Privacy Policy

Who we are

Rasid is operated by Taimoor Nasir, trading as Rasid, built in Dubai for the United Arab Emirates. Amounts are shown in AED by default. Rasid is iOS-first; Android will follow. It is free during early access.

Rasid is operated by Taimoor Nasir, who is the controller of the data described here. Contact: hello@rasid.app.

What we collect

Everything below lives in your own account. You create almost all of it by using the app; the rest is generated by the app on your behalf.

Account — your Firebase user ID, email address, display name, profile photo URL, country, currency, which method you signed in with (email, Google or Apple), and timestamps for when you signed up and were last active.
Preferences — default currency, reminder lead time, date format, theme, notification setting, biometric-lock setting, dismissed insights, and the period you last viewed.
Device — a push token per device plus the device model name, so alerts reach the right phone.
Subscriptions — name, plan, amount, currency, billing cycle, dates, category, payment method label, importance, whether it is a trial or paused, your free-text notes (up to 500 characters), price history, and whether a charge or bill was paid or did not go through (the amount, the date and where it came from: a receipt, a card alert, a failed-payment notice, or your tap).
Bills — for UAE utilities (DEWA, SEWA, ADDC, Etisalat/e&, du, Empower) and credit card statements (Emirates NBD, Mashreq, Mashreq Neo, ADCB, FAB, ADIB, RAKBANK, HSBC UAE): provider, amount due, minimum due, due date, issue date, billing period, up to 12 previous amounts, and the account reference or card last-4 exactly as printed on the bill. We also keep the sender domain and date of the email the bill came from, as evidence for where the figure came from. We never keep the email's subject or body.
Rent: if you add it, the property name you give, the yearly rent, the contract dates, and each cheque's date, amount and status (upcoming, cleared or returned). Rasid never asks for a cheque, account or landlord's details.
Instalment plans: for a plan from a pay-later company's emails (such as Tabby, Tamara or Postpay), from your bank's own instalment-plan emails, from a statement you upload, or one you add by hand: whether it is a pay-later, bank or store plan, the store's name as printed, the instalment amount and currency, the purchase total when printed, which payment it is and how many there are, the payments left, how often you pay, the next and last due dates, the latest payment counted, whether the plan is paid off, where it was seen (email, statement or by hand) and which values you changed yourself. Rasid never keeps an order number.
Budgets — the budget plan name, your monthly income, allocations, category budgets and fixed expenses, if you use the budgeting feature.
Spaces — the names you give your personal, family and business spaces, so they stay separate.
Chat — messages you send to the in-app assistant. The transcript is stored on your device only; it is not written to our database.
Widgets — for the Home Screen and Lock Screen widgets, the app keeps a small copy on your phone of what they show for the space you have open: the name, amount, currency and due date of your upcoming and overdue bills and subscriptions (up to ten next charges, and what is left to pay this month), this month's totals, the suggestions to pay less that Discover shows (what each suggests and its saving), and their logos. It stays on the device, in storage only Rasid and its widgets can read, and is not sent anywhere; the widgets themselves make no network requests. It is deleted when you sign out or delete your account.
Operational records — rate-limit counters, a log of notifications sent to you (which includes the subscription name and amount in the message body).
Your AI permissions — whether you agreed to Rasid sending your email, your imported files, and your Assistant messages to its AI provider, with the date and the version of the wording you agreed to. Turning one off deletes its record.
Usage counts — how many times you opened Discover, which kinds of savings suggestion were shown and tapped, and how many of your subscriptions Discover recognised and priced. Counts only, kept on your own account: never a service name, an amount or any text.

What we do not collect

Some of this matters more than what we do collect.

