Privacy Policy

Last updated: 21 September 2026

This policy explains what data the Mosara app (for Android, iPhone and iPad) and the mosara.app website process, why, where it is stored and what choices you have. Mosara is developed by an independent developer (“we”, “us”). For any privacy question, write to support@mosara.app.

1. Using Mosara without an account

Mosara works fully on your device. You do not need to sign up, and your finance data — accounts, operations, categories, budgets, goals, notes and settings — is stored in a database on your device that is encrypted with SQLCipher. The encryption key is generated on the device and kept in the system’s secure storage.

Even without an account, the app makes a few network requests that contain no finance data:

• Exchange rates. About once a day the app downloads reference exchange rates from our server (api.mosara.app). The request contains no account data; like any internet request, it reveals your IP address to Cloudflare, which carries our API traffic, and to our server.
• Fonts. The app downloads its interface fonts from Google Fonts. Google receives the technical data of the request, such as your IP address.
• Purchases. The app starts the RevenueCat purchase service with an anonymous identifier so that it can show and process Premium and optional tips.
• Google Firebase. The app initialises Google Firebase components used for sign-in and, on Android, sync notifications.

Scheduled-operation reminders are local notifications created on your device. Backup files and CSV exports are created on your device and saved wherever you choose; a backup can be protected with a password, a CSV file is plain text.

On Android, Google’s cloud backup of Mosara’s app data is turned off; on some devices, a direct device-to-device transfer may still copy the encrypted database. On iPhone and iPad, the encrypted database may be included in your device backups (iCloud or computer backups), which are controlled by you and Apple.

2. Mosara account (optional)

You need a Mosara account only for Premium cloud sync. Accounts are managed by Google Firebase Authentication. You can sign in with:

• Email and password. Firebase stores your email address and handles your password; we never see your password. We send email-verification and password-reset messages from noreply@mosara.app through Oracle Cloud Email Delivery, which keeps delivery logs that may include your email address.
• Google. Firebase receives your Google account identifier, email address, name and profile photo link. Mosara does not display the name or photo or send them to its own server.
• Apple. Firebase receives your Apple identifier and, if you share them, your name and email address (which may be an Apple private relay address).

Signing in alone does not upload your finance data. When you sign in, your account identifier is also used with RevenueCat so that a Premium subscription belongs to your Mosara account.

3. Premium cloud sync

With an active Premium subscription, the app syncs your data with our server so that the same data is available on every device signed in to your account. Synced data includes your accounts and account groups, categories and tags, operations (dates, amounts, currencies, exchange rates, notes, counterparties and places), budgets, goals, scheduled operations (including their time zone), exchange-rate overrides, and currency and display settings (such as number format and the first day of the week).

• Data is sent over encrypted connections (HTTPS/TLS). Our API is served through Cloudflare.
• Sync is not end-to-end encrypted: our server stores synced data in readable form so that it can deliver it to your other devices. Previous versions of synced records are kept in the sync history while your account exists.
• Our server runs on Oracle Cloud Infrastructure in the EU (Frankfurt region).
• On Android, the app registers a Firebase Cloud Messaging token for your device, used only to signal your devices to sync.
• If Premium ends, sync pauses. Data already synced stays in your account until you delete the account.

4. Purchases

Premium subscriptions and optional tips are bought through Google Play or the App Store, which process the payment. We never receive your card or payment details. RevenueCat manages subscription status for us: it receives your account identifier, your purchase history and the subscription status reported by the store. Our server asks RevenueCat whether your account has an active Premium subscription.

5. Running the service and support requests

• To run your account, sync and Premium, Mosara processes the necessary technical data about account, device and subscription events.
• If you contact support, we process your email address, the text of your message and anything you attach yourself, in order to reply and solve the problem. Third-party email and communication services may be used to deliver and handle messages. Support correspondence is kept separately from account data and is not deleted automatically when you delete your Mosara account; you can ask us to delete your support messages.

6. This website

mosara.app is hosted by Cloudflare. The site sets no cookies and shows no ads. We use Cloudflare Web Analytics to count visits: it records page views together with information such as the page address, referring site, browser and device type and country, without cookies and without identifying you personally. Cloudflare also processes technical request data, such as IP addresses, to deliver and protect the site.

7. Service providers

These providers process data on our behalf to run Mosara and may process it in countries other than yours. We do not sell your data or share it with anyone for advertising.

8. How long data is kept

• On your device: until you uninstall Mosara. Entries you delete in the app are marked as deleted but remain in the encrypted local database and are included in backup files you create. Uninstalling removes the database; on iPhone and iPad, a few secure-storage items (such as the database key and your account identifier) can remain in the system keychain after uninstalling.
• Mosara account and synced data: while your account exists.
• After you delete your account in the app: your synced data, sync history, device registrations and subscription-status records are removed from our database, your Firebase account is deleted, and deletion of your RevenueCat customer record is requested automatically. Without a fixed deletion period, we keep a limited set of technical records needed to complete and confirm the deletion and to run the service securely — such as a deletion record with your account identifier (without your email address or finance data), records of account emails we sent and of cloud data resets, and one-way hashed technical references. Technical records of account and subscription events may also remain with the service providers we use. Support correspondence is not deleted automatically (see section 5). Deletion requests sent by email are handled manually by the developer.
• Server backups: we make daily encrypted backups of our database and store them with a cloud storage provider to recover from failures. Backups are currently kept without a fixed deletion period, so a backup made before you deleted your account can still contain your data. Backups are used only to restore the service; restoring an older backup can bring back data of accounts deleted after that backup was made.

9. Security

• Finance data on your device is encrypted (SQLCipher); you can also lock the app with a PIN or biometrics, which are checked on the device only.
• Backups made in the app can be encrypted with your password (AES-256-GCM). The password cannot be recovered if you forget it.
• Data sent to our server is encrypted in transit (HTTPS/TLS). Server backups are encrypted.

No system is perfectly secure, but we work to protect your data.

10. Your choices and rights

• Use Mosara without an account — your finance data then stays on your device.
• Export your data at any time as a CSV file or a backup file.
• Delete your Mosara account and synced data in the app or by email — see Account deletion.
• Ask us for access to, correction or deletion of your data at support@mosara.app.

Depending on where you live, you may also have the right to complain to your local data protection authority.

11. Children

Mosara is not directed to children under 13, and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy when Mosara changes. The date at the top shows the latest version.

13. Contact

Email support@mosara.app. See also the Terms of Use and the Support page.