Hirro — Privacy Policy
Last updated: 14 November 2026
Applies to: the Hirro mobile application (Android and iOS), the Hirro web app at app.hirro.ir, and the Hirro backend at api.hirro.ir.
In one paragraph
Hirro is a shared-expense and loan tracker. It keeps what you type into it — what you spent, who you split it with, what you owe and are owed, and the cards you track it against — on a server we run ourselves, in Iran. We do not sell it, we do not advertise against it, and we do not send it to any third-party analytics or advertising service. Sign-in email uses a mail provider, Google sign-in uses Google if you choose it, remote notifications on Android and the web use Google's Firebase Cloud Messaging, and crash reports — and, while the app is being tested, performance timings, warning and error logs and screen recordings with every text and image blacked out — go to the Sentry error-tracking service through a relay we run. Notification text can include names, group names, expense titles and amounts; those providers may process that information outside Iran (§5.5). People in a group you join can read that group's expenses, and the members of your groups can see your name, username and profile picture. You can ask for your account to be deleted. Shared ledger history can remain for the other members; the limits of deletion are explained in §6.
1. Who is responsible
Hirro is operated by its owner as an independent project, not by a company. Contact for any privacy question, data request or complaint:
- Email: a.azimoshan@gmail.com
If you are not satisfied with a response, say so in a reply; there is no separate escalation desk, only the same person.
2. What we collect
We collect only what the app needs to do its job. There is no tracking SDK, no advertising identifier, and no behavioural analytics in the app.
2.1 What you give us
| Data | Why | Required? |
|---|---|---|
| Email address | Signing in (we mail you a code) | Yes, unless you use guest mode |
| First and last name | So your friends recognise you in a group | Yes, unless you use guest mode |
| Username | A stable handle friends can search for | Yes, unless you use guest mode |
| Phone number | Optional contact detail on your profile | No |
| Profile picture | Optional | No |
Signing in with Google. If you choose "Continue with Google", Google tells us your name and email address, and we use them to create your account and to fill in your name. We do not receive your Google password or anything else from your Google account.
Guest mode. You can use Hirro without an email address. A guest account has no email or username until you choose to create a full account. You can give a guest account a display name.
There are no passwords: you sign in with an emailed code, with Google, or as a guest.
2.2 What you create by using the app
| Data | Detail |
|---|---|
| Expenses | Title, amount, currency, date, category, note, who paid, how it was split |
| Groups | Group name, emoji, who is a member, each member's role |
| Guests | Names you add for people who are not app users |
| Settlements | Who paid whom, how much, when |
| Loans and installments | Title, principal, interest, schedule, due dates, what has been paid |
| Cards and accounts | Name, type (bank card, credit card, wallet, cash, investment), bank, colour, currency, opening balance, credit limit, and — only if you enter it — the full card number. We never ask for, and you should never enter, a card's expiry date, CVV2, PIN or online password. |
| Transfers | Money you move between your own cards and accounts: amount, date, note |
| Friendships | Who you are connected to, and pending requests |
| Activity log | A record of changes made inside a group, and who made them |
| Uploaded files | Receipt photos/files and avatars you choose to upload |
| Reminders | Local notification schedules for upcoming installments, stored on your device |
| Upcoming and recurring payments | Planned amounts, dates, reminders, participants and the person assigned to pay |
| Notifications | In-app notices about group activity, friend requests and assigned payments |
2.3 What is collected automatically
- Session cookie. Stored on your device to keep you signed in.
- Server logs. The Appwrite backend records request metadata (timestamp, endpoint, IP address, user agent) as part of normal operation.
- Push registration. Firebase uses installation identifiers and messaging tokens to address a device or browser. Hirro stores the push target associated with your account. Firebase may also process operational data such as IP addresses when its SDK or service is used (§5.5).
- Crash reports. When the app hits an unexpected error, it sends a crash report to Sentry, an error-tracking service (§5.5). The report first goes to a relay on our own server outside Iran, which passes it on without your IP address or cookies, so Sentry sees the relay's address, not yours. A report holds the technical error and where in the app's code it happened, the names of the screens opened just before it, the app version, your device model, operating system, language and time zone, and your account id. Reports are built to describe the error, not your data: they do not include your email, name, expenses, cards, notes or files, and before a report leaves your device the app also removes email addresses, sign-in tokens and secrets, IP addresses and long numbers (such as card or phone numbers) from the error text. Reports are kept for at most 30 days.
