authentication, email, and security providers may process IP addresses, browser or device details, request times, delivery information, and operational or security logs. We do not request your bank login credentials or connect directly to your bank.
How We Use Information
We use information to authenticate accounts, provide budgeting and reconciliation, sync devices, import and export records, extract document information, match transactions, retain evidence you can review, provide support, deliver requested messages, prevent misuse, and operate the service. Optional Drive automation checks connected account folders and processes documents in the background.
We do not sell personal, budget, or Google user data. We do not use Google user data for advertising, data-broker services, creditworthiness decisions, or lending. Google access is not consent to marketing messages; beta outreach has its own consent described below.
Where applicable law requires a legal basis, we rely on providing the service you request, consent where required, legitimate interests in operating and securing the service, or legal obligations. Optional permissions can be withdrawn.
App Analytics
When analytics is enabled, we use a dedicated PostHog project to measure app launches and visits to recognized app pages. Events contain a page path and limited event type, with an anonymous identifier held in memory for the current page session. We do not identify your account to PostHog or send email addresses, financial amounts, account names, payees, transaction notes, imported files, query strings, or URL fragments. Sign-in confirmation and callback pages are excluded.
We do not use analytics cookies or persistent analytics storage, session replay, automatic click or form capture, or automatic error, console, or network recording. Analytics respects Do Not Track and Global Privacy Control browser signals. You can also block analytics requests using browser controls. PostHog processes technical network information needed to receive events; IP-based location enrichment is disabled. Analytics is separate from the marketing website’s project and is used to understand and improve app usage.
Website Analytics
When analytics is enabled, we use a separate PostHog project for ihab.fyi to measure page visits, clicks through to the app, and beta-interest submission outcomes (such as success or unavailable). Events contain a recognized page path, these limited action types, an anonymous session identifier, and a coarse referring-service label (such as Google, direct, or other); we do not send your email address, form contents, query strings, URL fragments, or budget information to PostHog. Analytics uses an anonymous identifier held in memory for the current page session, without analytics cookies or persistent browser storage. We do not link website analytics to your app account or record your screen, clicks automatically, or form inputs.
Analytics respects your browser’s Do Not Track and Global Privacy Control signals. You can also block analytics requests using browser controls. PostHog receives technical network information when delivering events; IP-based location enrichment is disabled. Marketing analytics requests pass through e.ihab.fyi, a Cloudflare-backed managed proxy on our domain, before reaching PostHog. Aggregate usage is used to understand and improve the website.
Google Sign-In
Google Sign-In is optional; email sign-in is also available. Supabase, our authentication provider, processes the Google identity information described above to identify you, create or link your ihab account, and maintain your authenticated session.
Google Sign-In alone does not authorize access to Gmail messages, contacts, Google Photos, or Drive files. Connecting Drive for document automation requires separate consent. Choosing a device or cloud-synced folder for a backup is also separate from Google Sign-In.
Optional Google Drive Access
If you connect Drive, ihab requests drive.readonly and drive.file permissions. The read-only permission technically allows reading files across your Drive, not just files selected in a picker. The document workflow uses ihab-managed budget and account folders; that workflow boundary does not narrow the Google permission grant.
ihab reads file and folder metadata, document contents, and change notifications to find and process statements and slips in managed account folders. It creates and manages folders for connected budgets and accounts. Explicit folder and evidence actions can rename, move to trash, or restore managed items. Connection credentials, folder mappings, change cursors, and job records maintain this automation.
Drive data is used for the document extraction, review, matching, and reconciliation features you request. Originals remain in Drive unless you take an action that moves them to trash; disconnecting does not delete those files. Google controls its own Drive storage and trash retention.
Document Processing And AI
ihab sends document text and rendered image regions to Google through the paid Gemini Developer API to read and structure transactions and balances. Requests may include a selected account identifier and document fingerprint. Source images and text are not guaranteed to be redacted and can contain personal and financial details from your documents. This applies to Drive documents and manual uploads.
PDF decryption and rendering take place in our processing service. PDF passwords and Google connection tokens are not sent to the AI model. A single-upload password is not automatically saved; an account PDF password is stored only when you explicitly save it for future processing.
ihab does not use Google Workspace API data to develop, improve, or train non-personalized or generalized AI or machine-learning models. We use existing models for document-processing features. Under Google’s paid Gemini terms, submitted content is not used for general product improvement. This is not a promise of zero retention or no policy-enforcement model use: Google retains prompts, context, and outputs for 55 days for abuse monitoring, may have authorized personnel review flagged content, and permits use for models specifically involved in policy enforcement. Processing may take place internationally.
Our use and transfer of information received from Google APIs is limited to the disclosed user-facing features and is subject to the Google API Services User Data Policy, including its Limited Use requirements. This policy does not mean Google has verified or approved ihab or every requested permission.
