Legal

Privacy Policy

Effective October 27, 2026. Last updated October 30, 2026. Covers the Nisabify website at nisabify.com and the Nisabify apps for iPhone, iPad and Android.

The short version

Nisabify always needs an account, on the website and in the iPhone, iPad and Android apps. The one exception is the page where scholars and other reviewers give feedback on the zakah rules: see If you review the zakah rules. You sign in with an email address and a password, with Google, or with Apple.
Your wealth, your giving record and your school of fiqh are stored on Nisabify’s servers in the United States.
Nisabify is for adults 18 and over. The website asks you to confirm you are 18 or over and records the time and the wording version you agreed to. It asks for your date of birth only when you have a retirement account and choose to work out penalty-free withdrawals from your date of birth. Current iPhone and Android apps still check adulthood using a date of birth. They save it only when their wording explicitly says so.
Your school of fiqh is information about your religious belief. We store it only after you agree, and we use it only to work out your zakah.
Your data is not end-to-end encrypted. Nisabify can read what you store, including the names of the recipients you record gifts to.
If you buy a plan or give to a masjid on Nisabify, Stripe takes the payment. Nisabify never receives your full card number.
Ask Nisabify’s answers are written by Anthropic’s AI model, which receives your question. Your figures go with it only when you choose to include them.
No ads, no analytics, no tracking. We do not sell your personal information or share it for advertising.
You can delete your account from inside the website or either app at any time, or email us and we will delete it for you.

1. Who we are

Nisabify is a personal-finance app for Muslims in the United States. It works out an estimate of your zakah under the school of fiqh you choose, helps you give to a charity or to a masjid that has a page on Nisabify, and keeps a record of your giving for your own use and for tax season.

In this policy, “Nisabify”, “we” and “us” mean Mizan FinTech LLC, the operator of the Nisabify website at nisabify.com and the Nisabify apps (app ID tech.mizan.app). For any privacy question or request, email info@mizanfintech.app.

Nisabify was called Mizan until October 4, 2026. Only the name changed: it is the same service, run by the same operator, and your account and records are the same.

2. What we collect

Every way of using Nisabify needs an account, so what we hold is the same whether you use the website or an app, apart from the differences noted below.

Using the website

The website at nisabify.com/app/ opens with a sign-in page, and nothing else in the app is shown until you sign in. To show that page, your browser asks our authentication provider, Supabase, which sign-in options are available.
The website keeps no offline copy of its own files or of answers from Nisabify’s servers in your browser.
Nisabify’s own code sets no cookies and contains no analytics.
As with any website, our hosting provider receives technical information when your browser loads a page, such as your IP address and browser type. See Who processes it.
What the website keeps in your browser, and when it is removed, is described under What stays on your device.

Your account

You can create an account with an email address and a password, on the website and in both apps. You can also sign in with Google or with Apple, on the website and in both apps. Each option appears only once it has been switched on for Nisabify. Your account is identified by a random ID.

Email and password: Nisabify emails a link to your address, from info@mizanfintech.app, and you confirm the address before you can sign in. A password must be at least 8 characters, and Supabase refuses a new password that appears on a list of passwords known to have leaked. Your password goes over an encrypted connection to Supabase, which checks it when you sign in; Nisabify’s website and apps do not save it on your device. If you forget it, you can ask for a reset link, sent to the same address.
Google on the website, iPhone and iPad: Nisabify sends you to its sign-in address, auth.nisabify.com, which Supabase runs, and on to Google’s own sign-in page (on iPhone and iPad, inside a browser sheet). Google may share your email address, your name and your profile picture.
Google on Android: Google’s sign-in sheet on your phone gives Nisabify a Google sign-in token, which normally includes your email address and may include your name and profile picture.
Apple on the website and on Android: Nisabify sends you to auth.nisabify.com and on to Apple’s own sign-in page (on Android, inside a browser tab), and asks Apple for your name and email address. Apple lets you hide your email address behind a private relay address that forwards to you.
Apple on iPhone and iPad: Nisabify uses Sign in with Apple and asks Apple for neither your name nor your email address.

