Zimma is a personal finance app built for Pakistani users. We take the privacy of your financial data seriously. This policy explains what we collect, why, and what we do with it.
The short version: your financial data lives on your device first. Cloud backup exists to protect you from data loss, not to monetize your information. We will never sell your data.
Who we are
Zimma ("ذمہ") is operated by Zimma App. When this policy says "we," "us," or "Zimma," it refers to Zimma App and its services, including the Zimma mobile application and the zimma.app website.
What we collect
Account information
When you create a Zimma account, we collect your name and email address. If you sign in with Google or Apple, we receive the profile information those services share (typically name and email).
Financial data you enter
Zimma stores the financial data you choose to enter: transactions, accounts, planning spaces, savings goals, assets, categories, payees, Zakat payment records, and tax-related income.
All financial data is stored locally on your device first. Cloud backup exists for data protection and device migration. It is enabled by default for signed-in users and can be disabled in More. Everyday logging, planning and reports work from local records; sign-in, backup, restore and receipt suggestions need a connection.
Waitlist information
If you join our waitlist, we collect your name and email address to notify you when access is available.
We send optional product news and offers only after you request and confirm email updates. We record your consent and retain unsubscribe and delivery-suppression status to respect your choices. You can request updates or unsubscribe from any marketing email. Resend processes these messages on our behalf.
Automatically collected data
Sign-in and online services process the technical information needed to handle your requests. The production app does not read your SMS messages, contacts or bank apps.
Receipt scanning
Receipt scanning is optional. If you scan or upload a receipt, the text is read from the image on your device; the image itself is not uploaded. That text is sent to our servers, together with the names of your payees, categories and accounts (not your balances), and processed by Google’s Gemini model to suggest draft entries. We do not keep the receipt text after the suggestions are returned. The suggested entries are saved in the app like your other records, so they are included in your cloud backup when backup is on. Nothing is logged as a transaction until you review and approve it.
How we use your data
| Data | Purpose |
|---|---|
| Email and name | Account creation, login, and communication about your account |
| Financial data | Powering the app features you use: tracking, planning, savings goals and reports |
| Receipt text; payee, category and account names | Suggesting draft entries when you scan a receipt; processed by Google Gemini, and the receipt text is not kept |
| Cloud backup data | Protecting against data loss and enabling device migration |
| Technical service information | Operating sign-in and online services |
| Waitlist email | Notifying you when early access opens |
We do not use your financial data for advertising, profiling, or any purpose other than providing Zimma's features to you.
Data storage and security
Your financial data is stored in two places:
- On your device. Financial records are stored locally, so everyday logging, planning and reports work offline.
- In the cloud (optional). While cloud backup is enabled, your financial records are synced to our servers. It is on by default for signed-in users and can be turned off in More. Data is encrypted in transit (TLS) and at rest. Cloud backup enables data recovery if you lose your device or switch to a new one.
Authentication tokens are stored on your device in the app's private storage, protected by the operating system. For more details, see our Data Security page.
Data sharing
We do not sell, rent, or trade your personal or financial data. Period.
We share data only in these limited circumstances:
- Service providers. We use trusted infrastructure providers to host cloud backups, send transactional emails and, when you scan a receipt, suggest draft entries (Google Gemini). They process data on our behalf under strict agreements.
- Legal requirements. We will share data if required by Pakistani law, court order, or regulatory authority with valid jurisdiction.
We do not use any third-party analytics, advertising, or tracking in the Zimma app.
Website cookies
The zimma.app website uses minimal cookies required for basic functionality. We do not use third-party analytics, advertising, or behavioral tracking cookies on the website. If this changes in the future, we will add a cookie notice and update this policy.
Data retention
Your local data remains on your device for as long as the app is installed. The in-app delete-everywhere action removes financial records from the cloud and clears this device, but leaves the authentication account registered. If you stop using Zimma without deleting your account, we retain your cloud data so you can pick up where you left off when you return.
Waitlist emails are retained until you are invited or you ask to be removed.
Data breach notification
If a data breach affects your personal information, we will notify you by email as soon as reasonably possible, along with the steps we are taking in response and what you can do to protect yourself.
Communications
We may send essential account and early-access emails. Optional marketing emails require your confirmed opt-in and include an unsubscribe link. We do not sell your email address; our email delivery provider processes it only to deliver messages on our behalf.
Your rights and control
You have full control over your data:
- Access. All your data is visible within the app at all times.
- Delete. Use the in-app delete-everywhere action to remove financial records from the cloud and this device. Erase device data clears only this device and preserves its cloud backup. Contact us for authentication-account deletion requests.
- Offline use. The production app requires sign-in. After signing in, you can turn off cloud backup and continue logging, planning and reviewing local records offline.
To request data deletion or ask questions about your data, email us at [email protected].
Children
Zimma is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact us at [email protected] and we will delete it. Users between 13 and 18 may use Zimma with parental or guardian consent.
Changes to this policy
If we make material changes to this policy, we will notify you through the app or by email before the changes take effect. Minor clarifications may be made without notice.
Contact
For privacy questions, data requests, or concerns:
- Email: [email protected]
Your financial data is yours. Zimma exists to help you understand and manage it, not to profit from it. That is our commitment.