Privacy Policy

This policy explains what information yabidi collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It covers the yabidi app for iPhone and this website, yabidi.com.

The short version

• We collect what we need to run yabidi: your name and email address, the financial records you enter, and your conversations with the assistant.
• Your data is stored in your yabidi account on our servers. The app keeps only your sign-in on your phone.
• We don’t ask for full card numbers, bank account numbers or bank passwords.
• The assistant is powered by Anthropic. When you chat, your message and a summary of your yabidi data are sent to Anthropic to write the reply.
• You can attach a photo or PDF of a receipt or statement to a message. It’s read on your phone, and sensitive details such as card numbers are masked before anything is sent. The photo or file never leaves your phone, and we delete the masked text from our servers within 24 hours.
• We don’t sell your data and don’t use it for advertising.
• You can export your transactions and delete your account in the app at any time.

Who we are

yabidi is developed and operated by Mehmet Turşucu, an independent developer; there is no company behind it (“yabidi”, “we”, “us”). We decide how and why your personal data is used, which makes us the data controller under the GDPR and UK GDPR, the “veri sorumlusu” under Turkey’s KVKK, and the individual accountable for your personal information under Canadian law.

You can reach us about anything in this policy at privacy@yabidi.com, or write to Mehmet directly at mehmet.tursucu@yabidi.com.

Information we collect

Information you give us

• Account details. Your name and email address. If you sign in with Apple, Apple shares your name the first time and either your email address or a private relay address if you choose Hide My Email. If you sign in with Google, Google shares your name and email address. If you sign in with email, we use the address you enter.
• Financial records you enter. Accounts (name, type, institution, balance, currency and, if you choose, the last four digits of a card), card limits, interest rates and payment details for debts, transactions (amount, date, title, category and notes), budgets, savings goals, debt payoff settings and recurring payments.
• Profile and settings. Your preferred currency, language, time zone, notification preferences and, if you add one, a profile photo.
• Conversations with the assistant. Your messages, the assistant’s replies, the changes you confirm or cancel, and any reply you report.
• Documents you attach. The text of a receipt, statement or other document you add to a message, after sensitive details are masked on your phone. We never receive the photo or file itself. See Receipts, statements and other documents.
• Assistant memory. Up to 15 short facts drawn from your messages, such as “saving for a summer trip”. Memory is designed to leave out amounts, health, religion, politics and other people’s names. You can see and delete these facts in the app.
• Messages to support. Whatever you include when you email us.

Information created when you use yabidi

• Identifiers and sessions. A user ID, the ID your sign-in provider gives us, and a record of each sign-in session, including the app and device type your phone reports. We store sign-in refresh tokens and email sign-in codes only in hashed form.
• Device information for notifications. Your device’s push token, platform and language setting.
• Technical data. IP address, time, requested address and app or browser details, recorded in our server logs and used for security and to limit abuse.
• Usage counts. For example, how many assistant messages you’ve sent this month, so we can apply plan limits.
• Reminders we create for you. Payment, budget and weekly summary notifications, and a record of which ones we’ve already sent.

Information we don’t collect

• Full card numbers, CVV codes, card expiry dates, full bank account numbers (such as IBANs) or national ID numbers. We don’t ask for them. If a document you attach contains card numbers, IBANs or Turkish, US or Canadian national ID numbers, they’re masked on your phone before anything is sent.
• Photos and files you attach. They’re read on your phone and never sent to us; only the masked text is.
• Voice recordings. When you talk to the assistant, your speech is turned into text on your phone, and only the text is sent, like a typed message.
• Bank passwords. yabidi doesn’t connect to banks today.
• Face ID data. If you lock yabidi with Face ID, iOS handles it on your device; we never receive it.
• Your contacts, location or advertising identifier. We don’t track you across other companies’ apps or websites, and we don’t use third-party analytics or advertising tools in the app or on this website.

How we use your information

We use your information only to run yabidi:

We don’t use your data to train AI models, and we don’t make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

The assistant and AI

The Assistant tab is powered by Claude, an AI model made by Anthropic, PBC. The app tells you it’s AI and asks for your agreement before your first conversation.

• What’s sent to Anthropic. When you send a message, we send Anthropic your message, the recent conversation, your assistant memory and a summary of your yabidi data that the reply may need: totals, budgets, goals, debts, upcoming and recurring payments, accounts and your recent spending by category and merchant. If you attach a document, we also send its masked text. To update memory, we send Anthropic the messages you wrote.
• How Anthropic uses it. Anthropic processes this data on our behalf to write the reply, under a data processing agreement.
• What stays in yabidi. We store your conversations and memory on our servers so you can see them later, except the text of documents you attach, which we delete within 24 hours. You can delete your chat history and memory in the app at any time.
• Limits. The assistant only discusses money topics. It can make mistakes, so check anything important. It doesn’t give financial, investment, tax or legal advice, and it never saves a change without your confirmation. Figures in your plans come from yabidi’s own calculations, not from the AI model.

Receipts, statements and other documents

In the assistant, you can add a receipt, statement or other document to a message from the + menu: take a photo with the document scanner, choose a photo, or choose a file (a PDF or an image).

