Privacy Policy

1.Who we are

This policy covers the Sarfo service (sarfo.uz): the Sarfo mobile app for Android, the web app at https://sarfo.uz/app and the desktop app. In this policy, “Sarfo”, “we” and “us” mean the operator of that service, and “you” means the person using it.

Sarfo is free. There are no purchases, subscriptions or payments in the app, and no advertising. We are responsible for the personal data described below. For any privacy question or request, contact support@sarfo.uz.

2.Using Sarfo without an account

Sarfo works fully without an account. In that case everything you enter — accounts, transactions, categories, budgets, tags, notes, scheduled payments, savings goals and your settings — is stored only on your device: in the browser’s IndexedDB storage on the web, or in the app’s own storage on your phone or computer. None of it is sent to us, and we have no copy of it.

Because the data exists only on your device, uninstalling the app or clearing the site’s data in your browser deletes it permanently. To keep a copy, export a backup file from Settings → Data. Backup files are created on your device and saved wherever you choose; we never receive them.

3.Passcode and biometrics

You can lock the app with a passcode. The code itself is not stored: the device keeps only a salted hash of it. It is never sent to our server — not even when you are signed in and syncing.

If you unlock with a fingerprint or face recognition, the check is performed by your device’s operating system. The app only learns whether the check succeeded; it never receives, stores or transmits biometric data.

4.If you create an account

An account is optional, and it exists so that your data can reach your other devices. When you create one, we collect and store:

• Your email address, name and password. The password is stored only as a secure hash, never in readable form.
• Your date of birth, country, city and phone number, which we ask for when you register. They are used only to recover your account and keep it secure, are never passed to third parties, and can be changed in your profile at any time.
• Your time zone, interface language and email preferences (payment reminders and announcements — both can be switched off), and whether your email address has been confirmed.
• The devices signed in to your account: the device name the app sends when you sign in, and when each session was last used.

We use this information to run your account: to sign you in, keep your devices in sync, send the emails described below and protect the account against misuse.

5.Signing in with Google

If you choose to sign in with Google, Google shares your name, email address, Google account ID and profile picture URL with us. We use them to create your Sarfo account or sign you in to it; we never receive your Google password. Google sign-in is also covered by Google’s own privacy policy.

6.Sync

Sync happens only while you are signed in. The financial records listed above — accounts, transactions, categories, budgets, tags, notes, scheduled payments, savings goals and settings — are then sent to our server over an encrypted HTTPS (TLS) connection and stored there, so that they can reach your other devices.

Your passcode never syncs, and neither do backup files. Deleting a transaction, a category or a money account (such as cash or a card) in the app also removes it from our server at the next sync. To erase all of your synced data from the server while keeping your Sarfo account, email support@sarfo.uz from the address registered to it.

7.Emails we send

If you have an account, we email you only for these reasons:

• to confirm your email address;
• to reset your password when you ask for it;
• to remind you about an upcoming scheduled payment — optional;
• to announce new features and important changes — optional.

Reminders and announcements can be switched off in your profile at any time. Confirmation and password reset emails are sent only when they are needed to run your account.

8.App updates

The mobile app periodically contacts our server to check whether an update is available. The request contains the app version, the platform and a random install identifier. This identifier is not an advertising ID, and it is used only to deliver updates.

9.Server logs

Like most online services, our servers keep standard technical logs: the IP address a request came from, the time of the request and any errors. We use them for security, abuse prevention and diagnosing problems, and keep them for no longer than 30 days.

10.No ads, no tracking

Sarfo shows no ads. The app contains no analytics or tracking SDKs and does not use advertising identifiers. We do not build a profile of you, we do not sell your data, and we do not share it with anyone for advertising.

11.Service providers

A small number of providers process data on our behalf, and only for the purposes listed here:

• Hosting and infrastructure provider — runs the servers that store account data and synced data.
• Email delivery provider — delivers the emails described above, so it processes your email address and the content of those messages.
• Cloudflare Turnstile — protects the sign-up and password reset forms from bots. It processes your IP address and technical signals from your browser.
• Google — only if you choose to sign in with Google.
• open.er-api.com — the source of exchange rates. The request contains only a currency code and no personal data, but like any web request it reveals your device’s IP address to that provider.
• CoinGecko (api.coingecko.com) and gold-api.com — the sources of cryptocurrency and precious-metal prices. They are asked only when your accounts hold such a currency; the request contains only currency codes, but it too reveals your device’s IP address to those providers.

Beyond these providers, we disclose personal data only where the law requires us to.

12.Why we are allowed to process your data

We process personal data in accordance with the Law of the Republic of Uzbekistan “On Personal Data”: on the basis of the consent you give when you create an account or turn on a feature, and to the extent needed to provide the service you are using. You can withdraw your consent at any time, as described below.

13.Security

We protect your data with measures that match how sensitive it is:

• all traffic between the apps and our server is encrypted with HTTPS (TLS);
• passwords are stored only as hashes, and the passcode never leaves your device;
• access to servers and data is limited to what is needed to operate the service;
• requests are rate-limited to make password guessing and other abuse harder.

No system is perfectly secure, so we also recommend keeping backups of your own and setting a passcode on any device other people use.

14.How long we keep data

Data on your device stays there until you delete it: in the app (Settings → Data → Delete all data), by uninstalling the app, or by clearing the site’s data.

Account data and synced data are kept on our server for as long as your account exists. When you delete your account, its sessions on all devices are signed out immediately and the account can no longer be used; the account and all synced data are permanently erased from our servers within 30 days. Server backups that contain the data are overwritten within a further 30 days.

Server logs are kept for no longer than 30 days. Step-by-step instructions for deleting an account are at https://sarfo.uz/en/delete-account.

15.Your rights

You are in control of your data. In particular, you can:

• Access it — see the data in your account in the app, or ask us for a copy.
• Correct it — change your name, date of birth, country, city, phone number and other details on the profile screen.
• Export it — save all your financial data to a backup file (Settings → Data).
• Delete it — delete your account and its synced data in the app or on the web, and individual records at any time.
• Withdraw consent — for example, switch off reminder and announcement emails, stop syncing by signing out, or delete your account.
• Contact us — write to support@sarfo.uz with any question, request or complaint.

We answer requests within 30 days. To protect your account, we may ask you to write from the email address registered to it. You also have the right to lodge a complaint with the state authority responsible for personal data protection.

16.Children

Sarfo is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account or given us personal data, contact support@sarfo.uz and we will delete it.

17.Changes to this policy

We may update this policy as the service changes. The current version is always published on this page, with the date of the last update at the top. If a change is significant, we will also announce it in the app.

18.Contact

Questions, requests and complaints about privacy: support@sarfo.uz. The service is operated by Sarfo, https://sarfo.uz.