Privacy policy
Maal is a personal-finance app for Mac made by Ahmed Mohammed Fawzy (“we”). This page says what happens to your information when you use it. The short version: your financial records stay on your devices and in your own iCloud. We do not have them, and we cannot read them.
About this policy
Effective 7 October 2026. Every statement about what Maal does was checked against the app’s code on 4 October 2026.
Maal and maallive.com are operated by Ahmed Mohammed Fawzy, an independent developer in Egypt.
What we collect
Nothing. Maal has no account with us, no analytics, no advertising and no tracking. It does not send your accounts, balances, transactions, budgets, goals, loans, zakat figures or anything else you enter to us or to anyone else.
Where your records are kept
- On your Mac. Your ledger is stored on your Mac, in the app’s own protected storage.
- In your iCloud, if you use it. If you are signed in to iCloud, Maal can keep your ledger and your settings in your private iCloud storage so your devices stay in step. That storage belongs to your Apple Account. Apple holds it under its own privacy policy; we have no access to it.
- In files you choose to save. A backup or a CSV export is a file you create and keep where you decide. A backup is not encrypted: it is plain text that anyone with the file can read, so keep it somewhere safe.
When Maal uses the internet
Maal contacts the internet for two things only.
- Exchange rates and metal prices. To convert currencies and to price gold and silver, Maal downloads a public list of rates. It asks our server (rates.maallive.com) first and two public mirrors if that fails. The request is the same for everyone: it contains no account, no identifier, and nothing from your ledger, not even which currencies you hold. As with any internet request, the server sees the internet address (IP) it came from. You can turn automatic updates off in Settings › Currencies and type rates yourself.
- Apple’s services. iCloud, if you use it, and the App Store for your subscription. These are between you and Apple.
Logs on our rates server
rates.maallive.com is hosted on Cloudflare. As with any web host, standard request logs may exist on the host for a short time; Maal reads none of them and keeps no record of who asked.
Your subscription
Maal is paid for by a subscription through the App Store. Apple handles the payment. We never see your card or bank details. Apple tells the app only whether the subscription is active.
On your Mac
- App Lock. If you turn it on, your Mac checks Touch ID or your password. Maal never sees your fingerprint or your password.
- Reminders. Notifications are created on your Mac. They name the thing that is due and never show an amount.
- Search. Your Mac’s search can find your accounts and goals by name only if you allow it in Maal’s settings. It is never given an amount.
- Siri and Shortcuts. When you ask, Siri can tell you a figure such as what is safe to spend, or record an expense. This happens on your devices, and where App Lock is on Maal checks it is you first.
- Apple Pay. If you set up the shortcut that records card payments, the payment details your Mac passes to Maal stay on that Mac until you record them: they are not synced and are not put in a backup.
Diagnostics
Maal has no crash-reporting or analytics software of its own. If you have chosen in macOS to share diagnostics with app developers, Apple may send us anonymous crash reports. They contain no ledger data. You control this in System Settings › Privacy & Security.
Deleting your information
Because your records are yours, you remove them yourself: Settings › Data › Erase All Data removes the ledger from Maal and, when iCloud sync is on, from your iCloud ledger. Deleting the app removes what is stored on that Mac. We hold nothing to delete.
Erasing your data or deleting the app does not cancel a subscription. Manage or cancel it through the Apple Account that bought it.
Children
Maal is not directed at children and collects no information from anyone.
This website
maallive.com uses Cloudflare to serve pages and route visitors to a suitable country and language. A saved country and language preference is used when you choose to remember your selection. Hosting receives ordinary request information, which can include an IP address and browser headers.
The contact page loads Cloudflare Turnstile to check that the sender is a person. Turnstile processes information from your browser under Cloudflare’s own policy.
This website sets no analytics and no tracking. It keeps one cookie for the market you chose. Requests about your information go through the contact page. These website arrangements are separate from the private ledger in the app.
Contact
To ask about this policy, use the contact form on this site. There is no public email address. Your message goes to a private issue tracker on GitHub; GitHub stores it and can see its content under GitHub’s own privacy policy. The form asks for your message and, if you choose, a name and a reply email. Your IP address is not put in the message we keep.
Do not send ledgers, backups, bank statements, card details or passwords.
Only the operator can read the private issue tracker. A message is kept while it is being answered and is deleted on request.
Changes
If this policy changes, we will post the new version here and change the date above.