The confirmation and password-reset links open pages on nisabify.com (/auth/confirmed/ and /auth/reset/). Those pages save nothing in your browser. Each takes the sign-in details the link carries off the address bar as soon as it opens, and ends that sign-in once it has done its job. Saving a new password on the reset page also signs your account out everywhere else.

Supabase stores your email address and what it needs to check your password, if you use them, and the identity details your sign-in provider shares, along with the records needed to keep you signed in. If Nisabify has your email address, it shows it to you in Settings as “Signed in as”. Supabase also records, with each signed-in session, the IP address and the user-agent string of the browser or app that signed in. These are erased when you delete your account.

Your age

Nisabify is for adults 18 and over. The website first asks you to confirm "I am 18 or over." You must confirm before continuing. We record the time and the policy wording version you agreed to, without collecting a birth date at this step.

Current iPhone and Android apps ask for a date of birth to check adulthood. If they find you are under 18, the date is not sent and you cannot continue.
For the current phone sign-up path, the server checks the date again and records when you confirmed you are 18 or over. The date is saved only when the phone explicitly tells you it will be saved.
The website asks for a date of birth only when you have a retirement account and choose "Work it out from my date of birth" for penalty-free withdrawals. Your date of birth is saved in your account to value your retirement savings once you can withdraw them without penalty. You can correct it in Settings. It is deleted with your account and is not shared with any provider. Nisabify’s code does not write it to logs. The website and the apps load it from your account and do not keep it on your device.

Your time zone

Nisabify saves the time zone reported by your device so dates in your account follow your own calendar. The website sends it when you finish setup and when you open your account in a different time zone. Your time zone is deleted with your account and is not shared with any provider.

Your school of fiqh (religious-belief information)

To work out your zakah and track your zakah year, Nisabify stores which school of fiqh you follow: Ḥanafī, Mālikī, Shāfiʿī or Ḥanbalī. This is information about your religious belief, and several US state privacy laws treat it as sensitive.

We ask first. On the website and in the iPhone, iPad and Android apps, the setup step where you choose your school asks for your agreement, and you cannot finish setup without ticking it. Nisabify’s database refuses to save your chosen school to your profile, or to mark your setup complete, unless your agreement is on record. When an account is first created, this field holds a default value; that default is a placeholder, not a record of your choice.
Where it appears. Your school is stored on your profile, on each zakah year, and in each saved calculation. Your giving record also shows whether each gift was zakah or sadaqah, which says something about your religious practice.
How it is used. Only to decide which rulings apply to your wealth. Nisabify’s code does not send it to analytics (there are none) and does not write it to logs. It travels only inside encrypted requests, never in a web address.
The record of your agreement. We keep a record of each agreement: what it was for, which version of the wording it refers to, whether you agreed, and the date. In the apps, changing your school in Settings adds a new agreement record under the wording you accepted during setup. On the website it also stores your browser’s user-agent string (the text that names your browser and operating system).
Withdrawing. Today, you withdraw this agreement by deleting your account, which erases your school along with everything else.

Financial information you enter

Nisabify stores on its servers what you enter:

Accounts: the name you give each one, the institution, the type (checking, savings, brokerage, retirement or crypto), details such as Roth or Traditional, and its balances over time.
Other assets: the name you give each one, its kind (gold, silver, cash, business inventory, money owed to you, or other), its weight for gold and silver or its value over time for the rest, and whether an item is for personal use.
Debts: a name, when each is due, and the amount.
Gifts you record: the amount, the date, whether it was zakah or sadaqah, and the recipient’s name if you type one. That is usually an organization, but it can be a person. The apps also store which listed charity it was. If you void a gift in the apps, the reason you type is stored too.
Settings and zakah year: your nisab standard, lunar or solar year, how retirement accounts count, whether you use the daily reference price or your own, the gold and silver prices used with their date and source, and the dates your zakah years start and close.
Calculations: each time Nisabify works out your figure on its servers, it saves a permanent record of the result together with a copy of the inputs: account names, institutions and balances, assets, debts, the amounts and dates of your gifts, and your settings, including your school and time zone. In the apps this happens each time the app works out your figure. On the website it happens when you press Record this figure.