- Testing-phase diagnostics. While Hirro is being tested, the app may also send the three kinds of diagnostics below to Sentry, through the same relay and without your IP address. We turn them off when testing ends. They are kept for at most 30 days.
- Performance timings (testing phase). How long the app took to start, to open a screen and to get an answer from our server. They name the screen (for example "group page") and the kind of request (for example "read an expense"), never what it contained; the ids of your groups, expenses and other records are removed.
- Warning and error logs (testing phase). Short technical messages the app writes when something goes wrong, such as "a cached read could not be stored". Before they leave your device, the app removes from them everything it removes from crash reports, plus record ids and any number that could be an amount.
- Masked screen recordings (testing phase; Android and iOS only, not the web app). A low-quality recording of the moments before an error, and of about one session in ten. Every text and every image is covered by a solid box before a frame is kept, and so are charts and progress bars: amounts, names, card digits, notes, profile pictures and receipts never appear. What remains is the layout of the screen and where you tapped. Typing on your phone's keyboard is not recorded, and nothing is recorded while the app is in the background.
- App update checks (Android and iOS). When the app starts, it asks Shorebird, our code-update service, whether a fix is available for the version you have installed (§5.5). The request carries the app's identifier, version and platform, your processor type, the fix you are running, and a random number the app creates the first time it runs. It carries nothing you typed into Hirro, no account or device identifier, and no location.
- No analytics or advertising.
3. Card numbers
A card number is optional. If you enter one:
- It is encrypted before it is stored on our server, so it is not kept in readable form in the database or in its backups.
- It is shown only to you, and only on that card's detail page. Card names and lists never show it, and it is never shown to the members of your groups — your cards are private to you.
- It is used only to tell you which bank the card belongs to and to let you copy it (for example, for a card-to-card transfer in your banking app). Hirro never uses it to make, receive or authorise a payment.
- It is deleted when you delete the card's number, the card, or your account.
4. Where it is stored
The ledger and uploaded files are stored on a server we operate ourselves, physically located in Iran. Email delivery, optional Google sign-in, Firebase push messaging, app update checks, crash reports and testing-phase diagnostics involve providers that may process data outside Iran. The self-hosted database location does not limit those providers' processing locations (§5.5).
The backend is Appwrite, self-hosted. Traffic between the app and the server is encrypted with TLS.
Some data is also on your device: the app caches what it has loaded, and loan and payment reminders can be scheduled locally. Remote push and the in-app notification inbox are separate from those local reminders.
5. Who can see your data — read this part
We would rather be blunt than reassuring.
5.1 Other members of your groups
Every member of a group can read everything in that group — every expense, amount, note, receipt image, settlement and the activity log. Write permissions depend on the record: an expense's author edits or deletes it, settlement actions go through the server, and the activity log is append-only. Group membership changes are checked by the server. Do not put anything in a group note that you would not want every member of that group to read.
5.2 Other people using Hirro
Your name, username, profile picture, email address and any phone number you store in your profile are in a profile record readable by signed-in Hirro accounts, including guest accounts, not only your friends. Search preferences limit discovery in the app; they do not make that server profile record private.
Invitation and guest records are scoped to their group. Someone holding a share or claim link can access the preview that link is intended to share, such as the group name or a guest's balance, before signing in. Share those links only with their intended recipients.
5.3 Uploaded images
Receipts are private to their expense's group. A signed-in group member can read the attached files; they are not anonymous public uploads.
Profile pictures are public. Anyone with a picture's file URL can view it, and the avatar bucket exposes file-list metadata without signing in. Do not use a sensitive image as your profile picture. A card number visible inside an uploaded picture does not receive the field encryption described in §3.
5.4 Us
The operator has administrative access to the server and can therefore read what is stored on it. Card numbers are encrypted at rest, but because the server holds the key in order to show them back to you, the operator could technically decrypt them. That access is used for operating and debugging the service, not for browsing your expenses or your cards.
5.5 Third parties
- Email delivery. Sign-in codes are sent through the Resend mail relay, which necessarily sees your email address and the contents of those messages. It does not see any expense or card data.
- Google sign-in. If you choose to sign in with Google: Google knows that you signed in to Hirro, and shares your name and email address with us (§2.1).
