JiaFi Privacy Policy

1. Introduction

JiaFi is provided by the developer named on its App Store listing (“we”, “us”). You can reach us at support@jiafi.app.

JiaFi (家Fi) is a balance-sheet and financial-health tool built for families. We know that amounts and assets are the most sensitive personal information there is, which is why the whole product is designed around one idea: touch as little of your data as possible, and leave you in complete control of it.

2. What data we collect

2.1 Account information

• When you choose to sign in with Google or Apple, we collect your email address and user identifier, plus the name your Google or Apple account provides, which we use only to suggest the display name family members see. You can change that display name at any time.
• Signing in does not by itself move your ledger to our servers — whether it is synced depends on your plan (see §4.1).

2.2 Family financial data

• The account names, monthly balances, share counts and prices, loan terms, recurring expenses and financial goals that you enter yourself.
• We do not track day-to-day spending: we do not record individual receipts, and we do not connect to your bank or credit-card statements. There is simply no record of your daily spending for anyone to leak.

2.3 Sharing and on-device preferences

• The nicknames and shared-access roles of the members of a family ledger.
• Ledger restore points (so that you can roll back an accidental deletion, or go back to an earlier state when you need to).
• On-device preferences (language, currency unit, appearance theme and privacy mode). These stay on the device you set them on and are not uploaded.

2.4 Anonymous usage statistics

With your permission, we collect a very small amount of usage data that cannot identify you, so that we can see where people get stuck and when the app crashes. It contains no amounts, no text you have typed, and no identifier for you, your account or your device. Nothing is collected until you agree, and you can switch it off at any time. The full list — what is and is not collected, where it is kept and for how long, and what happens when you switch it off — is in Appendix A.

3. How we use this information

We use the information we collect only to:

• calculate your family's net worth, asset allocation and key financial indicators
• provide cross-device cloud sync and shared viewing for family members
• authenticate your account and keep each household's data isolated from every other
• understand how the product is used, so that we can improve its features and flows (see §2.4 — no amounts are involved)

We never sell your personal data, never use it for ad targeting, and never hand your financial data to any outside third party for AI model training.

4. Data storage and security

4.1 Where your data is stored

• On your device: whenever your ledger is not on a paid plan (signed out, or signed in on the free plan), your data is stored only on your own device and our servers store no financial figure from it (the mobile app encrypts it with SQLCipher database encryption).
• Cloud sync: once you are signed in and the ledger is on a paid plan (yours, or the household owner's if you were invited), we use a cloud database hosted on Supabase, located in Tokyo, Japan (AWS ap-northeast-1). When a paid plan starts, the ledger already on your device is uploaded to it automatically.

4.2 Security measures

We use industry-standard measures to protect your data:

• Encrypted in transit: every connection is protected by standard TLS/SSL encryption.
• Strict permission isolation: row-level security (RLS) in the database ensures that only you and the family members you have authorised can reach your data.
• Least-privilege internal access: our engineering and operations environment runs on least privilege with strict audit logging, and we never help ourselves to the contents of a member's ledger.

4.3 Data retention

• While you are using the service: your data is retained so that sync and restore points keep working.
• After you delete your account: the associated data is removed from our live database immediately. Database backups are kept for up to 30 days for disaster recovery and are then deleted automatically; we do not restore deleted accounts from them.

5. Your rights, and how to exercise them

5.1 Taking all of your data with you (export)

At any time, from the Data area of the app, you can export your monthly assets and liabilities, your loans, and your annual income and expenses as an unencrypted CSV spreadsheet to analyse however you like, or export a complete backup file protected by a password (.jiafi) — so that you always hold a full, restorable offline copy of your own data (the CSV format is for analysis and viewing only; it cannot be imported back).

5.2 Editing and correcting

You can change or update every account, balance and financial figure directly in the app, at any time.

5.3 Deleting your account and your data

You can delete your account and everything held in the cloud at any time:

• Mobile app: More › Account settings › Delete account
• Web: Data › Danger zone › Delete account
• Email: write to legal@jiafi.app and we will take care of it

Once you confirm the deletion, your account, your cloud ledger and your backup restore points are permanently erased from our servers (for the full process, see the account deletion guide).