Nisabify can see who you gave to. The recipient names in your giving record are stored in readable form. Nisabify can read them, and a valid legal order could require us to disclose them.

Removing an item is not the same as erasing it. A removed account, asset or debt is archived and keeps its value history. A voided gift stays on file, marked void. A changed balance is saved as a new entry beside the old one. Only deleting your account erases these.

Accounts you connect through Plaid

Connecting an account is optional. It is offered on the website and in the iPhone, iPad and Android apps, for US institutions and balances in US dollars. The connection is made by Plaid. How many institutions you can connect depends on your plan: none on Basic, up to five on Plus, and no fixed limit on Premium.

Before anything connects, Nisabify shows what it will read and asks you to agree. It records your agreement, the version of the wording and the date.
You then sign in to your bank, card, loan or investment provider on a page run by Plaid. On the website your browser leaves Nisabify for that page and returns afterwards; Nisabify’s own pages load no code from Plaid. Your username and password go to Plaid, never to Nisabify.
What Nisabify reads: your account balances; the holdings in your investment and retirement accounts; your debts, meaning what you owe on credit cards and loans and the date the next payment is due; and, only after you agree to Money, transactions in US dollars.
Transactions: the connection includes permission for your transactions. Nisabify reads them only if you have Premium and have agreed to Money.
Nisabify cannot move money. The connection is read-only. Nisabify does not ask for the permissions that payments, transfers or withdrawals need.
What Nisabify keeps. For each institution you connect: its name, Plaid’s references for the connection and its accounts, when it was connected and last read, whether it is working, and the access token Plaid issues for it. That token is stored encrypted on Nisabify’s servers and is never sent to your browser or your phone. For each account: the name the institution gives it and any name you give it, the last two to four letters or digits of its account number when the institution sends them, its type (which you can change between investment and retirement), and its value in US dollars each time it is read. Nisabify values an investment or retirement account from its holdings and keeps the total. A credit card or a loan is kept as a debt, never as something you own, with the amount owed, its kind and the next payment date. An overdrawn bank account, or an investment account worth less than nothing, is kept as a debt due now. An account or transaction that is not in US dollars is skipped. For Money, Nisabify keeps transaction dates, amounts, merchant names and categories; your category corrections, notes, merchant rules and budgets; and daily net-worth records from stored values. Nisabify also keeps a record of each time you start connecting or reconnecting: when, whether from the website, the iPhone and iPad app or the Android app, and what it came to.
What Nisabify sends Plaid: your Nisabify account’s random ID, not your name or email address. Plaid collects and keeps its own information about you and your accounts under its End User Privacy Policy.
When it is read: when you connect; when you open your Wealth page and the last reading is more than 12 hours old; when you choose Update now on the website; and when Plaid tells Nisabify that something changed or that a connection needs your attention. Transaction changes are read only after you agree to Money. Money reports use stored transactions and values. A daily net-worth record uses the latest stored values, which may be out of date.
Disconnecting: each connected institution has a Disconnect button on the Wealth page. It ends the connection at Plaid and removes that institution’s accounts and debts from your wealth figures and stops new reads. On the website, disconnecting also erases that institution’s imported transactions and balance history. In the apps, transactions already read stay for up to 25 months from their dates, or 13 months if you have not accepted the updated Money terms. Accounts and debts are archived with their value history, like anything else you remove, until you delete your account. Deleting your account disconnects every institution first.

If you buy a plan

Your plan, monthly or yearly billing, its status and renewal date, whether you have used the first-year offer, and Stripe’s references for your customer record and subscription. Stripe collects your card and billing details on its own page under its own privacy policy. We receive records of the payment events Stripe sends us, and keep them so that each is handled once. If a renewal payment fails, we email you.

