LOAF Privacy Policy
Effective date: 16 September 2026
Last updated: 11 October 2026
LOAF is a personal money-tracking app for iPhone. This policy explains what information LOAF collects, why, where it goes, and what you can do about it. It is written to be read, not skimmed — it's short on purpose.
Who is responsible for your data
LOAF is made and operated by Aaqib Mohammed Sali (the "Founder"), an individual based in Kerala, India ("LOAF").
For anything about your data — questions, requests, complaints — email aaqib@theloafapp.com. Under India's Digital Personal Data Protection Act, this is also the contact for grievances.
The short version
- LOAF never connects to your bank. You type in what you spend. LOAF never sees your bank login and never moves money.
- LOAF does not sell your data, does not show ads, and does not track you across other apps or websites.
- Your data is stored on your phone, and — if you sign in — backed up to your own private space in Google's Firebase cloud.
- You can delete everything from inside the app, at any time.
What LOAF collects, and why
1. What you tell LOAF, so the app can work
| What | Why |
|---|---|
| Your name | So LOAF can greet you |
| Your country | To show the right currency and formatting |
| Your payday and, if you use one, your card bill day | To work out your monthly cycle |
| Your balances, expenses, savings, baskets and card bills | This is the app — it's what LOAF tracks for you |
| The commitment you sign during setup | Shown back to you in Settings. It is stored only on your phone and is never uploaded |
2. Your account
LOAF needs an account. When you sign in — with email and password, Google, or Apple — LOAF stores:
- Your email address
- An account identifier created by Firebase
Sign-in itself is handled by Google Firebase Authentication. If you use Google or Apple to sign in, LOAF receives only what you agree to share on their sign-in screen (typically your email). LOAF never sees your Google or Apple password.
The data in section 1 (except the signed commitment) is backed up to your own private area in Firebase, so it follows you to a new phone.
3. How the app is used, so it can be improved
LOAF uses Google Analytics for Firebase to understand how the app is used in general — which screens are opened, which buttons are tapped, how long sessions last, and the country a session comes from. This data is not linked to your name or account; Google sees an anonymous per-install identifier. It does not include the amounts you enter.
LOAF does not use the advertising identifier and does not ask for tracking permission, because it does not track.
4. Messages you send
If you send a feature request, bug report or help request from inside the app, LOAF stores your message, your email (so LOAF can reply), and the app version, iOS version and device model (so LOAF can reproduce a bug). If you send from Mail instead, it's an ordinary email.
If you delete your account, LOAF asks why. The reason is stored anonymously — with no name, email or account identifier attached — and is used only to make LOAF better.
5. Notifications
LOAF's reminders are scheduled on your phone and never leave it. You choose which reminders you want in Settings.
What LOAF does not collect
Your bank details. Your card number. Your location (beyond the country a session comes from). Your contacts, photos or messages. Anything from other apps.
Where your data is stored
- On your phone. Everything LOAF needs to work is stored locally.
- In Firebase. Firebase is run by Google. Its servers are located around the world and may be outside India, the UK or your country. Google acts as a processor on LOAF's behalf and is bound by its own data-protection commitments and standard contractual safeguards for international transfers.
Access to your Firebase data is restricted by security rules so that only your own signed-in account can read or write it.
How long LOAF keeps your data
- Your account and its data: for as long as your account exists. When you delete your account, everything is deleted — from your phone and from Firebase.
- Messages you send for support: until your request is resolved and for a reasonable time afterwards.
- Anonymous deletion reasons and analytics: kept as aggregate information, with nothing that identifies you.
Your rights
Wherever you are, you can:
- See your data — it's all in the app, and Settings → Account → Export my data gives you a copy as a file.
- Correct it — every figure in LOAF can be edited.
- Delete it — Settings → Account → Delete account removes everything. No email needed, no waiting.
- Withdraw consent — deleting your account withdraws it.
- Complain — to LOAF first at aaqib@theloafapp.com. In India, under the DPDP Act, you may also approach the Data Protection Board. In the UK, you may contact the Information Commissioner's Office (ico.org.uk).
If you are in the UK or the European Economic Area, the legal bases LOAF relies on are: performance of a contract (providing the app you asked for), legitimate interests (understanding usage, answering support requests, keeping the service secure), and consent (where you sign in with a third-party provider). You also have the right to data portability, which the export in Settings provides.
Children
LOAF is for adults. It is not directed at anyone under 18, and LOAF does not knowingly collect data from anyone under 18. If you believe a child has created an account, email LOAF at aaqib@theloafapp.com and it will be deleted.
Security
Data travels between your phone and Firebase over encrypted connections (HTTPS). LOAF never stores your password — Firebase handles sign-in. No system is perfectly secure, but your data is restricted to your own account and LOAF has no way to see your password.
Changes to this policy
If this policy changes, the new version will be posted at this address with a new date at the top. If a change is significant, LOAF will tell you inside the app.
Contact
aaqib@theloafapp.com
Aaqib Mohammed Sali, Kerala, India