No bank login credentials, no card numbers, no CVV, no OTP, no screen scraping. Rasid never asks for them.
No advertising SDKs, no ad identifiers, no cross-app or cross-site tracking. Rasid does not track you across other companies' apps or websites.
No product-analytics or telemetry SDK. There is no Firebase Analytics, Amplitude, Mixpanel, Segment, PostHog or AppsFlyer in the app. The usage counts above are written by Rasid itself to your own account.
Website analytics — the public website uses Vercel Web Analytics to measure visits, page views and traffic sources. This is separate from the app. We exclude admin-page events and remove query strings and URL fragments from page-view URLs. We do not send Gmail content, financial records or access tokens to website analytics.
No card numbers or bank account details. Rasid is free during early access and we do not process payments. It records only whether a bill or a renewal was paid, when and for how much, from the emails you let it read and from your own taps.
The password of a locked statement PDF. It is typed and used on your phone only.
No location data, no contacts, no health data, no microphone.
No bank account connection. Rasid does not link to bank accounts through open banking or any other route, and there is no plan to add it. Everything Rasid knows comes from billing email and from files you hand it yourself.

Google user data: the Gmail scope

Rasid requests exactly one Google API scope: https://www.googleapis.com/auth/gmail.readonly. It is read-only. Rasid cannot send, delete, modify or label your mail, and cannot see your Google account beyond your mailbox.

Why we need it: to find the subscriptions and bills already sitting in your inbox as receipts, invoices, renewal notices and statements, so you do not have to type them in. That is the core feature of the app; without the scope, the import has to be done by hand.

The permission is requested only when you tap Connect Gmail, never as part of signing in. Nothing is read from your mailbox until you start a scan or a bill refresh. If you would rather not grant it at all, sign in with Apple or with an email address and password instead — every other feature works.

What a scan reads:

Message IDs matching billing-specific searches: receipts, invoices, payments, bills, subscriptions, renewals, trials, instalments, rent, insurance and school fees, card alerts that name a subscription, and known biller and pay-later domains. Most searches cover the last 400 days; the searches for amounts due and utility bills cover the last 120. It is not a search of your whole mailbox.
Sender, subject and date headers for up to 6,000 of those messages, grouped by sender. Then the full text of some of each sender's messages: up to 6, or up to 12 for a pay-later company, a bank's card alerts or a sender with many products such as Apple or Google, and up to 16 when a sender is read a second time. What goes to our AI provider is cut to 8,000 characters per message, or 20,000 on a second reading or with a PDF, keeping the start and the text around each price.
A bill refresh looks at the last 35 days from 21 UAE utilities and banks, up to 12 messages each, with bodies capped at 20,000 characters. It also looks at up to the last 45 days of mail from any other sender whose subject or wording looks like a bill. Short pieces of those messages (the sender's domain and company name, the subject and a few lines) go to our AI provider, masked first, to sort bills from other mail: card numbers, IBANs, phone numbers, email addresses, street addresses and people's names are removed. The ones that look like bills are then read in full and sent masked, as described under AI processing.
Price changes: a refresh also looks at the last 45 days of emails with "price" in the subject from the services you track, and from Apple and Google Play. Up to 6 a refresh go to our AI provider, masked as described under AI processing, to read the new price. Only the new price, its currency, the day it starts and the old price (when printed) come back to your phone.
Payment confirmations: to tell you whether a bill or a subscription renewal was paid, a refresh also looks at the last 45 days of messages from the biller or the service itself (receipts, payment confirmations, refunds), and at card or bank alerts that name a subscription you track. Only messages signed by the sender's own domain count. Rasid keeps the amount, the date, the kind of message and a one-way hash of the message ID. It never keeps the subject or the body.
Failed payments: to tell you when a payment did not go through, a refresh also looks at up to 30 messages from the last 45 days whose subject says a payment failed, was declined or is past due. One counts only when it is signed by the domain of a subscription or bill you track, or by a payment processor that names it. Rasid keeps the same fields as for a payment, marked as failed. When the wording is not one Rasid already knows, up to 8 of these messages a refresh go to our AI provider, masked as described under AI processing, only to check whether the payment failed.
Rent: a scan offers a landlord's tenancy email (a contract, a renewal, Ejari or rent due) as rent for you to add, and nothing is saved until you tap Save rent. Rasid does not look for banks' cheque notices. A bill refresh's search for bills can still match an email with the word cheque in its subject; like any message it sorts, only masked pieces go to our AI provider, and cheque and account numbers are always removed first. You mark each cheque cleared or returned yourself.
Instalment plans: in a scan and a bill refresh, which payment of a plan an email is about, how many there are, the amount, the store and the due dates are read by code from what the email prints. This covers pay-later companies such as Tabby, Tamara and Postpay, and your bank's emails about your own card instalment plan. An order number is never kept.
PDF attachments. In a bill refresh, only when the bill is in the attachment rather than the email ("please find your invoice attached"). In a scan, a telecom provider's bill PDFs, up to 3 per provider, because add-ons billed to a line are only listed there. Up to two PDFs per message, up to 4 MB and 6 pages each, are opened in server memory. In a refresh their text is read by the same rules as an email body, and goes to our AI provider only when those rules cannot find the amount; in a scan it goes to our AI provider with the email. Either way, names, email addresses, card numbers and phone numbers are masked first. Attachment filenames and attachment bytes are never stored, logged or sent anywhere. A password-protected PDF is not opened.

