Privacy Policy
Version 1.2 — 15 October 2026
1. What Riyaly is
Riyaly is an app for keeping track of money you have already committed: subscriptions, loan instalments, savings goals and income.
Riyaly does not connect to your bank. It has no access to any account, card or payment method. It cannot see your balance, and it cannot move money. Every figure in the app is one you typed in yourself.
That is the single most important thing on this page, and it is the reason most of the rest of it is short.
2. Who is responsible for your information
Manwal Alraqamiya Company Holding (شركة منوال الرقمية القابضة), a Saudi limited liability company, Commercial Registration 7055338847, of Building 8568, Street 221, Al Narjis District, Riyadh 13323, Kingdom of Saudi Arabia (National Address RANA8568), is the controller of the personal data described here. Riyaly is its product.
Until version 1.2 of this policy the controller was Asim Alatni, who founded Riyaly and owns the company. Riyaly has moved to the company; your data has not. It is stored in the same place, seen by the same people, and used for the same purposes described here.
Questions about this policy, or about your own data: help@manwal.io, or through Settings → Support in the app.
3. What we collect
What you give us
| What | Why | Required? |
|---|---|---|
| Mobile number | It is how you sign in. We do not use it for marketing. | Yes |
| Name | So the app can address you | No — you can leave it blank |
| Email address | Only if you choose to add one | No |
| Your monthly income | To work out what is left after your commitments | No — the app works without it, and says less |
| Subscriptions, loans, goals, payments | This is the service. It is what you came to record. | You choose what to enter |
| Support messages | So we can answer you | Only if you write to us |
What the app records by itself
| What | Why |
|---|---|
| When you mark something paid | So the history and the totals are right |
| Crash reports and error diagnostics | So we can fix what breaks. Collected by Firebase Crashlytics. |
| A device notification token | So reminders can reach your phone. Removed when you sign out. |
We do not collect your location, your contacts, your photos, your calendar, or anything from other apps on your device. We do not use advertising identifiers, and there is no advertising in Riyaly.
4. Why we use it, and on what basis
| Purpose | Basis under the PDPL |
|---|---|
| Running the app you signed up for | Performance of our agreement with you |
| Signing you in and keeping the account secure | Performance of our agreement, and our legitimate interest in preventing abuse |
| Payment reminders and notifications | Your consent. Turn them off in Settings at any time. |
| Fixing crashes and faults | Our legitimate interest in the app working |
| Group-level statistics (§6) | Our legitimate interest in knowing what to build |
| Answering your support messages | Performance of our agreement with you |
We do not sell your personal data, and we do not share individual records with anyone for their own purposes.
5. Who can see it
You can. Everything in your account is yours to read, change and delete from inside the app.
A small number of named staff can, when there is a reason to. Support needs to look at an account to answer a question about it. Every such access is recorded with the person's name, the account, the time and a written reason. Those records cannot be edited or deleted by the person who made them.
Nobody else at Riyaly can see individual accounts at all. Staff working on the product see only the group-level figures described in §6, in which individual rows carry no name, no phone number, no email and no amounts.
Google can, as our infrastructure provider. See §7.
Law enforcement or a regulator can, if the law requires it. We will tell you if that happens, unless we are legally prohibited from doing so.
6. Group-level information
We look at questions like "how many people track at least one loan" or "which subscription services are most common". These help us decide what to build.
Two safeguards apply and are built into the system rather than promised:
- Any figure covering fewer than 20 people is withheld rather than reported. A number describing a group of three can identify those three.
- Rows in these tables are not linked to accounts. Each row carries a reference derived from your account through a one-way cryptographic function using a secret key held only on our servers. An exported table cannot be matched back to accounts by anyone who obtains it.
A possible future use, disclosed now rather than later. We may in future share or license this group-level information — never individual records — with third parties such as financial institutions or open-banking providers. If we do, it will be information of the kind described above: about groups, subject to the same minimum-size rule, and containing nothing that identifies you.
We are telling you now because doing it later without having said so first would not be fair to you. We may never do it at all.
7. Where your information is kept
Stored in Saudi Arabia. Your records are held in Google Cloud's Dammam
region (me-central2). At rest, your data does not leave the Kingdom.
Processed in Qatar. The server code that reads and writes those records
runs in Google Cloud's Doha region (me-central1). When you open the app, your
request is handled there and the answer is sent back to you. This is a transfer
of personal data outside the Kingdom within the meaning of the PDPL, and we
would rather tell you about it than let you find it out.
What it does and does not mean:
- The transfer is processing only. Your records stay stored in the Kingdom. The Doha region keeps no copy beyond the moment it answers your request.
- It is necessary to deliver the service you asked for — without it the app cannot read or write anything.
- Google Cloud is our processor for this, acting on our instructions under its own data-processing terms, which carry contractual protections for data handled outside its country of origin.
We intend to move this processing into the Kingdom so that the transfer stops happening at all. This section will be updated when it does.
Our infrastructure provider is Google. Firebase and Google Cloud provide authentication, storage, server code, notifications and crash reporting. Google processes this data on our instructions under its own data-processing terms. We have no other sub-processors.
8. How it is protected
- Your records are reachable only through our own server code, which checks on every request that you are asking for your own data. There is no direct database access from the app or the browser.
- Staff access is controlled by named permissions checked on every request, so removing someone's access takes effect immediately rather than whenever their session next expires.
- The two actions that can do the most damage — changing who has access, and erasing a person's records — additionally require a second factor from an authenticator app, re-entered for each sign-in.
- Every privileged access to an individual account is recorded, with a reason.
- Data is encrypted in transit and at rest by our infrastructure provider.
- Backups run daily and weekly, with point-in-time recovery covering the last seven days.
Stated plainly, because it is true today: the app's abuse-prevention layer (App Check) is not yet enabled. It is planned before general release, and this paragraph will be removed only when it is actually in place.
No system is perfectly secure, and we will not claim otherwise.
9. How long we keep it
| What | How long |
|---|---|
| Your account and everything in it | Until you delete it |
| After you ask us to delete your account | 30 days, then permanently deleted. You can cancel during those 30 days. |
| Backups | Deleted copies persist in backups for up to 84 days, then age out |
| Records of staff access to accounts | 24 months |
| Crash reports | As long as Firebase Crashlytics retains them (currently 90 days) |
What "delete my account" actually removes: your profile, every subscription, loan, goal, income source and payment record, every support message you sent, and your sign-in credentials. It is not recoverable afterwards, including by us.
What survives: records that you asked us to delete your account, and records of any staff access to it. These describe our own actions rather than you, and deleting them would defeat the purpose of keeping them.
10. Your rights
Under the Personal Data Protection Law you may ask us to:
- tell you what we hold about you
- give you a copy in a readable format
- correct anything wrong
- delete your account and its contents
- stop sending you notifications — Settings, immediately, no request needed
- explain how your data was processed
Deleting your account and correcting your details are things you can do yourself, from inside the app, without asking us. For a copy of your data, write to us and we will put it together for you.
Ask through Settings → Support, or at help@manwal.io. We will respond within the period the law requires. We will not charge you, and we will not treat you differently for asking.
If you are not satisfied with our answer, you may complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).
11. Children
Riyaly is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has an account, contact us and we will remove it.
12. Changes
If we change this policy in a way that affects you, we will tell you in the app before the change takes effect — not by quietly updating this page. The version and date are at the top.
13. Contact
help@manwal.io · Settings → Support in the app
Building 8568, Street 221, Al Narjis District, Riyadh 13323 Kingdom of Saudi Arabia · National Address RANA8568