Privacy policy

• Your data stays on your device

  Your expenses, items, income and investments live in a local database on your phone. We cannot see them.

• No account required

  You use Fibi as a guest. An account is optional, only if you want the same data on more than one device.

• Sentence text may be processed

  If the on-device parser is unsure about a sentence, only that sentence’s text goes to our server (or straight to the provider if you added your own key) to be understood, and it is not stored.

• No ads, no tracking

  We do not sell your data or use it for ads. The app has no analytics or advertising SDKs.

Fibi is developed and published by Eswact, the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).

For any question about this policy or your data: erensaribay37@gmail.com

Everything you enter is kept in a local database (SQLite) on your device:

• expenses, payments and installments; recurring payments and subscriptions; income,
• items (name, category, price, current value, quantity, photo, product link), category targets and your “before you buy” checks,
• investments (asset, quantity, trade amounts) and the last market prices read,
• settings: language, theme, modules, tabs, reminders.

Unless you link an account, this data is not sent to our server.

Backups

The app takes a local backup on the device every day (the last 7 are kept). If your phone’s own backup is on (Android Auto Backup to Google Drive, iCloud on iOS), the database and these backups are backed up to your Google or Apple account under their terms. JSON or CSV files you share from the app go wherever you choose; a JSON backup includes your item photos.

Fibi does most of its work on your device. In the cases below only the information needed is sent, over an encrypted connection (HTTPS).

Understanding a sentence

A rule-based parser on your device reads what you typed or said first. If it is unsure, the text of the sentence is sent to the Fibi server together with your category names and the language. The server passes it to an AI provider (Google Gemini; Groq if that does not answer) to extract the intent. Only a structured result comes back, such as the amount, the category and the date expression; the amount and the date are still verified by code on your device. The Fibi server does not store this text.

Speech recognition

By default, voice input is turned into text by your device’s speech recognition service (Google on Android, Apple on iOS) under that service’s own privacy terms. When cloud recognition is chosen, the recording is sent through the Fibi server (or directly, with your own key) to a speech recognition provider (Groq, OpenAI or Google Gemini) and is not stored after it is transcribed. Either way, the text is shown to you in a preview before anything is saved.

Your own AI key

Under Settings → Voice and AI you can add your own Google Gemini or Groq key. Sentence understanding and cloud speech recognition then go straight from your phone to that provider; the Fibi server is not involved in these requests and never sees your key. The key is kept only in your phone’s secure storage (iOS Keychain, Android Keystore); it is never written to the database, backups or our server. These requests and their costs fall under the terms of your own account with the provider.

Product links

When you share or paste a product link, the Fibi server opens that page and the product image on your behalf and reads details such as the name, brand and price. If details are missing, the visible text of the page may be sent to the AI provider. The link and the page content are not stored.

Market prices

If you use the Investments section, your phone fetches current prices directly from public sources (Truncgil, Yahoo Finance, CoinGecko, hisse.net). These requests contain only the symbol being priced (e.g. gram gold, AAPL); your quantities and amounts are not sent.

Technical logs

Our server and its hosting provider may keep technical logs such as IP address and request time for security and debugging. These logs do not contain sentence text, recordings or financial data.

You can use Fibi without an account. If you want the same data on more than one device (e.g. a phone and a tablet), link a Google or Apple account under Profile → Link account. We keep no passwords; sign-in goes through Google or Apple. When you link an account:

• Account details: the user ID given by Google or Apple, your e-mail address, your name (if shared) and the date the account was created. With Sign in with Apple, a refresh token is kept so that Apple’s authorization can be revoked when you delete your account.
• Synced data: to keep your devices the same, your expense, payment, item, category, recurring payment, income, investment, target and purchase-check records are stored on the server under your account.
• Not synced: device settings such as theme, tabs, home cards, reminders and the price cache; item photos stay on your device.

If you unlink your account, the data stays on your device as guest data. You can delete your account and your data on the server at any time: Account and data deletion.

Fibi asks for a permission only when you first use the feature that needs it; if you decline, the rest of the app keeps working.

• Microphone and speech recognition: only for voice input.
• Notifications: reminders such as payment days, scheduled on your device. We have no push notification server.
• Photos: to add a photo you pick from your gallery to an item; the picked image is copied into the app’s own folder.
• SMS (Android only, optional): to show bank card-purchase SMS as expense suggestions. The SMS text never leaves your device and is not written to the database; only its ID is marked so the same message is not suggested twice. iOS does not let apps read SMS.

• We do not show ads, and we do not sell or rent your data.
• We do not track you across apps or websites; the app has no analytics or advertising SDKs.
• We send AI providers only the text needed to answer the current request, never all of your records.
• This website uses no cookies and does not track visitors; it only remembers the language you pick with the TR/EN switch in your browser. It serves its fonts itself.

If you added your own key, requests to Google and Groq are made directly from your phone under your account. Some of these providers process data outside Türkiye and the European Union (e.g. in the USA). What is sent is limited to the text or recording needed for that request.

• Data on your device: until you delete it. Deleted records go to the Trash first; you can delete them permanently from there.
• Sentence text, recordings, link content: not kept on the Fibi server once the request is answered. AI providers may keep API data for a limited time under their own terms, to monitor abuse.
• Account and synced data: until you delete your account. Then all of it is deleted at once and completely; we have no legal obligation to keep any of it.

Under Article 11 of KVKK and the GDPR you have the right to learn whether your data is processed, and to access, correct, delete, port and object to its processing.

Data on your device is already under your control: export it as JSON or CSV, edit it or delete it in the app. For your account and the data on our server, follow the steps on Account and data deletion or write to erensaribay37@gmail.com; we answer within 30 days at the latest.

All traffic between the app and the server is encrypted with HTTPS. AI and speech recognition keys are kept only on the server, never inside the app. The safety of the data on your device also depends on your phone’s screen lock and storage encryption; we recommend using a screen lock.

Fibi is not directed at children under 13 and does not knowingly collect data from them.

When we update this policy we change the date at the top of the page. Important changes to how your data is processed are also announced in the app.

For questions, requests or complaints: erensaribay37@gmail.com. You can also lodge a complaint with your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).