What we keep from your mailbox

Raw email — bodies, snippets, message IDs, label IDs and sender addresses — exists only in the memory of the Cloud Function handling your request, for the duration of that request. It is never written to our database or to file storage.

From a subscription scan, the results come back to your phone and you choose what to import. Only the fields on the imported record are saved — name, amount, currency, cycle, dates, category, plan, type. The email subject and sender are deliberately not carried across.

From a bill refresh, a saved bill keeps the email's sender domain and date, plus the account or card reference printed in the bill, so you can see where the amount came from and so the next statement matches the same account. It never keeps the subject or the body.

When a scan meets a sender we do not recognise, we add the sender's domain, a guessed merchant name and a counter to a shared vendor list that helps Rasid recognise that biller for everyone. No user ID, no message content and nothing that identifies you is stored with it. Because it contains nothing personal, it is not removed when you delete your account.

Limited Use

Rasid's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms:

We use Google user data only to provide and improve the user-facing features you can see in Rasid — finding subscriptions, reading bills, and reminding you before you are charged.
We do not use Google user data for advertising of any kind, and we show no ads.
We do not sell Google user data, and we do not transfer it to data brokers, information resellers or anyone else for their own purposes.
We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models, and we do not permit our processors to do so. Email content is sent to our AI provider only to produce the result you asked for in that moment.
We transfer Google user data to others only where it is necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger or acquisition after obtaining your explicit consent.
No human at Rasid reads your Gmail content, except with your explicit consent for a specific problem you have reported to us, where it is necessary for security (for example investigating abuse), or where the law requires it.

AI processing

Rasid uses Anthropic's Claude models to read messy billing text and turn it into structured records. This happens server-side, inside our Cloud Functions. The API key is held in Firebase Secret Manager and never reaches your phone. Anthropic is a processor acting on our instructions; it is not permitted to use your data to train models.

Nothing is sent to Anthropic until you agree in the app. Rasid asks separately before it reads your email, before it reads a file you import, before your first Assistant message or budget plan, and before it sends your subscriptions to get recommendations in Discover. Each time, it names Anthropic. "Not now" sends nothing, and you can still add everything by hand. If you connected Gmail before Rasid asked, it asks once, and your bills stop updating until you answer.

You can turn each one off again in Settings, under AI. From then on every AI request for that kind of data is refused. A Gmail scan or bill update already running checks again before each request that carries mail, so it stops sending mail within about 10 seconds; requests already on their way finish. Turning off AI for Gmail also disconnects Gmail. Turning off Recommendations also deletes the results kept for them.

What is sent, and when:

