Privacy Policy

Last updated: November 2, 2026

Important

Tahwilati is a record-keeping app only. It does not transfer money, does not send or receive any payment, and never connects to any mobile wallet or bank account.

• Transfers happen outside the app, in your wallet provider's own app.
• Tahwilati records what you enter manually or review and confirm from transfer messages, so you can track balances, commissions and daily closing.
• The app will never ask for your wallet password, PIN or OTP code.

Data you enter

Your name and mobile number, shop name and optional shop photo, wallet names, numbers, balances and limits, customers with credit (name, number, amount), operations (type, amount, commission, time, and optional customer phone, name or reference), optional receipt photos, daily closings and settings. It is stored on your device first and works offline; changes sync when you are back online.

Transfer SMS tracking

If you enable Transfer messages and grant the RECEIVE_SMS permission, the app receives new messages in the background, including while its interface is closed, to detect Vodafone Cash transaction messages. It filters the sender and message content and discards personal messages, advertisements and verification codes (OTPs) without storing or uploading them. It does not read your existing SMS history, send SMS or access call logs.

From transfer messages, we extract the amount, direction, customer name and phone if present, wallet phone, transaction reference and time, and any balance or provider fee. These details prepare an operation for review; nothing is posted to your ledger until you confirm it.

Raw transfer message text is temporarily stored encrypted on your device until imported into the local review inbox, then removed from the reception queue. Extracted details remain in the local inbox. Full SMS text is not uploaded to our servers or sent to an AI service. When you confirm an operation, its approved details, including the customer name, phone and transaction reference where present, sync to Supabase with your shop ledger, like other operations.

A transfer notification may appear; its lock-screen public version hides personal details. You can stop reception under Transfer messages → Message settings, or revoke the SMS permission in Android settings. Disabling tracking stops new message reception but does not delete previously recorded operations. Uninstalling the app removes its SMS queue and local inbox from the device.

Account and sync

You sign in with your mobile number and a password; the number is verified with a code sent on WhatsApp. The code is generated, sent and checked by Authevo, which receives only your number and the code. Your data is synced to Supabase servers over HTTPS so you can restore it on another device. Passwords are hashed, and each shop's data is restricted to its owner and the people they add.

We record the app's last connection time to identify accounts that have stopped connecting. This does not prove that the app was uninstalled.

Subscriptions

There are no payments inside the app. Subscriptions are arranged with us on WhatsApp and paid by transfer; we keep the amount, date and the transfer screenshot you send us to activate your plan. We never ask for or store card details.

Crash reports

If the app crashes, a technical report is sent to Sentry (device model, Android version, app version, stack trace). Phone numbers are removed on the device before sending; no screenshots, balances or names are sent.

Permissions

• Internet: sign-in, sync and crash reports.
• Biometrics: optional app lock, verified by Android; the app never receives your fingerprint.
• Camera / photos: only when you choose to attach a receipt or a shop photo.
• Receive SMS: after disclosure and your consent, to detect new transfer messages and prepare them for review, including while the app interface is closed.
• Notifications: to alert you to transfers awaiting review. This permission does not let us read other apps' notifications.

What we don't do

• We don't sell or share your data for advertising.
• No ads in the app.
• We don't store or upload personal SMS or verification codes; SMS tracking is restricted to wallet transaction messages after your consent.
• We don't read other apps' notifications or call logs.

Deleting your data

Uninstalling the app deletes its data from the device, but the server copy is kept so you can restore it. You can delete your account and shop data from Settings → Delete my account in the app (steps), or email tahwilati@gmail.com or message us on WhatsApp from the account's number; we will delete it within 30 days. We retain your name, shop name, phone number, deletion time and any feedback you wrote before deleting in an admin-only record. Email us if you want that record removed too.

Children

The app is intended for shop owners and is not directed at children under 13.

Contact

tahwilati@gmail.com