Storage And Security
Your device stores budgets, preferences, and sign-in information in browser storage for offline use. Supabase hosts account and synced budget records, extracted financial information, source metadata, and private review or approval images, which may include rendered document pages. Temporary upload processing does not mean extracted records or saved evidence are temporary.
We use encrypted connections, account authorization, and database access controls to help protect hosted information. Drive refresh tokens and explicitly saved account PDF passwords are encrypted separately on the server. These controls do not make ihab end-to-end encrypted. Authorized operators and infrastructure providers may have technical access needed to operate or secure the service.
Human access to Google user data is limited to purposes permitted by Google’s Limited Use requirements, such as your affirmative consent for specific support, security or abuse investigation, or legal requirements. Google’s separate abuse-monitoring review is described above. We do not make Google data public or provide it to unrelated advertisers or data resellers.
If you grant location permission, transaction entry can save coordinates with a payee unless you dismiss the location chip; saved locations may sync. Device biometric features do not send fingerprint or face images to ihab. You can revoke optional permissions in device settings. No system is completely secure; protect your devices, accounts, and exported backups.
Service Providers And Sharing
Supabase provides authentication, database, private evidence storage, and server-side processing. Vercel hosts the website and web app; Cloudflare provides domain and network services. Resend delivers authentication and other service emails; Google-hosted mailboxes handle manual correspondence. Google provides optional sign-in, Drive access, and paid Gemini processing as described above. PostHog provides the limited app and website analytics described above in separate projects. Each provider receives information needed for its role, rather than every category listed in this policy.
We may disclose information when required by law or as necessary to investigate misuse or security incidents and protect people and their rights. We provide required notice of a business transfer affecting your information. Google API data remains subject to applicable Limited Use restrictions; this does not authorize unrelated sale, advertising, or generalized-model training.
Providers may process information outside your country. This policy does not promise a particular processing country or regional-only AI processing. Where required, international processing is subject to applicable safeguards; contact privacy@ihab.fyi for information relevant to your account.
Retention, Disconnection And Deletion
We keep account, budget, extracted evidence, and source records while needed for the features you use, restoration, security, or legal obligations. Saved review or approved document images remain with associated records; they do not all expire after 24 hours. Unattached temporary images have an expiry and are queued for cleanup. Synced deletions may retain deletion markers; restricted backups and logs may persist through their retention periods.
Disconnect Drive in ihab to stop background jobs and queue connection-token revocation. You can also revoke access in Google Account connections. Neither action automatically deletes your ihab account, existing sessions, imported transactions, evidence, folder mappings, or original Drive files. Saved account PDF passwords remain encrypted until removed or the associated account or budget is permanently deleted.
Use available evidence and data-removal controls or email privacy@ihab.fyi from your account address to request account deletion or removal of associated hosted personal data. We may verify your identity. Explicit evidence removal queues hosted-image cleanup and, where linked, moves Drive evidence to trash; cleanup may need retries. We delete or anonymize data when no longer needed, subject to legal retention and backup or log expiry. Google’s separate AI retention is described above.
Hosted deletion does not automatically erase exports, browser copies, cloud-synced backups, or Drive files and trash you control. Revoking permission does not recall information already processed. Review your own copies and Google settings separately.
Website And Beta Interest
ihab.fyi stores your light or dark theme preference in your browser. The beta-interest form collects your email address, consent to beta invitations and ihab updates, and submission time in a private Supabase database. It does not collect your budget, verify email ownership, create an app account, or guarantee an invitation.
The form uses validation, a hidden spam field, and rate limiting. The collection endpoint uses a hashed network identifier for rate limiting rather than storing your raw IP address in the interest list; infrastructure logs may separately contain technical request data. We use the private list for beta invitations and ihab updates and may export it for that purpose. We do not sell it or make it public.
Withdraw consent, stop messages, or request access, correction, or deletion at privacy@ihab.fyi. We may verify control of the address. Interest records remain until removal is requested or outreach no longer needs them; valid removal requests cover active outreach copies, subject to restricted backup retention. Any email provider used for outreach receives only information needed to deliver those messages. We identify the actual outreach provider in this notice before transferring the list to it.
Your Choices And Policy Updates
You can review and correct budgets, export records, stop optional features, revoke Google access, and ask about access, correction, deletion, restriction, objection, or portability at privacy@ihab.fyi. Rights and exceptions depend on applicable law; you may also have a right to complain to your local data-protection authority. ihab is not designed for children; contact us if a child has provided information without appropriate authorization.
We update this policy when our practices change. The effective date appears above. We provide required notice of material changes and obtain any required consent before accessing or using Google user data for a new purpose. Contact privacy@ihab.fyi for privacy requests, support@ihab.fyi for product help, and security@ihab.fyi for security reports.
Read the Terms Of Service for this website.