Gmail scan — a sanitised version of each candidate email (sender, subject, body, date), in batches. Before it leaves our server we mask the local part of email addresses, phone numbers, full and partial card numbers, account numbers, national IDs, street addresses, postcodes, names in greetings and signatures, IP addresses and URL tokens. The masking is pattern-based and best-effort, and it is lighter on the subject line than on the body, so treat it as a strong reduction of personal data rather than a guarantee that none passes through.
Statement, receipt and image import: the file you pick is sent as it is, up to about 6 MB, with no masking applied. You can pick up to 10 screenshots of one statement; your phone makes them smaller and sends them together, within the same limit. If a PDF is locked with a password, you type the password on your phone, your phone opens the file and makes an unlocked copy, and that copy is what is sent. The password is never sent to us or to Anthropic, never saved and never logged, and the unlocked copy is deleted after reading. Rasid does not keep the file or the screenshots. If you upload a bank or credit-card statement, everything visible on it goes to the model, including account numbers, balances and transactions unrelated to your subscriptions. Crop or redact first if that matters to you.
Tenancy contract or Ejari certificate, in Add rent: only if you have said yes to reading files. The photo, screenshot or PDF you pick is sent as it is, up to about 6 MB, like a statement. Our server asks only for the property's name, the yearly rent and its currency, the contract dates and the cheques, and drops anything else in the answer, such as a name, an Emirates ID or a phone number. The document is not kept, and the copy the picker made on your phone is deleted after reading. You check the filled form before anything is saved.
Google Sheet import — only if you have said yes to reading files. Our server reads the first tab of the sheet (up to 400 rows and 12 columns, each cell cut to 80 characters) and sends its text to Anthropic's Claude, which finds the subscriptions in it. Email addresses, links and long numbers (card, account and phone numbers) are masked first; the masking is pattern-based and best-effort, so shorter numbers and unusual formats can pass. Everything else in those cells goes as written, including names, labels and amounts, so only share a sheet you are happy for it to read. Only the subscriptions it finds come back to your phone, and you choose which to add. Rasid does not keep the sheet or the answer.
In-app chat — your message, recent conversation history, and a summary of your data so the answer is useful: your active subscriptions with amounts and dates, your budget plan including your monthly income and allocations, and this month's spending totals.
Budget plan generation — monthly income, fixed expenses, and spending by category.
Discover's AI recommendations — only if you have said yes to Recommendations, in Discover or in Settings under AI. Without it, nothing goes to Anthropic. For each subscription Discover recognises: which service in Rasid's catalogue it is, the plan its amount matches, what it costs per month, the currency, how often you pay, whether the amount came from a receipt, was typed or was recorded, whether 5% VAT is on top, and whether the App Store or Google Play bills it. Along with them go Rasid's own price list for the UAE and its reviewed offers. Never a subscription's name, the plan as you typed or received it, your notes, dates, your name, your email or your account ID. Our server also receives your space as a one-way hash, used only to keep the answer for you, and the app version; neither goes to Anthropic. The answer is codes and rankings, not text: the words you read in Discover are Rasid's own.
Insight generation — subscription records and derived signals. This feature is currently switched off in both the app and on the server.

Files you import

You can import .xlsx, .xls, .csv, Google Sheets, PDFs and images (png, jpeg, heic, webp, gif), up to 10 screenshots at a time. In Add rent you can also pick your tenancy contract or Ejari certificate to fill the form (see AI processing above).

Files you pick from your phone are read on the device and sent straight to our Cloud Function for extraction. They are not uploaded to file storage and we do not keep a copy of the file — only the records you confirm on the review screen.

A Google Sheets import does not use your Google account. You paste a link to a sheet you have shared publicly, and our server fetches it with our own API key. In the current version of the app, the function reads the first tab of the sheet and passes its text to Anthropic's Claude to find the subscriptions (see AI processing above); only the subscriptions it finds come back to your phone. Earlier versions of the app fetched the first tab and read its columns on the phone instead. Only share a sheet you are happy for it to read.

Discover's prices

Discover compares what you pay with Rasid's own price table, read from public pages. A price from a UAE App Store listing is used only for a subscription the App Store bills; for one you pay the provider directly, Discover uses the provider's own prices.

Offers

The Offers section lists sales, bundles and plan deals that service providers publish on their own pages. Rasid reads those pages itself and publishes one list at rasid.app. The app downloads that same list for everyone. The request carries no account, no cookie and nothing about you.

Which offers apply to you is worked out on your phone, from your own subscriptions and bills and from the answers you give in Offers, such as being a student. Those answers stay on your phone. They are not synced to your account and are not sent to us.

Deal alerts are off until you turn them on in the notification settings. When they are on, your phone schedules them itself, from that list and your own subscriptions. Nothing is sent to us to schedule them.

If an offer does not work for you, you can tap "I could not claim this". That hides the offer on your phone and sends nothing. A report is sent only if you then choose Send to Rasid, and the screen shows what would go. It holds three fields: the offer's ID, the reason you chose and the day. It is sent without your sign-in, and Rasid stores exactly those three fields, with no account and no device. The address your phone connects from is used only to limit abuse, is held in memory and is not stored.