• Read on your phone. yabidi reads the text on your iPhone: with Apple’s text recognition for photos and scanned pages, and from the PDF’s own text where it has one. It doesn’t read a photo’s location or other details stored with it.
• Masked before it’s sent. Before the text leaves your phone, yabidi masks card numbers (it keeps the last four digits, so the assistant can match the card to your accounts), IBANs (it keeps the country code and the last four characters), national ID numbers (Turkish ID numbers, US Social Security numbers and Canadian Social Insurance numbers), email addresses, and your full name as it appears in your yabidi profile. As a safety net, our server also masks any card number the phone missed. The rest of the text, such as merchant names, amounts, dates, addresses and other account or reference numbers, is sent as it appears, so attach only documents you’re comfortable sharing.
• The photo or file stays on your phone. yabidi doesn’t upload or keep the photo or file, and doesn’t save scans to your photo library. Only the masked text is sent to our servers and to Anthropic, in the same way as a chat message, and Anthropic processes it under the same terms as your other messages.
• Nothing is saved without you. The assistant suggests the transactions it finds, and nothing is added to your records until you confirm them.
• How long we keep it. The masked text of a document is deleted from our servers within 24 hours of when you send it; nightly backups may keep it for up to 30 days. The assistant’s replies and the transactions it suggests from the document, such as merchant names, amounts and dates, stay in your chat history like any other message, until you delete your history or your account. Transactions you confirm are saved to your records. The assistant’s memory doesn’t learn from your documents.
• Permissions. Taking a photo needs access to your camera; iOS asks you the first time, and you can change this later in the iPhone Settings app. When you choose a photo or a file, iOS gives yabidi only the one you pick, not your photo library or your other files.
• Limits. A document can have up to 10 pages and 30,000 characters of text.

Who we share information with

We don’t sell your personal information or share it for advertising. We share it only with service providers that help us run yabidi and that may use it only to provide their services to us:

When you sign in with Apple or Google, or buy a subscription through the App Store, Apple and Google also process your data under their own privacy policies.

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

International transfers

We and our service providers may process your information in countries other than the one you live in, including the United States. Where the law requires, we protect these transfers with safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and for Turkey, standard contracts notified to the Personal Data Protection Authority.

How long we keep information

When you delete your account, we delete your data from our live systems right away. Copies in backups are deleted automatically within 30 days. We keep information longer only if the law requires it.

Security

We protect your information with measures that include encrypted connections (HTTPS), access controls, a firewall, separate database credentials, and storing sign-in codes and refresh tokens only in hashed form. No system is perfectly secure, but we work to protect your data, and we’ll tell you and the authorities about a breach when the law requires it.

Your choices in the app

• Edit or delete any record.
• Export your transactions as a CSV file: Profile › Data › Export my data.
• Review and delete what the assistant remembers, and delete your chat history.
• Turn reminders and notifications on or off.
• Delete your account and all of its data: Profile › Data › Delete my account and data. See how to delete your account.

For anything else, email privacy@yabidi.com. We may need to confirm your identity before acting on a request. We reply within 30 days and don’t charge for requests, unless they’re clearly excessive.

Your rights

Europe, the UK and Switzerland

Under the GDPR, the UK GDPR and Swiss law, you can ask to access your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. You can also complain to your local data protection authority.

United States

If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, use and disclose, and to access, correct and delete it. You also have the right not to be discriminated against for using these rights. Residents of other states with privacy laws, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, have similar rights. If we decline your request, you can appeal by replying to our decision; if we deny your appeal, you can contact your state attorney general.

In the last 12 months we collected these categories of personal information: identifiers (such as name, email address, user ID and IP address), financial information you entered or attached, commercial information (such as subscription status), internet activity (server logs) and inferences (the short facts the assistant remembers). We collect them from you, your device and your sign-in provider, and use them for the purposes described above. We disclose them only to the service providers listed above.

We don’t sell or share personal information for cross-context behavioral advertising, and we don’t use sensitive personal information to infer characteristics about you. We honor Global Privacy Control signals. You can make a request yourself or through an authorized agent.

Canada

Under PIPEDA and provincial laws, including Quebec’s Law 25, you can ask to access and correct your personal information, withdraw your consent, and, in Quebec, receive your information in a structured, commonly used technological format. Your information may be stored and processed outside your province and outside Canada. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Turkey

Under the Personal Data Protection Law No. 6698 (KVKK), the data controller (veri sorumlusu) is yabidi, as described in Who we are. We collect your personal data from you, your device and your sign-in provider, through the app, this website and email. The purposes and legal grounds for processing it are in How we use your information, the recipients in Who we share information with, and transfers abroad in International transfers.

Under Article 11 of the KVKK, you can ask whether we process your personal data and for information about it; learn the purpose of processing and whether it’s used for that purpose; know the third parties in Turkey or abroad it’s transferred to; ask for incomplete or incorrect data to be corrected, and for data to be deleted or destroyed, and for those third parties to be told; object to a result against you that arises from analysis done only by automated systems; and claim compensation for damage caused by unlawful processing. Send your request to privacy@yabidi.com; we reply within 30 days, free of charge. You can also complain to the Personal Data Protection Authority (KVKK).

Children

yabidi isn’t meant for anyone under 18, and you must be 18 or older to create an account. We don’t knowingly collect personal information from children. If you think a child has given us personal information, email privacy@yabidi.com and we’ll delete it.

This website

yabidi.com doesn’t use cookies, analytics or tracking, and it doesn’t ask you for personal information. Our website host processes technical data, such as your IP address, to deliver the site and protect it from abuse.

Changes to this policy

We’ll post any changes here and update the date at the top. If a change is significant, we’ll tell you in the app or by email before it takes effect.

Contact

Email privacy@yabidi.com for privacy questions and requests, or support@yabidi.com for help with the app.