Privacy Policy

The data controller for Mizan is Abdallah Hamada, an individual developer based in Istanbul, Türkiye. For any privacy request, including access, correction, deletion, restriction, objection or a copy of your data, contact support@mizan-ai.org. We reply within 30 days.

Account and authentication data: name, email address, Mizan user ID, language and currency preferences. Email sign-in stores a salted password hash, not the password. Google Sign-In provides your name, email address and Google account identifier; Mizan does not receive your Google password.

Financial records you choose to enter or confirm: accounts, balances, transactions, transfers, budgets, goals, recurring expenses, assets, categories, currencies, exchange-rate preferences and notes. Guest-mode records are stored on the device. Records are sent to Mizan’s backend for syncing after you sign in.

Imported content: text that you deliberately share with Mizan is redacted before a structured transaction is saved; the original message text is not saved.

AI requests and usage records: questions, instructions and relevant financial context are sent when you use an AI feature. Mizan stores operational usage records such as the model, request type, token counts, estimated cost and time, linked to your user ID; it does not store the AI request text in those usage records.

Subscription data: plan, product, provider, status, renewal or expiry dates, store environment, and provider subscription or transaction identifiers. Payment-card numbers and bank credentials are not received or stored by Mizan.

Support data: information you include when you contact support. Servers and payment providers may also process ordinary request, device, store and security metadata needed to deliver and protect their services.

• Mizan does not connect to bank accounts and does not request bank passwords, card numbers, PINs or one-time codes.
• The app does not read SMS messages or contacts and does not request location data.
• The audited app and website contain no advertising SDK, advertising identifier use, third-party analytics or crash-reporting SDK.
• Mizan does not sell personal or financial data and does not share it for targeted advertising.

To create and secure accounts; store and sync chosen records; calculate budgets, reports and forecasts; provide support; operate subscriptions and entitlements; prevent abuse; and maintain the service.

AI content is processed only when you invoke an AI feature. Mizan does not use your financial records to create advertising profiles.

The website uses only functional browser storage and language cookies for sign-in state, theme, language and checkout operation. Mizan does not use them for advertising or cross-site tracking.

• OpenAI processes the content needed to answer an AI request. Your name and email are not intentionally added to these requests.
• Depending on the website checkout configuration, Paddle acts as merchant of record and processes checkout, tax, invoicing and subscription events, or Stripe processes hosted checkout and subscription events. These providers receive account and purchase details needed for billing; card details are entered with the provider, not Mizan.
• Apple App Store and Google Play process in-app purchases, renewals, cancellations and refunds. RevenueCat receives Mizan’s authenticated user ID plus store, product and subscription-event data so Mizan can verify entitlement status across devices.
• Google processes identity data when you choose Google Sign-In.
• Netlify hosts the public website, Render hosts the backend API, and Neon provides the PostgreSQL database. These infrastructure providers process request, account and service data as needed to operate and secure Mizan.
• Resend — sends transactional emails (email confirmation and password reset). Receives your email address and the message content.

We only send emails needed to operate your account. We do not send marketing emails.

Mizan may disclose information when legally required or to protect users, the service or legal rights. It does not share data with data brokers or advertisers.

Connections to the production website and API use HTTPS/TLS. Passwords are salted and hashed, authentication tokens are revocable, payment webhooks are signature-verified, and server-side secret keys are not embedded in the mobile app. No system can be guaranteed completely secure.

You can permanently delete an account in Settings > Account > Delete account, or use the Delete Account. On successful deletion, Mizan deletes the account and associated active-database records and clears account-linked local app records. Paddle subscriptions are cancelled by the deletion service first. Apple App Store, Google Play and legacy Stripe subscriptions must be cancelled with the provider; deleting Mizan does not by itself stop those providers from billing. Providers may retain transaction records under their own legal obligations.

• Account and financial data: kept while your account exists. When you delete your account, it is removed from our live database immediately and from backups within 30 days.
• Server logs (user IDs and error messages, never your financial entries): up to 30 days.
• AI usage records (model, token count and cost, never the text of your questions): kept while your account exists and deleted with it.
• AI requests: sent to OpenAI to generate a reply. OpenAI may keep them for up to 30 days for abuse monitoring under its own policy.
• Billing records: kept by our payment providers (Paddle, Stripe for earlier web subscriptions, and the app store you purchased through, where applicable) for as long as tax and accounting laws require.
• Support emails: up to 2 years after the conversation ends.

• Access and correction: view and edit your account and financial records in Mizan.
• Export: export supported financial records from Settings > Export.
• Delete: use the in-app control or the public deletion page. You may also contact support@mizan-ai.org.
• AI and imports: do not use the AI coach if you do not want selected content sent for AI processing; transaction-import sources can be disabled in Privacy settings.

Mizan is available worldwide. Your data is processed outside your country by the providers listed above, including in the European Union (Render, Frankfurt) and the United States (OpenAI). Where required, we rely on these providers’ data processing terms and standard contractual clauses.

• EU, EEA and UK (GDPR / UK GDPR): you have the right to access, correct, delete, restrict or object to processing, and to receive your data in a portable format (Settings → Export). We process data to provide the service you signed up for (contract), to keep it secure and prevent abuse (legitimate interests), and with your consent where we ask for it. You may complain to your local data protection authority.
• Türkiye (KVKK, Law No. 6698): under Article 11 you have the right to learn whether your data is processed, request information about it, learn the purpose of processing and the third parties it is transferred to, request correction or deletion, object to a result produced solely by automated analysis that is against you, and claim compensation for damage caused by unlawful processing. You may also complain to the Personal Data Protection Board (KVKK).
• United States: we do not sell your personal information or share it for cross-context behavioural advertising.
• Everywhere else: you can use the same rights above by contacting support@mizan-ai.org.

Mizan is intended for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If we learn that an account belongs to someone under 16, we will delete the account and its data. Users aged 16 and 17 should use Mizan with the knowledge of a parent or legal guardian.

This policy may change as Mizan changes. The effective date appears above, and material changes will be communicated where required.

Privacy questions, deletion requests and complaints: support@mizan-ai.org.