Name: Shibre
Author: Kaleb Tesfaye

Section 1

Overview & Developer Commitment

Shibre ("the Application") is an independent personal financial management software application developed and maintained by Kaleb Tesfaye (based in Addis Ababa, Ethiopia). Shibre is engineered to help individuals effortlessly track, categorize, and understand their expenses across Ethiopian banks and mobile money services by automatically extracting structured facts from transactional SMS notifications.

This application was built with one unwavering foundational principle: Your financial records belong strictly to you. We do not sell, rent, monetize, broker, or exploit your personal or financial information. We never use your financial details or message content for third-party advertising, profiling, or commercial marketing.

Section 2

Data Architecture: Offline-First vs. Cloud Sync

Shibre is designed from the ground up as an offline-first utility. We provide complete transparency regarding how your data is processed and stored:

Default / Guest Mode

100% On-Device / Zero Remote Upload

By default, all SMS scanning, regex pattern matching, expense categorization, and financial metrics calculation occur 100% locally on your physical smartphone. No transaction data, SMS text, or account balances ever leave your device. There are zero uploads to any remote server.

✓ Offline sandbox • No remote storage

Optional Cloud Sync

Row-Level Security & Device Binding

Users who sign in have the option to enable Shibre Cloud Sync to synchronize transaction notes, custom categories, saving goals, and peer loans across their personal devices.

In-Transit Encryption: All cloud sync transmissions enforce HTTPS / TLS 1.3 encryption.
PostgreSQL Row-Level Security (RLS): Data is partitioned by authenticated account ID; other accounts cannot access your records.
Hardware Session Tokens: Cryptographic device fingerprinting validates each sync request and prevents unauthorized device replay.

✓ TLS 1.3 Encryption • Database Row-Level Security

Section 3

Financial SMS Processing & Ignored Messages

Under Google Play's Permissions Policy, Shibre accesses SMS messages solely for the approved core functionality of Personal Financial Management (PFM). Shibre automatically analyzes incoming SMS alerts exclusively from recognized Ethiopian banks and mobile wallet providers (such as Telebirr by Ethio Telecom, Commercial Bank of Ethiopia / CBE Birr, Bank of Abyssinia, Dashen Bank, Awash Bank, Ahadu Bank, and user-configured bank senders) to compute account balances and classify spending.

What Transactional Facts Are Extracted:

Shibre operates on a strict pure-fact parsing model. Only the objective fields necessary to calculate your finances are parsed:

Bank / Institution Name
Transaction Amount & Currency (ETB/USD)
Transaction Reference Code / ID
Debited vs. Credited (Direction)
Transaction Timestamp
Counterparty / Merchant Identifier
Post-Transaction Remaining Balance
Pattern Type (Transfer, Airtime, Package, Sanduq)

What Data Is Strictly Ignored & Discarded:

Shibre enforces strict programmatic discard filters. One-Time Passwords (OTPs), two-factor authentication (2FA) verification codes, banking PINs, login passwords, security codes, and all personal text messages from your contacts, friends, or family are immediately filtered out in device memory and dropped. They are never recorded, indexed, analyzed, stored, or transmitted anywhere.

No Advertising or Commercial Resale:

SMS data is accessed strictly to deliver personal expense accounting to you. It is NEVER sold, leased, or rented. It is NEVER shared with data brokers, advertisers, marketing platforms, or credit-scoring agencies.

Section 4

Device Permissions & Why They Are Needed

Shibre requests only the essential device permissions declared in its Android Manifest required to provide financial tracking. You are prompted with a prominent in-app disclosure before requesting SMS access, and you can revoke any permission at any time in Android system settings:

Permission	Purpose & Usage	Data Handling
RECEIVE_SMS	Detects incoming banking SMS alerts in real time as transfers, deposits, or payments occur so your balance stays updated instantly.	Processed locally on phone
READ_SMS	Allows one-time scanning of past financial alerts during initial onboarding to calculate starting account balances and transaction history.	Processed locally on phone
POST_NOTIFICATIONS	Delivers on-device alerts when transactions are detected and presents scheduled daily, weekly, or monthly financial summaries.	Generated locally on phone
USE_BIOMETRIC / USE_FINGERPRINT	Allows locking Shibre with your device fingerprint or face unlock to guard your financial records from unauthorized physical access.	Android OS Secure Enclave
INTERNET & ACCESS_NETWORK_STATE	Used for authenticated multi-device Cloud Sync (when enabled), over-the-air bank regex pattern updates, and Sentry crash diagnostics.	Encrypted via TLS 1.3
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	Prevents Android Doze mode from delaying background broadcast delivery for real-time banking SMS categorization and scheduled reports.	OS power management only
RECEIVE_BOOT_COMPLETED	Restores local scheduled spending summary alarms and background sync jobs after device restart.	No data collected
READ/WRITE_EXTERNAL_STORAGE (≤ Android 12)	Used exclusively when the user manually exports or imports an offline encrypted JSON backup file to or from local storage.	User-initiated file save only

