// privacy

Privacy Policy

For every app published by BM DEV.

About BM DEV

This page covers every app published by BM DEV on Google Play. Each app has its own section below stating what data that app handles. If an app section says otherwise than this general part, the app section applies to that app.

Changes to This Policy

We will update this page before an app starts handling data in a new way. The effective date will change when the policy changes.

Regional Law and Contact

  • Applicable law: BM DEV handles personal data in line with Saudi Arabia's Personal Data Protection Law (PDPL). For any privacy request, contact apps@benmousa.dev.
  • Questions or requests: Contact BM DEV using the email above.

Mekhbat (مِخْباة)

  • App and publisher: Mekhbat (مِخْباة), published by BM DEV

Summary

This app turns your bank and wallet SMS messages into spending records and budgets.

  • Mekhbat keeps your data on your phone; household data leaves it only end-to-end encrypted, so BM DEV holds no readable personal data about you.
  • On your phone only: All SMS reading, parsing, budgeting, backup encryption, and report generation happen on your phone.
  • No server of our own: We do not run a backend server. Your messages and transactions are not sent to BM DEV.
  • Bank and wallet SMS only: SMS from phone numbers, short codes and sent messages are never stored. A message from a named sender such as a shop may be held until the next re-read of history, then its text is erased. Messages from banks and wallets are kept, except one-time codes, which are never stored.
  • No ads or analytics: The app contains no advertising SDKs and no analytics trackers in the app itself, except ML Kit's usage data while the optional Nano switch is on.
  • Network access: The app requests the INTERNET permission, used only for optional household sync.

Data the App Reads and Stores on Your Phone

SMS Messages (READ_SMS and RECEIVE_SMS)

When you grant SMS permissions, the app reads your phone's SMS inbox:

  • On first setup, to learn your bank message formats and import past spending.
  • When a new SMS arrives (RECEIVE_SMS), to record new spending and notify you.
  • When you open the app and every 6 hours in the background, to catch any bank SMS missed while the phone was off or the app was stopped.

How we filter SMS before storing:

  • SMS from phone numbers, short codes and sent messages are never stored. A message from a named sender such as a shop may be held until the next re-read of history, then its text is erased. Messages from banks and wallets are kept, except one-time codes, which are never stored.

Bank App Notifications (NotificationListenerService)

Mekhbat can optionally read bank app notifications through Android's NotificationListenerService. This is an optional source for bank and wallet apps that send app notifications instead of SMS.

The listener:

  • Reads only notifications from bank apps that you have allowed in the app.
  • Ignores notifications sent by Mekhbat itself.
  • Passes the notification title, notification body (big text if present, otherwise the normal text), and post time to the local notification source.
  • Keeps everything on your phone. Nothing leaves the device.

Local App Database (savings.db)

The app stores the following data locally on your phone:

  • Bank and wallet messages: Sender ID, message text, timestamp, direction, and a local hash fingerprint.
  • Learned message templates: Message structure and field positions (amount, balance, fee, merchant, card/account digits).
  • Transactions: Amount, currency, fee, balance after transaction, transaction type, merchant or counterparty name, masked card or account digits, timestamp, category, status (PENDING, CONFIRMED, or IGNORED), snooze time, user notes, and links between transfers across your own accounts.
  • User choices and settings: Remembered merchant categories, transfer link overrides, custom categories, category budget limits, salary day, savings goals, Jam'iya, end-of-cycle savings, budget rollover, seasonal budgets, and the Hijri date line.
  • Manual cash entries: Cash spending you add by hand, stored locally.

Notifications (POST_NOTIFICATIONS)

The app posts local notifications when new transactions need a category. By default, transaction amounts are hidden on the lock screen (the lock screen shows only "New transaction" or "New transactions").

Home Screen Widgets

The app provides two home screen widgets:

  • Safe to spend: Shows the current safe-to-spend amount.
  • Quick add: Lets you add a manual cash entry quickly.

Reports and Export

You can export reports as CSV or PDF to a place you choose with the Android file picker. Reports are generated on your phone.

Hide Amounts

The app includes a hide amounts mode so you can hide monetary values in the app.

Biometric App Lock

The app includes an optional biometric app lock. It is off by default. You turn it on in Settings, and the phone must have a screen lock. When enabled, the app asks for the fingerprint, face, or phone passcode through Android's BiometricPrompt on start and after a minute or more away. The app never sees or stores the fingerprint, face, or passcode. If the phone's screen lock is later removed, the app stays open rather than locking the user out.