If you give to a masjid on Nisabify

The masjid, the amount, whether it is zakah, sadaqah or a general gift, any amount you added towards the card fee, the gift’s status and Stripe’s references for the payment. If you are signed in, the gift is added to your Records. The payment is made in the masjid’s own Stripe account, so the masjid and Stripe receive the details Stripe collects at checkout, such as your name, email address and card details as Stripe shows them to a seller.

If you save a card for masjid round-ups

Stripe stores the card. We keep Stripe’s references for it and its brand, last four digits and expiry date, so that we can show you which card is saved. For each monthly charge, a copy of the card is created in the masjid’s own Stripe account and charged there. If a charge fails, we email you.

If you join or run a masjid’s page

If you join a masjid, we keep which masjid you joined and when. The masjid’s administrator sees counts and totals only, never your identity, your wealth or your individual gifts.

If you run a masjid’s page, we keep the masjid’s name, page address, message and contact email, its employer identification number, its confirmation of tax-exempt status, whether it accepts zakah, and the status of its Stripe account. The details Stripe asks for during onboarding, such as the authorised person’s identity and the masjid’s bank account, go to Stripe directly.

If you use round-ups

Your choices, the purchases each round-up came from, your monthly totals and collections, and references for the notices we send you. Turning round-ups off removes amounts not yet collected; your collection history stays. If you give through Every.org, the charity, the amount, a gift reference and whether you count it as zakah are sent to Every.org for its checkout.

If you use Ask Nisabify

Your questions and the answers, until you delete the conversation or your account, and a count of the questions you have asked this month. Deleting a conversation does not reset the count. To answer, Nisabify sends Anthropic your question, the recent conversation, Nisabify’s rules and your school of fiqh, and your current figures only when you choose “Include my numbers”. We identify you to Anthropic by a scrambled form of your account’s random ID, never by your name or email address.

Reminders

Your reminder settings, a record of each reminder sent, and, on a phone where you allow notifications, the token needed to deliver them, the kind of phone and the app version. Reminder messages contain no balances, amounts or school of fiqh.

What stays on your device

Website: your browser’s local storage, which Nisabify does not encrypt, keeps your sign-in session: the tokens, and the account details Supabase returns when you sign in, including your email address and any name, profile-picture link or account identifier your sign-in provider shared. It also keeps your choice of system, light or dark theme; while a change is being saved, a random reference for it, so that a retried save is not counted twice, removed once it is saved; and a short note while a sign-in check is in progress. While you sign in with Google or Apple, the tab keeps a one-time security code, removed when you come back. While you connect an account, the tab keeps a note of the connection you started, including Plaid’s temporary connection token, removed when Nisabify learns what the connection came to and ignored after four hours. Your accounts, balances, gifts and settings are not kept in the browser: the website loads them from your account. Signing out removes the session. An earlier version of the website kept a copy of your whole record in the browser; if you used it, clearing that browser’s site data for nisabify.com removes any copy it left.
iPhone and iPad: the app keeps your sign-in session (tokens, your account ID and your email address, if Nisabify has one) in the iOS Keychain. The item stays on this device: it is not synced to iCloud and does not move to a new device. Deleting the app does not necessarily remove this item; sign out first if you want it gone. The app does not write your financial data to files of its own; it loads it from your account. iOS may keep a temporary cache of recent responses from Nisabify’s servers inside the app’s own storage, which is removed when you delete the app.
Android: the app keeps your sign-in session (tokens, your account ID and your email address, if Nisabify has one) in encrypted storage. Cloud backup of the app’s data is turned off. The app does not save your financial data to its own storage.

When you email us

If you write to info@mizanfintech.app, we receive your email address and whatever you include in your message. Please never send bank logins, passwords or account numbers.

Family plans

No financial data crosses between household members. The owner sees each member's and invitee's email address, status and joined date, and the household's total connection count. A member sees the owner's email address and the same count. Nothing else.