Notifications

If you turn on notifications, Rasid alerts you three days before a renewal, a trial converting to paid, or a bill due date. You can change the lead time. It also tells you once when a payment for something you track did not go through. For rent, it reminds you 7 days and 1 day before each cheque.

Alert text contains the service name and the amount, for example a reminder that a named subscription renews tomorrow. That text passes through Apple and Google push infrastructure and appears on your lock screen. Turn notifications off in Settings if you would rather it did not.

The waitlist

If you join the waitlist on rasid.app, we keep your email address, the time you joined, the page you joined from, your place on the list, a personal invite code and, if you joined through a friend's link, that friend's code. To limit abuse and to show you your place, we also keep a salted hash of your IP address, not the address itself, for up to 24 hours. A daily job deletes it.

The waitlist receipt may ask one optional question: what you would comfortably pay each month, out of $9.99, $11.99 or $12.99. If you answer, we keep your answer and the launch offer it earns (50% off your first month on the monthly plan) against your email address, to plan pricing and to send your code at launch. We do not share it. Skipping the question changes nothing about your place.

Your address is sent to our email provider, Loops, which sends the welcome email with your place. If you joined through a friend's link, Loops also emails that friend to say they moved up, and we send ourselves a short note that someone joined. The waitlist is separate from any app account. To be removed, email hello@rasid.app: we delete your waitlist record and your Loops contact.

Who else gets your data

We use the following processors and services. We do not sell data to anyone, and we have no advertising partners.

Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Logging) — the whole account. Firebase Auth holds your email, name, photo URL and sign-in identity. Firestore holds every record described above. Our server code runs on Google Cloud.
Google Gmail API — your OAuth access token and the billing searches we run; it returns matching messages to our server. Google therefore sees which billing queries Rasid runs against your mailbox.
Anthropic — the AI payloads listed above.
Apple — Sign in with Apple identity assertion, if you use it; and push delivery for notifications.
Firebase Cloud Messaging (Google) — notification title, body and the related record ID, sent to your device tokens.
Expo — your device's native push token, exchanged with Expo's servers to mint the push token we store.
Sentry — crash reports and performance traces from production builds when crash reporting is configured: exception messages, stack traces, component stacks and the screen name. We strip the user email and IP address before sending. Other fields are not filtered, so personal data appearing inside an error message could be transmitted.
Google Sheets API — the spreadsheet ID for a sheet you choose to import, plus the contents of its first sheet.
logo.dev — the website domain of each subscription you track, plus your device's IP address, when fetching that service's logo. This discloses your subscription list, one service at a time, to that CDN.
Google favicon service — the same domain and IP, as a fallback when logo.dev has no logo.
Loops — the waitlist email address, the time and page you joined, your place and invite code, so it can send the welcome email and the "you moved up" email.
open.er-api.com — exchange rates. No user data is sent.

Where it is stored and how it is protected

Your data sits in Google Cloud Firestore under a document tree keyed to your account, on infrastructure operated by Google.

Access rules on the database restrict every document to the signed-in owner. Admin flags are writable only by our server, never by the app. Your bills, including the account reference printed on a bill, are written by your own app, and only you can read or change them.
All traffic between the app, our functions and third parties runs over HTTPS/TLS.
Your Google access token is kept in the iOS Keychain on this device only, readable after the phone's first unlock, so a bill refresh can run in the background. It is never written to our database and never logged. It is passed to our function over HTTPS for the length of one scan and discarded. Where there is no Keychain, in web builds and some development builds, the app falls back to ordinary local storage, which is less protected.
No Google refresh token is stored by the app. Access tokens are short-lived, around an hour, and re-minted through Google's own sign-in SDK when a scan needs one.
Third-party API keys live in Firebase Secret Manager and never ship in the app. An automated build check fails the release if a secret appears in the bundle. The one key that is in the app is logo.dev's publishable key, which is designed to be public.
You can lock the app with Face ID or Touch ID.
Diagnostic logs on the Gmail paths identify you by a truncated hash, not your account ID, and error text is scrubbed before it is written. Some other server logs do record your raw account ID. Logs contain no email content.
Client-side logs strip passwords, tokens, keys, secrets, credentials, cookies, session values and email addresses, and non-error logging is disabled outside development.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your data we will tell you.

