Privacy policy

• Your data stays on your device

  Your expenses, items, income and investments live in a local database on your phone. We cannot see them.

• No account required

  You use Fibi as a guest. An account is optional; in this version your records stay on your device even if you link one.

• Sentence text may be processed

  If the on-device parser is unsure about a sentence, only that sentence’s text goes to our server (or straight to the provider if you added your own key) to be understood, and it is not stored.

• No ads, no tracking

  We do not sell your data or use it for ads. The app has no analytics or advertising SDKs.

Fibi is developed and published by NSA Teknoloji San. ve Tic. A.Ş. (NSA Teknoloji), the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).

Address: Barış Mahallesi Koşu Yolu Caddesi Arge ve İnovasyon Binası No:26/48 Gebze / Kocaeli

For any question about this policy or your data: info@nsasoft.com.tr

Everything you enter is kept in a local database (SQLite) on your device:

• expenses, payments and installments; recurring payments and subscriptions; income,
• items (name, category, price, current value, quantity, photo, product link), category targets and your “before you buy” checks,
• investments (asset, quantity, trade amounts) and the last market prices read,
• settings: language, theme, modules, tabs, reminders.

This data is not sent to our server; it stays on your device even if you link an account (there is no sync between devices in this version).

Backups

The app takes a local backup on the device every day (the last 7 are kept). If your phone’s own backup is on (Android Auto Backup to Google Drive, iCloud on iOS), the database and these backups are backed up to your Google or Apple account under their terms. JSON or CSV files you share from the app go wherever you choose; a JSON backup includes your item photos.

Fibi does most of its work on your device. In the cases below only the information needed is sent, over an encrypted connection (HTTPS).

Understanding a sentence

A rule-based parser on your device reads what you typed or said first. If it is unsure, the text of the sentence is sent to the Fibi server together with your category names and the language. The server passes it to an AI provider (Google Gemini; Groq if that does not answer) to extract the intent. Only a structured result comes back, such as the amount, the category and the date expression; the amount and the date are still verified by code on your device. The Fibi server does not store this text.

Speech recognition

By default, voice input is turned into text by your device’s speech recognition service (Google on Android, Apple on iOS) under that service’s own privacy terms. When cloud recognition is chosen, the recording is sent through the Fibi server (or directly, with your own key) to a speech recognition provider (Groq, OpenAI or Google Gemini) and is not stored after it is transcribed. Either way, the text is shown to you in a preview before anything is saved.

Your own AI key

Under Settings → Voice and AI you can add your own Google Gemini or Groq key. Sentence understanding and cloud speech recognition then go straight from your phone to that provider; the Fibi server is not involved in these requests and never sees your key. The key is kept only in your phone’s secure storage (iOS Keychain, Android Keystore); it is never written to the database, backups or our server. These requests and their costs fall under the terms of your own account with the provider.

Product links

When you share or paste a product link, the Fibi server opens that page and the product image on your behalf and reads details such as the name, brand and price. If the site blocks the server, the page is opened on your phone in an invisible browser (the site then sees your phone's IP address, like an ordinary visit) and the page's product details and visible text are sent to the server to be read. If details are missing, the visible text of the page may be sent to the AI provider. The link and the page content are not stored on the server.

If you track a product's price, the same reading is repeated when the app opens and every few hours in the background; the price history stays only on your device and the change notification is created on your device.

Market prices

If you use the Investments section, current and past prices are fetched through our server from public sources (Truncgil, Yahoo Finance, CoinGecko, hisse.net, TEFAS); if the server cannot be reached, your phone asks those sources directly. These requests contain only the symbol or fund code being priced (e.g. gram gold, AAPL, TTE); your quantities, amounts and which investments are yours are not sent. The server keeps each instrument's daily closing price; this is not personal data and is not linked to anyone.