Database Encryption

The app database is encrypted at rest with SQLCipher, using a 256-bit random key. The key is wrapped by the Android Keystore and stored in the app's private no-backup storage. It is never included in a backup and never leaves the phone. An existing unencrypted database is converted on first open, and the original is removed only after the copy checks out. If conversion fails, the app keeps working unencrypted and tries again at the next start.

If the Android Keystore key is lost, the local database cannot be opened, and only a passphrase backup can restore the data.

Encrypted Backup and Restore

You can create an encrypted backup and restore it later.

  • You choose where to save the backup using the Android file picker. This can be a local file or Google Drive, if your device offers Google Drive as a save target.
  • There is no Google sign-in and no Google setup performed by the app.
  • You type a passphrase. The backup is encrypted on your phone.
  • If you lose the passphrase, the backup cannot be opened.
  • Backups hold no SMS text.

The backup file is encrypted with AES-GCM. The encryption key is derived from your passphrase using PBKDF2 with HMAC-SHA256. The backup includes transactions, templates, merchant memory, link overrides, settings, and message metadata needed to keep transactions linked, but message bodies are emptied before encryption.

Optional Household Sync

Optional household sync is built. It uses the INTERNET permission only when you create or join a household. Nothing is sent unless you create or join a household, and then only spending you mark one message at a time.

The app talks to Google Firebase (Cloud Firestore and Firebase Authentication) directly over HTTPS. There is no Firebase library, no analytics and no advertising library. BM DEV runs no server.

A shared record holds only its label (category or transaction type), amount, currency, date and time. It is encrypted on the phone with AES-256-GCM using a household key before it is sent, so Google and BM DEV cannot read it. The household key is exchanged between phones using P-256 ECDH, never sent readable, and is not in backups.

A join request holds the person's chosen name and a public key, sealed with a secret in the invite code, which the user shares themselves.

What Google can see: encrypted bytes, sizes, timestamps, a random household id, and an anonymous Firebase account id. As with any connection, Google also sees the phone's IP address. The Firebase project stores these on Google's servers in the location BM DEV chose.

SMS text, sender, merchant and person names, balances, and card and account digits never leave the phone.

Leaving a household removes shared records from that phone. Records already sent stay on Google's servers as encrypted bytes unreadable without the key. There is no automatic server deletion yet.

Syncing happens when the app opens, on new SMS and on the 6-hour background job, whenever a network is available.

Optional Gemini Nano Suggestions

Optional Gemini Nano suggestions are built. They are off by default. A Settings switch turns them on. On supported phones, the feature suggests the amount, name and type on the Teach screen, and the user checks and saves it. Nothing is saved automatically.

It runs on the phone through Android AICore, using Google's ML Kit GenAI Prompt API library. Message text is processed on the phone.

While the switch is on, the ML Kit library sends Google usage data: device information (manufacturer, model, OS version, build), app package name and version, performance metrics, input and output sizes, error codes, configured languages, and per-installation identifiers, for diagnostics and usage analytics. Google says ML Kit encrypts this in transit and does not transfer it to third parties. Google's page does not list message text among what it sends.

The library adds the permission com.google.android.apps.aicore.service.BIND_SERVICE.

Android Auto-Backup Disabled

The app sets android:allowBackup="false" in AndroidManifest.xml so Android does not upload unencrypted copies of your database to cloud backup.

Permissions We Do Not Use

  • No location: The app never requests location permissions.
  • No contacts or call logs: The app never reads your contacts or call history.
  • Network access: The app requests the INTERNET permission, used only for optional household sync.

Planned Features Not Built Yet

The following features are planned and are not in this version of the app:

This policy will be updated before any of the planned features above are enabled in a public release.

Data Sharing and Third Parties

  • We do not collect, sell, rent, or share your personal or financial data.
  • Google receives the encrypted household sync data described above only when you join a household, as the service provider.
  • If you save an encrypted backup to Google Drive using the Android file picker, Google Drive is the storage destination you choose. The app does not sign you in to Google and does not set up Google Drive for you.

Your Controls and Data Deletion

  • Permission control: You can turn off SMS, notification, or notification-listener permissions at any time in your phone's Android Settings.
  • Screenshot blocking: An optional switch in Settings can block screenshots of the app.
  • Deleting your data: All app data is stored locally on your phone. You can delete all stored messages, transactions, templates, and settings at any time by clearing the app's storage in Android Settings or by uninstalling the app.
  • Deleting backups: You can delete backup files you saved using the Android file picker. If you saved a backup to Google Drive, delete it from Google Drive.