How long we keep it

The short version: your records stay until you delete them or delete your account. Email subjects and bodies are never kept.

Account, subscriptions, bills, spaces, budgets, budget plans and notification history — retained until you delete the record or the account. There is no automatic expiry.
Gmail message content — subjects and bodies are not retained; they exist in server memory for the duration of one scan or refresh. So an interrupted scan can resume, a short checkpoint is kept: message IDs, sender domains, and the amounts, dates and service names read from them. It is deleted by a daily clean-up once it is two days old, so at most three days.
Google access token — short-lived, roughly one hour, then discarded.
Bill history — the 12 most recent statements per bill; older entries roll off.
Cached AI insights — 6 hours to 7 days depending on how they were produced, and no more than 30 days.
Discover's AI recommendations — on your device until you sign out or turn off Recommendations; on our server as references and codes only, never an amount, for up to 7 days, and deleted when you turn off Recommendations.
Rate-limit records — deleted after 30 days by a daily cleanup job.
Chat transcripts — stored on your device until you clear them or delete the app. Clearing chat history clears it locally only.
Data already sent to a processor is governed by that processor's own retention terms. We cannot recall a request after it has been made.

Disconnecting Gmail

Two independent switches, and either is enough:

In Rasid: Settings, then disconnect Gmail. This deletes the token from your device, revokes the grant at Google, and records a sticky opt-out so the app will not ask again for that account. Bills and subscriptions already saved stay; delete them individually if you want them gone.
At Google: go to your Google Account, then Security, then Third-party apps with account access, and remove Rasid. Revoking there stops all future access immediately, whatever the app does.

Deleting your account

Settings, then Delete Account, then confirm. This is not a request queue — it runs immediately and it is not reversible.

What happens, in order: your user document and every subcollection under it are recursively deleted, which is your profile, subscriptions, bills, spaces, budgets, budget plan and income, transactions, audit and notification logs, insights and preferences; any file-storage prefix for your account is cleared; and your login is deleted last, after the data is gone. On the device, your Google grant is revoked, the stored token and email are wiped, and every local store is reset.

What survives, and why:

Vendor entries derived from unrecognised sender domains — a merchant name, a domain and a counter, with no user ID and no message content attached.
Aggregate, non-identifying counts of whether insights were rated useful.
Anything already transmitted to a processor — Anthropic, Sentry, Expo, Google — which is subject to their retention periods.
Your waitlist record if you joined on rasid.app, and your Loops contact. Email hello@rasid.app to have both removed.
Records we are required to keep by law, if any apply.

Your choices

Almost everything Rasid holds about you is visible and editable in the app — open a subscription, a bill, a space or a budget and change or delete it. Notifications, biometric lock, currency and reminder timing are all in Settings.

For anything the app does not cover — a copy of your data, a correction, an objection to a particular use, or a question about why something is stored — email hello@rasid.app. We will respond within 30 days. If you are unhappy with the answer you can raise it with the data protection authority where you live.

Children

Rasid is a personal finance tool for adults and is not directed at children. You must be at least 18 to use it. We do not knowingly collect data from children.

If you believe a child has given us personal data, email hello@rasid.app and we will delete the account and its data.

International transfers

Rasid is built and operated from Dubai for users in the UAE, but the services behind it are global. Firebase and our Cloud Functions run on Google Cloud; Anthropic, Sentry and Expo operate their own infrastructure. Your data will therefore be processed outside the UAE, including in the United States.

We hold accounts with these providers under their published data-processing terms and use them only as processors acting on our instructions. If you want to know the current hosting region for your data, email hello@rasid.app and we will tell you.

Changes

If we change what we collect, add a processor, or change what we do with Google user data, we will update this page and change the date at the top. Material changes will be flagged in the app before they take effect. Continuing to use Rasid after that means the updated policy applies.

Contact

hello@rasid.app — privacy questions, deletion requests, data access requests, and anything on this page that looks wrong.

Taimoor Nasir, trading as Rasid, Dubai, United Arab Emirates. Contact: hello@rasid.app.