ZayKaf is owned and operated by iEdrak LLC, a limited liability company registered in the State of Delaware, United States of America. This Privacy Policy applies to all users of the app in every country where it is published. It is intended to align with the highest global data protection standard (the EU General Data Protection Regulation, GDPR), supplemented by region-specific disclosures in Section 14.
ZayKaf operates entirely offline. The app contains no server-side code, no analytics service, no advertising network, and no third-party tracking tool of any kind.
In practical terms, this means:
This provides a high level of privacy because your data remains on your device. At the same time, we recognize that the app handles sensitive content (bank notifications), and we are committed to full, honest disclosure of everything the app accesses — even though that data never leaves your device.
Description: Text of notifications received from registered bank apps/senders on your device.
Purpose: To extract transaction details (amount, transaction type, bank name) and categorize them automatically.
Description: Amounts, transaction dates, expense/deposit category, sending bank name.
Purpose: To display monthly summaries and organize a financial record within the app.
Description: If you enable PIN lock, it is stored as a hash using the PBKDF2 algorithm.
Purpose: To protect app access without storing the actual code anywhere.
The app does not access: contacts, location, photos, other files on your device, or call logs. To detect bank messages, the app reads the content of notifications on your device and checks each one on-device; notifications from non-banking apps are examined only transiently in memory and are never stored or transmitted.
We process your data based on:
All data is stored locally on your device only, using:
The app performs no automatic cloud backup, and it disables Android's automatic backup
(allowBackup is turned off), so the operating system does not copy the app's data off
your device either. The only way your data leaves the device is if you deliberately use the in-app
Export feature and share the resulting file yourself.
For full clarity, ZayKaf does not:
The app uses Android's NotificationListenerService to read the content of notifications and filter them on-device for bank messages; only messages identified as bank transactions are stored. This permission requires your explicit, manual approval in system settings, and you can revoke it at any time from your device settings, which immediately stops the app from reading any new notifications.
The Notification Access permission is the core functionality of the application. Without this permission, the application cannot automatically detect and categorize banking transactions.
If Notification Access is revoked, the app immediately stops processing new bank notifications while preserving previously stored local data. Your existing transaction history remains fully accessible within the app and is not deleted as a result of revoking this permission.
The application accesses notification content solely through the officially granted Android Notification Access permission, and does not read data through any other means or from unauthorized sources.
As the sole owner of your data, you can at any time, from within the app:
Your data remains on your device until you personally delete it from within the app, or uninstall the app entirely. As the developer, we do not retain any copy of your data anywhere else, because it never reaches us in the first place.
This app is intended for users aged 18 and older only, given its financial nature. We do not knowingly collect data from any user under this age, and we do not provide mechanisms designed for minors. If we become aware that an underage user is using the app, we recommend it be uninstalled immediately by a parent or guardian.
We may update this Privacy Policy from time to time to reflect changes in the app or legal requirements. Any update will be published on this page, with the "Last updated" date above revised accordingly. Continued use of the app after an update is published constitutes acceptance of the revised policy.
For any question about this policy or your data, you can reach us at:
Email: support@zaykaf.com
Since ZayKaf is published in multiple countries, this section outlines the additional rights available to you under your local legislation, on top of the general rights described in Section 8 above.
Saudi Arabia — Personal Data Protection Law (PDPL), enforced by the Saudi Data & Artificial Intelligence Authority (SDAIA), grants you the right to: access your data, correct it, delete it, withdraw consent, and obtain a copy of it.
UAE — Federal Personal Data Protection Law, Bahrain — Personal Data Protection Law, Qatar — Law No. 13 of 2016, and Oman — Personal Data Protection Law: all grant similar rights including access, correction, deletion, and the right to object to processing.
Kuwait: currently has no comprehensive dedicated data protection law; we apply to you the same voluntary global protection standard described in this policy (see Category C below).
This includes Iraq, Lebanon, Libya, Yemen, Sudan, Syria, Somalia, Palestine, Mauritania, Djibouti, and the Comoros, as well as Kuwait from the Gulf category above. In these cases, regardless of the absence of dedicated local legislation, we voluntarily commit to applying the same higher protection standard set out in this policy to all our users everywhere, including the same "we don't collect, we don't transfer" principle, and your full right to access, edit, and delete your data as detailed in Section 8.
If you are located in the European Economic Area or the United Kingdom, these regulations grant you additional rights including: the right to data portability, the right to lodge a complaint with your local data protection authority, and the right to know the precise legal basis for each processing activity (detailed in Section 4). Since the app never collects your data on any server in the first place, there is no "international data transfer" subject to the transfer mechanisms set out in Article 44 et seq. of the GDPR.
If you are a California resident, the California Consumer Privacy Act (CCPA) and its amendment (CPRA) grant you the right to know whether your data is sold or shared (we never do either), the right to request deletion of your data, and the right not to be discriminated against for exercising these rights.
The Turkish Personal Data Protection Law No. 6698 grants you the right to know whether your data is being processed, to request its correction or deletion, and to file a complaint with the Turkish Personal Data Protection Authority (Kurul) in the event of a violation.
Pakistan: subject to general sector-specific digital data regulatory frameworks. India: the Digital Personal Data Protection Act, 2023 (DPDP Act) grants you the right to access, correct, delete, and withdraw consent at any time.
Data protection falls under limited-scope general regulatory frameworks related to digital data and communications. As in Category C, we apply to you the same higher voluntary protection standard set out in this policy.
This policy is issued by iEdrak LLC and applies with the same substantive content regardless of your geographic location, with the additional rights described above varying according to your country's legislation.