Sorayli Privacy Policy
Effective October 2, 2026
Sorayli is a personal finance tracker. This policy describes what data the Sorayli web and mobile apps collect, why, and what happens to it. The short version: your financial data exists so the app can show it back to you. We do not sell it, and we do not use it for advertising.
What we collect
- Account data: your email address, name, and sign-in credentials, managed by our authentication provider. We never see or store your password.
- Financial data you enter: transactions, budgets, categories, subscriptions, and notes. This is the product; it is stored so the app can display it.
- Receipt images: photos you scan or upload, stored so you can view them later, plus the text extracted from them.
- Device tokens: if you enable push notifications, the token needed to deliver them to your device.
What we send to an AI provider, and to whom
Two features use a third-party AI service: receipt scanning and the assistant chat. That service is OpenAI (OpenAI, L.L.C.), through its API. Nothing is sent to it until you have agreed, in the app, on the consent screen shown before your first scan or chat message. You can withdraw that permission at any time in Settings → Privacy; scanning and chat then stop until you allow it again, and everything else keeps working.
- Receipt scanning. What is sent: the photo of the receipt you scan (or a processed copy of it), and the names of your spending categories so the result can be filed. What comes back: the merchant, date, amounts and line items, which are stored in your account.
- Assistant chat. What is sent: the message you type, and the summaries of your financial data needed to answer it (totals, budgets and, when you allow the personalised mode, recent transactions). What comes back: the answer, stored in your chat history.
- Never sent: your name, email address, phone number, contacts, location, device identifiers, or sign-in details. Requests carry no account identifier the provider could link to you.
OpenAI processes this data only to return the result. Under the API terms we use, it does not use your data to train its models, retains it for at most 30 days for abuse and misuse monitoring, and then deletes it. OpenAI is contractually bound to protect this data to a standard at least equal to this policy. Sorayli keeps the results (extracted receipts, chat answers) in your account, where you can export or delete them.
Who else processes your data
Beyond the AI provider named above, Sorayli relies on specialist providers for authentication, database and file storage (hosted in the EU), application hosting, transactional email, in-app purchases, rate limiting, and product analytics and error monitoring (hosted in the EU). Each receives only what its function requires, under contracts that restrict use of your data to providing that function and require protection at least equal to this policy.
Usage analytics on the web
On the Sorayli website and web app, we record which pages are viewed and may record how the web app's screens are used, with every piece of text and every image masked, so that no amount, merchant, or receipt is captured. We do not build advertising profiles from it. If you have an account, you can switch this off in Settings → Privacy → Analytics. Error reports from the web app and the server have credentials and sign-in tokens removed before they are sent.
Usage analytics in the app
The Sorayli app records anonymous usage events: which welcome and setup screens were shown, whether a receipt scan worked, and whether sign-up was completed. They are kept under a random identifier that is not linked to your account, name, or email, and they never contain amounts, merchants, receipt images, or anything you type. The app makes no screen recordings. You can switch this off in Settings → Privacy → Share usage analytics.
We send account and security email, and, only if the corresponding setting is on, budget alerts, weekly summaries, and subscription reminders. Every non-security email carries a one-click unsubscribe. Other marketing email is off unless you opt in, with one exception: if you use Sorayli on Android, where the app cannot sell plans, we send up to three short emails in your first week explaining how plans work there — the first to everyone, the other two only if you have not said no to product emails. Each carries a one-click unsubscribe.
What we do not do
- We do not sell your data.
- We do not share it with advertisers or data brokers.
- We do not read your bank accounts. Sorayli only knows what you enter or scan.
Deleting your data
You can delete your account from Settings in the app. Deletion removes your account, your organization if you are its only member, and all of its transactions, budgets, receipts, and images.
Deletion takes effect after 30 days. During that window nothing has been erased and signing back in cancels it; after it, the erasure is permanent and we keep no copy. We email you when deletion is scheduled, with the date.
Offline data on your device
The mobile app keeps a copy of your recent data on the device so it works offline. It is scoped to your account and removed when you sign out or delete your account.
Contact
Questions or requests about your data: support@sorayli.com.