- Firebase Cloud Messaging (Google). Android and web push notifications use Firebase. Message titles and bodies may include an actor's name, a group name, an expense or payment title and an amount. Routing data includes the notification identifier and type. Our push payload does not include card numbers or receipt files. Firebase processes installation identifiers, messaging tokens and service metadata to deliver messages; its infrastructure may be outside Iran. Firebase initialization can contact Google even before notification permission is granted. You can disable notification permission in your device/browser settings and manage alerts in Hirro. Native iOS currently uses local alerts and reminders. See Firebase privacy information and FCM message security. Push uses transport encryption, not end-to-end encryption of its notification text.
- Shorebird (app updates). The Android and iOS apps check Shorebird's servers on start for code fixes and download them from there (§2.3). Shorebird stores the check data in the United States. Its hosting providers (Google Cloud and Cloudflare) log each request's IP address to run and secure the service. None of your Hirro data is sent. The web app does not use Shorebird. See Shorebird's privacy policy.
- Sentry (crash reports and testing-phase diagnostics). Crash reports and, while the app is being tested, performance timings, warning and error logs and masked screen recordings (§2.3) are stored by Sentry (Functional Software, Inc.) in the United States, for at most 30 days. They reach Sentry through a relay on our own server, which removes your IP address and cookies on the way, and the app removes email addresses, tokens and long numbers before anything leaves your device (and record ids from timings and logs). In a screen recording every text and image is blacked out. None of it contains your expenses, cards, notes or files. See Sentry's privacy policy.
- No advertising or analytics partner. We do not sell or rent your data.
- Legal demands. If we were compelled by a valid legal order to hand over data, we would have to comply. We will tell you unless we are forbidden to.
6. How long we keep it
- While your account exists: indefinitely — the point of the app is a running history.
- After you delete your account: your profile, your cards and accounts (including any card numbers), transfers between them, your loans and installments, your personal (non-shared) expenses and your authentication record are removed.
- What survives deletion: entries you created inside a shared group can remain, because removing them would change the balances other members rely on. The deleted profile can no longer be opened, but identifiers and names already present in historical records or activity descriptions may remain; deletion does not promise to anonymize every shared record. If you want those records removed as well, ask the group's other members to delete the group.
- Server logs: retained for a short operational period and then rotated.
- Crash reports and testing-phase diagnostics: at most 30 days, then deleted automatically.
- Shared ownership: if you are the only owner of a group with other members, transfer ownership before deleting your account. Groups where you are the only remaining member are deleted as part of account deletion.
7. Your rights and how to use them
Delete your account
In the app: Profile → Delete Account. It asks for confirmation, then deletes server-side. A failure can leave a partial deletion because the server does not make the whole operation atomic. Retry or contact us if it reports an error; the app confirms completion only when the server confirms it.
You can also email a.azimoshan@gmail.com from your registered address and ask.
Get a copy of your data
Email a.azimoshan@gmail.com from your registered address. We will send a machine -readable export within 30 days. The app also exports selected group ledgers and date ranges as CSV or PDF; that is not a complete account export.
Correct something
Names, usernames, phone numbers and profile pictures are editable in Profile → Edit. For anything else, email us.
Withdraw from the beta
Delete your account, or email us and we will remove it.
8. Children
Hirro is not intended for anyone under 13, and we do not knowingly hold data about a child. If you believe we do, email a.azimoshan@gmail.com and it will be deleted.
9. Security
- TLS on every connection between the app and the server.
- Card numbers encrypted at rest (§3).
- No passwords to leak: sign-in is by emailed code, Google, or guest mode.
- Server-side authorisation for group membership changes.
- Access to the server restricted to the operator.
- An optional app lock on Android and iOS: Face ID, Touch ID, a fingerprint or the device passcode, asked for when Hirro opens. The check is made by your device's operating system. Your face, fingerprint and passcode stay on the device and Hirro never receives them; the app learns only whether the check succeeded. Whether the lock is on is stored on the device, not on our server. The web app has no app lock.
What we do not yet have, stated plainly: certificate pinning, screenshot protection, encrypted storage of the session cookie on the device. Profile visibility remains broad as explained in §5.2. With the app lock off, or on the web, a device that someone else can unlock can open Hirro.
No system is perfectly secure. If you find a problem, email a.azimoshan@gmail.com — we would much rather hear it from you.
10. Changes to this policy
If this policy changes materially we will update the date at the top and note the change in the app's release notes. Continuing to use Hirro after a change means you accept the updated policy.
11. Contact
a.azimoshan@gmail.com