If you join a waitlist

If you join the Family waitlist on the website, we keep your email address, the plan you chose and when you joined. Nothing else: no name, no account, and it is not linked to an account if you have one. We use it only to email you about that plan’s launch and its founding price. To be removed, email info@mizanfintech.app.

If you ask on the website to be told when Nisabify opens, we keep your email address and when you asked, in the same way and with nothing else. We use it only to send you that one email. To be removed, email info@mizanfintech.app.

If you review the zakah rules

Anyone with the link to the rules review page can use it without an account. Your answers stay in your browser until you press Send. When you press Send, we store the name you choose to give (it is optional), the option you chose for each rule, your notes and when you sent them, and we email them to the team’s mailbox, info@mizanfintech.app (a Google Workspace mailbox), so that the team can read your feedback. To accept a later correction from you and to limit abuse, we keep a fingerprint of the random code your browser makes for your review and a fingerprint of your network address, never the address itself. If we sent you a personal invitation link, your answers are also saved as you go so that you can continue on another device; we store only a fingerprint of that link, never the link itself. To have your answers and the emailed copy removed, email info@mizanfintech.app.

What we do not collect

Your location, contacts, photos, or access to your camera or microphone.
Advertising identifiers or device identifiers. A phone’s notification token is kept only if you allow notifications (see Reminders).
Your full account numbers or bank login.

3. How we use it

To work out your zakah estimate under the school and settings you chose, and to show how each figure was reached.
To track your zakah year, keep your giving record, and keep your data in step across your devices.
To show the balances, holdings and debts of accounts you connected and, after you agree to Money, income, spending, budgets, categories and net worth over time.
To keep a fixed record of each calculation, so a figure you acted on can be reproduced later.
To record the agreements you give us.
To check that you are 18 or over, and to record that you confirmed it.
To sign you in, keep your account secure and run the service.
To send you emails about your account: the link that confirms your address, and a password-reset link when you ask for one; the reminders you have chosen; and a notice when a plan renewal or a round-up card charge fails.
To take payments for plans and gifts through Stripe, apply the plan you bought, and collect the round-ups you chose.
To answer your questions in Ask Nisabify.
To answer you when you contact us.
If you joined a waitlist, to email you about that plan’s launch. If you asked to be told when Nisabify opens, to send you that email.
To comply with the law, including a valid legal order.

We do not use your information for advertising. Money categorises transactions automatically using Plaid categories and your merchant rules; you can correct a category. The only marketing email we send is the launch email to people who joined a waitlist. The figures Nisabify shows are estimates for you to act on; Nisabify makes no decisions about you.

4. What we do not do

We do not sell your personal information, and we do not share it for targeted advertising.
No ads, analytics or tracking. Nisabify’s website and apps contain no advertising, analytics, tracking or crash-reporting code, and send nothing to advertising networks or data brokers. Nisabify’s pages load no outside code. To connect an account your browser goes to a page run by Plaid, and to pay, to a page run by Stripe or Every.org; each handles what you enter there under its own privacy policy.
We never hold your money. A gift to a charity is made on the charity’s own website or through Every.org. A gift to a masjid on Nisabify is paid through Stripe straight into the masjid’s own Stripe account. Nisabify takes no share of any gift. When Nisabify opens a charity’s own website, it adds nothing to the link: no amount, no ID, and on the website no referring address. Recording a gift yourself only saves your own note of it in Nisabify.
We cannot move money from your bank. Nisabify does not request the permission that would allow it. Card charges you choose, for a plan or for masjid round-ups, are made by Stripe.