Fibi Pro purchases

If you buy Fibi Pro, payment goes through the App Store or Google Play; we never see your card or payment details. To know whether your subscription is active, the app sends a random user ID and the store’s purchase record (product, date, period, store) to RevenueCat, our subscription infrastructure provider. If you link an account, your Fibi account ID takes the place of that ID so Pro also turns on on your other devices. To know which limits apply, our server learns your subscription status (whether you have Pro, its end date, product and store) from RevenueCat and keeps it under that ID; RevenueCat also notifies our server of subscription events (purchase, renewal, cancellation).

To apply the free plan’s limits our server keeps daily usage counters per feature (e.g. how many sentences were parsed or links read today). A counter belongs to your account, or without one to RevenueCat’s random ID, or without that to your IP address; it contains no sentence text, links or financial data and is deleted after 35 days.

Technical logs

Our server and its hosting provider may keep technical logs such as IP address and request time for security and debugging. These logs do not contain sentence text, recordings or financial data.

You can use Fibi without an account. If you like, link a Google or Apple account under Profile → Link account; in this version an account makes Fibi Pro turn on on your other devices too (Android and iOS). We keep no passwords; sign-in goes through Google or Apple. When you link an account:

• Account details: the user ID given by Google or Apple, your e-mail address, your name (if shared) and the date the account was created. With Sign in with Apple, a refresh token is kept so that Apple’s authorization can be revoked when you delete your account. If you remove Fibi’s access in your Apple ID settings or delete your Apple account, Apple notifies us and your Fibi account is deleted together with its data on the server.
• Session: after you sign in, the session key our server issues is kept only in your device’s secure storage (iOS Keychain, Android Keystore); it never goes into the database or backups.
• Your records: your expenses, items, income, investments and other records are not sent to the server; they stay on your device. Sync between devices will come in a later update; when it does we will update this section, and the app will ask you before your records are uploaded for the first time.
• Fibi Pro: your subscription status and daily usage counters are tied to your account (see Fibi Pro purchases).

If you unlink your account, Fibi continues on this device as a guest; your data stays on the device. You can delete your account and your information on the server at any time: Account and data deletion.

Fibi asks for a permission only when you first use the feature that needs it; if you decline, the rest of the app keeps working.

• Microphone and speech recognition: only for voice input.
• Notifications: reminders such as payment days, scheduled on your device. We have no push notification server.
• Photos: to add a photo you pick from your gallery to an item; the picked image is copied into the app’s own folder.

• We do not show ads, and we do not sell or rent your data.
• We do not track you across apps or websites; the app has no analytics or advertising SDKs.
• We send AI providers only the text needed to answer the current request, never all of your records.
• This website uses no cookies and does not track visitors; it only remembers the language you pick with the TR/EN switch in your browser. It serves its fonts itself.

If you added your own key, requests to Google and Groq are made directly from your phone under your account. Some of these providers process data outside Türkiye and the European Union (e.g. in the USA). What is sent is limited to the text or recording needed for that request.

• Data on your device: until you delete it. Deleted records go to the Trash first; you can delete them permanently from there.
• Sentence text, recordings, link content: not kept on the Fibi server once the request is answered. AI providers may keep API data for a limited time under their own terms, to monitor abuse.
• Account details and subscription status: until you delete your account. Then your information on the server and your customer record at RevenueCat are deleted at once; we have no legal obligation to keep any of it. The stores’ (Apple, Google) own purchase records follow their terms.
• Daily usage counters: 35 days.

Under Article 11 of KVKK and the GDPR you have the right to learn whether your data is processed, and to access, correct, delete, port and object to its processing.

Data on your device is already under your control: export it as JSON or CSV, edit it or delete it in the app. For your account and the data on our server, follow the steps on Account and data deletion or write to info@nsasoft.com.tr; we answer within 30 days at the latest.

All traffic between the app and the server is encrypted with HTTPS. AI and speech recognition keys are kept only on the server, never inside the app. The safety of the data on your device also depends on your phone’s screen lock and storage encryption; we recommend using a screen lock.

Fibi is not directed at children under 13 and does not knowingly collect data from them.

When we update this policy we change the date at the top of the page. Important changes to how your data is processed are also announced in the app.

For questions, requests or complaints: info@nsasoft.com.tr. You can also lodge a complaint with your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).