6. Third-party services

To keep the service running, we integrate with these necessary services and no others:

• Supabase: account authentication and cloud database hosting, and storage of the daily aggregate numbers from the anonymous usage statistics in §2.4
• Cloudflare: website hosting, network security, and storage of the anonymous usage statistics in §2.4
• Google / Apple: third-party sign-in
• Apple (App Store): payment, tax and invoicing for subscriptions bought inside the iOS app — the only place JiaFi sells subscriptions. The web version does not take payment; a plan bought on your iPhone applies to the same account on the web
• RevenueCat: integration and lookup of subscription status. RevenueCat receives your App Store purchase records (which plan, when, trial and renewal status) linked to a JiaFi-generated identifier. It receives no amounts, accounts or financial data from your ledger; your payment method and card number are handled directly by the App Store, and neither JiaFi nor RevenueCat ever receives them
• Market data: your device sends only a ticker symbol to our own server, which answers from its own daily price table; no holding size, amount or anything that identifies you is ever sent to anyone
• GitHub (Microsoft): daily database backups, kept for up to 30 days

7. Children

This service is designed for adults managing a household's finances. It is not directed at children under 13, and we do not knowingly collect their personal information.

8. Changes to this policy

This Privacy Policy may be updated from time to time. Substantive changes will be published on this page and flagged inside the app; please check back periodically to stay up to date.

9. Contact us

If you have any question about this Privacy Policy, or wish to exercise your data rights, please contact:
legal@jiafi.app

Appendix A. Anonymous usage statistics in full

So that we can tell which parts of the product work well and which parts people get stuck on, we collect a very small amount of usage data that cannot identify you.

What we collect:

• (Mobile app only) how far you got in the first-run tour, whether you saw an upgrade prompt (a dialog or a banner), which feature that prompt was about, and whether you tapped its button, and whether you opened the plan page and tapped its start button. It does not include whether you eventually purchased anything, or what you purchased. The web version has no such item: it does not show upgrade prompts or the plan page, so there is nothing to collect
• which month your ledger was created in, and how many months you have been using it
• how many periods your ledger has been settled for in a row (as a range — for example “3–5 periods” — never an exact number)
• which plan you are on (Free / Individual / Family)
• When the app crashes or hits an error: what kind of error it was (for example “the app closed unexpectedly” or “a screen could not be shown”), the error's technical type name (for example TypeError), which part of the app you were in (for example “the balance sheet” — never the specific account or page), whether it was the iPhone, Android or web version and which build, and a short code computed from where in the program the error happened, so that we can tell whether two reports are the same problem. It does not include the error message, anything that was on your screen, or any part of the page address that could point to a specific account
• That is all of it. The list of events is closed — anything not on the list is never sent, and the server turns it away a second time.

What we do not collect:

• Any amount. Your balances, holdings, loans, expenses and net worth — not one of those numbers appears in these statistics
• Account names, member nicknames, or any text you have typed
• Any identifier that could identify you, your account or your device
• Your IP address (it is never written into these statistics)
• Error messages, screenshots or screen contents, or the address of the page you were on

These statistics cannot be traced back to any individual member, including by us — we cannot work out what any one person did, and we cannot link one session to another.

Where it is stored, and for how long: the raw events are held on our own Cloudflare infrastructure and deleted automatically after 90 days; after that only the daily aggregate numbers remain (for example “N ledgers reached their third month on this day”), held in our own Supabase database, and an aggregate cannot be turned back into an individual. Those aggregates live in the same database as your ledger, under the same permission isolation, but they contain no field that could be traced back to a person. Neither the raw events nor the aggregates are shared with any third party.

We only begin collecting once you have agreed: we ask you first, and until you agree, not a single one of these statistics is collected. Crash reports were added in version v9 of this policy: if you agreed to an earlier version, we ask you once more before collecting them — if you decline at that point, all of these statistics stop, including the ones you agreed to before — and if you said no before, we do not ask again. Once you have agreed, you can withdraw at any time using “Send anonymous usage statistics” — in the mobile app under More › Security, and on the web under Settings. After you withdraw, we receive nothing further and the device stops collecting new statistics; events already queued on your device and not yet sent stay where they are, unsent, and are only sent if you switch the setting back on. If you delete your account, any statistics still queued on this device are deleted as well.