5. Who processes it

These companies process information for us so that Nisabify can run:

Supabase: Our database, sign-in and server functions, in the United States (US East region). Everything stored with your account is held here. Like our other providers, Supabase keeps technical logs of requests, which can include your IP address.
metals.dev (Droid Infinity) and MetalpriceAPI: Supply the daily gold and silver reference prices to our servers. We use metals.dev by default and keep MetalpriceAPI as an alternative. We send the currency, the unit or metal symbols, and our service credential. We send nothing from your account, your holdings or your calculations, and the request comes from our server, never from your device.
Plaid: Connecting accounts, only if you use it. See Accounts you connect through Plaid. What you enter on Plaid’s page, and what Plaid collects from your institution, is handled by Plaid under its own End User Privacy Policy.
Stripe, Inc.: Takes payments for plans, stores saved cards, and runs checkout for gifts to masjids, which are paid into each masjid’s own Stripe account. Stripe handles what you enter on its pages under its own privacy policy.
Every.org: Runs checkout for gifts to charities, including round-ups, only when you choose to give through it. It receives the charity, the amount, a gift reference and whether you count the gift as zakah, and tells us whether the gift was completed.
Anthropic, PBC: Writes Ask Nisabify’s answers. It receives what is described under If you use Ask Nisabify. Anthropic says it deletes these within 30 days, keeps them for up to 2 years if its safety systems flag a conversation, and keeps them longer where the law requires.
Apple and Google push services: Deliver reminder notifications to iPhone and iPad (Apple Push Notification service) and to Android phones (Firebase Cloud Messaging, from Google). They receive the notification token and the message.
Apple and Google: Whichever one you choose to sign in with: Google or Apple, on the website and in both apps.
Cloudflare: Hosts the website and receives standard request information, such as your IP address and browser type, when your browser loads it. Your browser may also send Cloudflare reports about network errors.
Google Workspace: Sends Nisabify’s emails (the link that confirms your address, password-reset links, reminders, and notices about failed payments and round-up charges) from info@mizanfintech.app, and delivers email sent to that address.

Charity websites, the IRS and ProPublica receive a visit only when you open one of their links, and they receive only what any website receives from a visitor.

Masjids you give to or join on Nisabify are not our service providers. Each receives what is described in section 2 and handles it under its own policies.

We may also disclose information when the law requires it, for example in response to a valid legal order. If Nisabify is ever transferred to a new owner, your information would move only under this policy, and we would tell you before any different terms applied.

6. How long we keep it

Your account data (sign-in details, profile, your date of birth, your time zone, the confirmation time, policy wording version and record that you confirmed you are 18 or over, school, settings, agreements, accounts, assets, debts, balance history, zakah years, gifts and calculations) is kept until you delete your account. Money transactions and their category corrections and notes stay for up to 25 months from their dates; budgets stay for 13 calendar months, counted from their budget month; net-worth records stay for 25 months. Transactions, their corrections and notes, and net-worth records stay for up to 13 months if you have not accepted the updated Money terms. Merchant rules stay until you remove them or delete your account. Disconnecting in the apps stops new reads without erasing these retained Money records; disconnecting on the website also erases that institution’s imported transactions and balance history.
Plans, payments, gifts to masjids, saved-card references, round-ups, Ask Nisabify conversations and reminder settings are kept until you delete your account, except that you can delete an Ask Nisabify conversation yourself. Stripe, Every.org and the masjids you gave to keep their own payment records under their own policies and legal duties; deleting your Nisabify account does not delete those.
Reviewers’ answers (the optional name, choices and notes on the rules review page, and the copy emailed to the team) are kept for 12 months after the review closes, then deleted.
Your sign-in session in your browser is removed when you sign out there or delete your account there. What else the browser keeps, and for how long, is listed under What stays on your device.
After you delete your account, we keep a record that the deletion was requested and completed: your account’s random ID and the dates and, only if something could not yet be ended at Plaid or Stripe, that provider’s reference for it, kept so that it can be closed. It contains no name, email address, card details or financial data. We keep it to show that the deletion happened.
Plaid’s records (only if you connected an account) are kept by Plaid under its own privacy policy. Disconnecting an institution, or deleting your Nisabify account, ends Nisabify’s access to it; it does not delete what Plaid holds. Plaid’s privacy policy says how to ask Plaid for that.
Backups. Deleted data can remain in our database provider’s backups until those backups expire. We have not yet confirmed the length of that window. We will state it here once we have.
Service providers’ logs are kept under each provider’s own retention rules.
Emails you send us are kept as long as we need them to deal with your request.
Waitlist sign-ups are kept until the plan launches and we have emailed you, or until you ask us to remove them, whichever comes first. A request to be told when Nisabify opens is kept the same way: until we have sent that email, or until you ask us to remove it.

