Effective 2026-10-07 · The Mahsoob app, operated by Feras Melhem
In short: Mahsoob never connects to your bank and never asks for banking credentials. Cloud sync is off by default, so unless you turn it on, your financial data does not leave your device. We do not sell your data and we do not use it for advertising.
Mahsoob is a personal finance tracker. Your data is kept in a database on your own device, and the app works fully without an internet connection. An optional server exists for sync and backup, and is used only if you enable sync.
When you create an account we store your name, your email address and a one-way hash of your password. We do not store the password itself and cannot recover it.
For each device that signs in we store a device identifier, its name, its platform and the time it last synced, so you can see your devices and revoke any of them.
If you enable sync, the records you created yourself are uploaded:
| Type | Contents |
|---|---|
| Accounts | Name, type, currency, balance, bank name |
| Transactions and transfers | Amount, date, category, note, linked account |
| Categories and beneficiaries | The names, icons and colours you chose |
| Budgets and recurring rules | Limits, periods and schedules |
When you paste a bank message or share one with the app, the amount, merchant and account are extracted from it, and you review the result before any transaction is saved. The original message text is stored encrypted so a mistake can be traced back, and is never returned by the API in any response.
If you send a suggestion for a new tool from inside the app, we store its title and description, and a phone number and email address only if you choose to give them, used solely to reply to you. None of your financial data is sent with a suggestion.
Files you attach to a transaction (a photo of a receipt, an invoice, a document) are kept on your device. With cloud sync on, they are uploaded to our server into private storage that is never published, and can only be downloaded through your own account. Shopping and task lists stay on your device and sync like the rest of your data when sync is on. Deleting your account deletes the files with it.
The currency converter asks our server for exchange rates, which it fetches from an outside rate provider. Nothing about you or your amounts is sent; the conversion itself happens on your device.
Mahsoob does not connect to any bank, uses no banking API, and cannot move your money.
We do not use your data for advertising, for profiling, or for any commercial analysis.
We do not sell your data and do not share it with advertisers or data brokers. The only third party your data passes through is the hosting provider running the server and database, acting solely as a processor on our behalf. We may disclose data where a binding legal obligation requires it.
No system is perfectly secure, but these are the measures actually in place.
Your data is kept for as long as your account exists. You can delete your account yourself from Settings in the app, which erases your server-side data immediately. If you ask us by email instead, it is erased within 30 days. Data on your device is removed when you delete the app.
To make a request, write to privacy@ferasmelhem.com from the email address on your account.
The app is not directed at anyone under 13, and we do not knowingly collect their data.
When we change it we update the effective date at the top of this page. Material changes are announced in the app.
Feras Melhem — privacy@ferasmelhem.com
