Privacy Policy

1. Who we are

Rattib is developed and run by an independent developer based in Saudi Arabia, who is responsible for your data under this policy. Contact: support@alialnujaidi.com. for review (full controller details)

2. What we collect

• Account: your mobile number (to sign in with a one-time code), your language and your settings, such as the budget month start day and notification preferences.
• Reminders: title, notes, times, repeat rules and whether they’re done.
• Medicine (health data): medicine names, doses and their schedules, the log of taken or missed doses, and refill details if you add them.
• Documents: the document type, the name you give it and its expiry date only. We never store document numbers or photos.
• Financial data: the expenses, bills, subscriptions, budgets and categories you add. We don’t connect to your bank and never see your card.
• Receipt images you attach to expenses; uploaded to private, non-public storage.
• Device and security data: your push token, platform and app version, and the IP address and a device identifier in sign-in records, to prevent abuse. for review (security log retention)
• Subscription: your Premium status from the App Store via RevenueCat, and how many smart-add actions you used this month (the count only, not the content).

We don’t collect your location or your phone’s contacts. No ads, no tracking, and no third-party analytics or tracking SDKs — in the app or on this website.

3. How we use it

Only to run Rattib for you: signing in, syncing and backing up between your phone and our servers, reminders and notifications, free-plan limits and Premium, and answering support messages. We don’t sell your data, use it for advertising, or share it except with the service providers in section 5, as far as needed.

The monthly insights in the app are calculated on your phone from your own data, not by AI.

4. Where your data is stored and how we protect it

• On your phone: a local database is the main copy of your data, so the app works offline. Sign-in keys are kept in the phone’s secure storage.
• On our servers: your data is synced to our servers on Cloudflare: the database (Cloudflare D1) and receipt images (Cloudflare R2, private storage per user) in the European region — that is, outside Saudi Arabia. for review (cross-border transfer)
• Data is encrypted in transit and at rest. Receipt images open only through short-lived links after your account is checked.
• We never store your sign-in code itself, only a hash; it expires after 5 minutes and attempts are limited.
• We back up the database every night to private storage; each backup is deleted automatically after 30 days.

5. Service providers

• Cloudflare: hosting for the server, database, files, backups and this website.
• Authentica (Saudi Arabia): sends your sign-in code by SMS; receives your mobile number and the code.
• Anthropic (Premium only, when you use smart add): we send the text you type, a receipt image, or the bank SMS text you paste, together with today’s date, your language and your category names, and get back a draft for you to review. Rattib doesn’t keep this content after processing and doesn’t log it, and nothing is saved until you confirm the draft. Anthropic processes it under its commercial API terms, which don’t allow it to be used to train models. for review (Anthropic retention period)
• Apple App Store and RevenueCat: buying and managing Premium. RevenueCat receives an internal account id (not your mobile number) and your purchase history; Apple handles payment.
• Apple Push Notification service and Expo: deliver notifications to your phone using your push token. Notifications never carry medicine names or amounts.

These providers must protect your data and can’t use it for their own purposes. We may disclose data if a competent authority requires it under applicable law.

6. Health and financial data

Medicine names and schedules are health data; expenses and bills are financial data. We handle them with extra care: medicine names and amounts never appear in lock-screen notifications, and we don’t share them for anything other than running the app. Rattib is not a medical device and doesn’t give medical advice. for review

7. Permissions

• Notifications: for reminders, doses and due dates; you can turn them off in your phone’s settings.
• Camera and photos: to attach a receipt photo, only when you choose to.
• Files and sharing: to save and share your export file.

8. How long we keep it

• We keep your data while your account exists. If Premium ends, nothing is deleted.
• When you delete your account, your data and receipt images are deleted from our servers immediately and from your phone, and wiped from backups automatically within 30 days.
• Purchase records held by Apple and RevenueCat follow their own policies. for review

9. Your rights and controls

• Access and correct: all your data is visible in the app, where you can edit or delete it.
• Export: Settings → Export my data (CSV) builds a ZIP file on your phone with one CSV file per data type (receipt images excluded) for you to share or save.
• Delete account: Settings → Delete account, confirmed with a code sent to your phone. Details on the support page.
• Notifications: you can turn them off at any time.
• For anything else, email support@alialnujaidi.com and we’ll reply within 30 days.

10. Age

Rattib is meant for people aged 18 and over. We don’t knowingly collect children’s data; if you learn of any, email us and we’ll delete it. for review

11. Changes to this policy

If we change anything important, we’ll tell you in the app before it takes effect, and publish the new version here with its version number and date.

12. Contact us

For any question about your privacy: support@alialnujaidi.com