7. Deleting your account

You can delete your account yourself while signed in:

Website: Settings → Your account → Delete account. If the website shows an error, email us and we will delete the account for you.
iPhone and iPad: Settings → Your account → Delete account.
Android: Settings → Your account → Delete account.
At the age question: if Nisabify stops you because you are under 18, it offers Delete my account on the website and in both apps.

When you confirm, Nisabify first asks Plaid to end every connection you made, and asks Stripe to cancel any paid plan at once and remove the cards saved for Nisabify, including their copies in masjids’ Stripe accounts. Anything that cannot be ended straight away is retried until it is. If a bank connection could not be ended, email us and we will have it closed. Nisabify then erases your sign-in record (including your email address and password, if you used them) and everything attached to your account: your profile and school, your date of birth, your time zone, the confirmation time, policy wording version and record that you confirmed your age, settings, agreements, accounts, assets, debts, balance history, zakah years, gifts and voids, calculations, and the records of your connected accounts, including the stored access tokens; Money transactions, category corrections, notes, merchant rules, budgets and net-worth records; your plan, round-ups, masjid membership, Ask Nisabify conversations, reminder settings and phone notification tokens. This cannot be undone. A masjid page you run stays, without you as its administrator. The website and the apps then sign you out and remove the session from your device.

What remains afterwards is listed under How long we keep it: the deletion record, Plaid’s records if you connected an account, the payment records Stripe, Every.org and masjids keep, a sign-in session in any other browser where you were signed in, which no longer works, service providers’ logs under their own retention rules, and backups until they expire. Removing the app from your device does not delete your account. If you signed in with Apple, Nisabify does not yet withdraw its access at Apple when you delete your account; you can remove Nisabify from the list of apps using Sign in with Apple in your Apple ID settings.

If you cannot sign in, or the deletion does not finish, email info@mizanfintech.app and we will delete the account for you after confirming that it is yours. If you signed in with Apple, Nisabify may hold no email address for you, so we may not be able to confirm the account from an email alone; delete it from inside the app whenever you can.

8. Security

Every connection the website and the apps make to Nisabify’s servers is encrypted (HTTPS).
The database lets each person read and change only their own records. Internal records are not reachable from the internet, and Nisabify’s server functions refuse any request without a valid sign-in. The exceptions are the waitlist form on the home page, the rules review page, public masjid pages and their gift checkout, the unsubscribe link in reminder emails, Nisabify’s own scheduled jobs, which need a secret key, and the notices Plaid, Stripe and Every.org send, which are accepted only when they prove they come from that service.
Gifts, agreements and calculations cannot be edited after they are saved. Mistakes are corrected by adding a new entry, so your record cannot be changed silently.
The iPhone and iPad app keeps your session in the iOS Keychain. The Android app keeps it in encrypted storage. The website keeps it in your browser’s local storage, which Nisabify does not encrypt, so protect the device, and sign out when you finish on a shared computer.
Your bank login and full card number never reach Nisabify, and Nisabify holds no permission to move money from your bank.

Your data is not end-to-end encrypted: Nisabify can access what is stored on its servers. No system is perfectly secure. If you find a security problem, please tell us at info@mizanfintech.app.

9. Children

Nisabify is for adults: our Terms require you to be at least 18 to use it. Nisabify is not directed to children, and we do not knowingly collect personal information from children under 13. Once you have signed in, the website requires you to confirm you are 18 or over. Current phone builds ask for your date of birth to check adulthood and do not let anyone under 18 continue. See Your age. If you believe someone under 18 has given us personal information, email us and we will delete it.