Section 5

Security Architecture & Data Protection

Shibre implements multi-layered technical security controls to protect your information:

Operating System Sandboxing

Data is confined strictly to Shibre's isolated application directory. Other apps installed on your device cannot access or read Shibre's internal SQLite database.

Hardware-Backed Biometrics

Biometric authentication utilizes the Android Keystore. Raw biometric data is handled by the OS secure enclave and never exposed to the application.

PostgreSQL Row-Level Security

For users who choose Cloud Sync, cloud database tables enforce Row-Level Security (RLS) policies. Every query is cryptographically bound to the authenticated user ID.

TLS 1.3 Transport Security

All external network communications (cloud sync handshakes, OTA bank pattern updates, Sentry diagnostics) strictly enforce modern HTTPS / TLS 1.3 encryption.

Section 6

Third-Party Services & Subprocessors

In accordance with Google Play's Data Safety disclosures, Shibre integrates only the following trusted third-party service providers:

Supabase Inc.

Cloud Backend & Auth

Provides authenticated user account management, PostgreSQL cloud database storage, and real-time synchronization for users who opt into Cloud Sync. Data is stored securely in compliant cloud infrastructure protected by Row-Level Security (RLS).

Functional Software, Inc. (Sentry)

Crash Reporting

To diagnose stability issues and fix app crashes across diverse Android models, Shibre utilizes Sentry. Crash logs collect only anonymized technical stack traces, OS version, and device model. Sensitive personal information, SMS bodies, bank account numbers, and financial amounts are strictly stripped and never collected.

Google Identity & Play Services

Authentication & Distribution

Used for optional Google Sign-In authentication and app delivery via the Google Play Store.

Shibre does NOT contain any third-party advertising SDKs, ad trackers, data brokers, or commercial behavioral tracking tools.

Section 7

Data Rights, Retention & Permanent Deletion

You retain total ownership of your financial records and have the absolute right to inspect, export, or permanently delete your data at any time:

In-App Instant Data Deletion

You can wipe all local transactions, wallets, and settings instantly in Settings > Delete Data, or permanently delete your account and all associated cloud sync records via Settings > Delete Account & Data. Wiping is immediate and irreversible.

Web-Based Account & Data Deletion Request

In compliance with Google Play's Account Deletion requirements, users who do not have the app installed or prefer a web-based request can submit an account deletion request through our official deletion portal:

Visit Web Deletion Page (shibre.com/delete-account)Email support@shibre.com

Data Retention Periods

• Local Data: Stored on your device until you delete transactions, clear app cache, or uninstall the app.
• Cloud Synced Data: Retained while your account remains active; permanently deleted upon account deletion.
• Diagnostic Logs (Sentry): Anonymized crash logs are automatically expunged after 90 days.

Section 8

Children's Privacy

Shibre is a personal financial bookkeeping utility intended exclusively for individuals of legal age to hold bank and mobile money accounts (18 years or older, or minors under parental supervision).

We do not knowingly collect, request, or solicit personal data from children under the age of 13. If we learn that personal data from a child under 13 has been collected, we will take immediate steps to delete that information permanently from our records.

Section 9

Terms of Service & Banking Disclaimer

Shibre is an autonomous utility designed for personal financial management and bookkeeping:

No Custody of Funds: Shibre is not a bank, wallet provider, payment processor, or depository. The application never holds, moves, transfers, or debits your money.
Independent Software: Shibre is developed independently by Kaleb Tesfaye and is not officially affiliated with, endorsed by, or sponsored by Ethio Telecom (Telebirr), the Commercial Bank of Ethiopia (CBE), Awash Bank, Dashen Bank, Bank of Abyssinia, or any other financial institution.
Record Accuracy: While Shibre parses notification text with high precision, users should consult their official bank statements for tax, auditing, or legal verification.

Read Complete Terms of Service

Section 10

Contact & Developer Support

If you have questions, suggestions, or concerns regarding your privacy or this policy, please contact developer Kaleb Tesfaye:

Email Support

support@shibre.com

Telegram Community

@Shibre_app