10. Your rights

Things you can do yourself

Get a copy. On the website, Download my data (Settings → Account) downloads everything in your account, and Export CSV (Records) downloads your giving record. In the apps, Export CSV on the Records tab shares your giving record. You can also email us.
Correct it. Edit your accounts, assets, debts and settings in the app. A gift is corrected by voiding it and recording it again.
Delete it. Delete your account as described in Deleting your account.
Withdraw your agreement to Nisabify storing your school by deleting your account.
Disconnect an institution with its Disconnect button on the Wealth page. Deleting your account disconnects every institution. You can also email us.

US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws may have the right to:

know what personal information we collect, use and disclose, and get a copy of it;
correct information that is wrong;
delete it;
receive it in a portable format;
opt out of the sale or sharing of personal information, targeted advertising and profiling (we do not sell or share your information or use it for advertising; Money sorts your own transactions into categories automatically, which you can correct, and makes no decisions about you);
limit the use of sensitive personal information (we use your school of fiqh only to provide the service you asked for); and
not be treated differently for using these rights.

We honour these requests from anyone in the United States, whether or not their state’s law applies to us. Email info@mizanfintech.app. We may ask for information to confirm the request comes from you, and we will not ask for more than we need. You may use an authorized agent, and we may ask for proof that the agent acts for you. We will respond within 45 days. If we need longer, we will tell you why, and we will not take more than another 45 days. If we turn down your request, you can ask us to reconsider by replying to our answer; if you are still unsatisfied, you can contact your state attorney general.

Because Nisabify does not sell or share personal information or track you across websites, it behaves the same whether or not your browser sends a Global Privacy Control or Do Not Track signal. We do not disclose personal information to third parties for their own direct marketing.

Categories of personal information

Identifiers: Your account’s random ID; your email address, if you sign up with it or your sign-in provider shares it; and your sign-in identity. From you, and from Google or Apple if you sign in with them. Processed by Supabase; by Google Workspace for the emails Nisabify sends you; by Plaid, which receives your account’s random ID if you connect an account; by Stripe, which holds your customer record if you pay; and by Anthropic, which receives a scrambled form of your account’s random ID if you use Ask Nisabify.
Account log-in details: Your password, if you sign in with an email address. From you. Processed by Supabase, only to check it when you choose it and when you sign in.
Age: Your adult confirmation, its time and the policy wording version, and your date of birth if supplied for retirement valuation. From you. The website collects a birth date only for a retirement account using age to work out penalty-free withdrawals. Current phone builds also check adulthood using a birth date; they save it only with explicit wording. You can correct your date of birth in Settings. It is deleted with your account and is not shared with any provider. Account storage is processed by Supabase.
Time zone: Your device’s time zone. From your device, so dates in your account follow your own calendar. It is deleted with your account and is not shared with any provider. Account storage is processed by Supabase.
Sensitive personal information: religious beliefs: Your school of fiqh, and whether your gifts were zakah or sadaqah. From you, after you agree. Processed by Supabase; by Anthropic, which receives your school when you use Ask Nisabify; and by Every.org, which receives whether a gift through it is zakah.
Financial information: The accounts, balances, assets, debts, gifts and calculations described above. From you, and from Plaid if you connect an account. Processed by Supabase; by Plaid for connected accounts; and by Anthropic when you include your figures in Ask Nisabify.
Commercial information: The plan you bought and its payments, gifts you made to masjids on Nisabify, round-up collections, and the brand, last four digits and expiry of a card you saved. From you and from Stripe and Every.org. Processed by Supabase, Stripe and Every.org; gifts to a masjid also go to that masjid.
Internet and device information: Your browser’s user-agent string, stored with the agreements you give on the website; the IP address and user-agent string Supabase records with each signed-in session; and the IP address and browser details our providers receive when you connect. Processed by Supabase and Cloudflare.

None of these categories is sold or shared for advertising.

11. Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change affects how we use information you have already given us, we will tell you in the app or on the website before it takes effect, and ask for your agreement again where the law requires it.

12. Contact us

For any question about this policy or your information, or to make a request, email info@mizanfintech.app.