Privacy Policy

Last updated 30 September 2026

Riyal helps friends and groups split expenses and keep track of who owes whom. This policy explains what we collect, why, and the choices you have. Riyal records balances between people — it does not move money or process card payments; transfers happen through your own bank.

Information we collect

Account details you provide: your name, email address, and mobile number. Optionally, your IBAN, bank code, and a profile photo so friends can pay you back. Your password is stored only as a secure one-way hash — we never see it.

Content you create in the app: groups you join, bills and expenses, splits, chores, settlements, and any feedback you send us.

Technical and device data: app version, device model and operating system, a push-notification token (if you enable notifications), IP address, and diagnostic or crash information used to keep the app working.

Your contacts, only if you allow it. When you open Add person and give permission, the app reads the phone numbers in your address book and sends us only the Saudi mobile numbers among them, in a standard format, so we can show you which of your contacts are on Riyal. We use those numbers for that match only and do not store them. Contact names and other details stay on your device.

How we use your information

What other people can see

When you join a group, other members can see your name, profile photo, the items you add, and your balances within that group. Anyone who already has your mobile number, saved in their contacts or typed in full, can find you on Riyal and see your name and profile photo; nobody can look you up by name. Your IBAN and bank details are shown to people you share a balance with so they can transfer what they owe. Your email and password are never shown to other users, and we never show your phone number to anyone who does not already have it.

How we share information

We do not sell your personal data. We share it only:

Data storage and security

Your data is transmitted over encrypted connections (TLS) and stored on secured cloud infrastructure. Passwords are hashed with Argon2id and access tokens are short-lived. Some of our providers may process data outside Saudi Arabia; where they do, we take steps to protect it consistently with this policy.

How long we keep it

We keep your information for as long as your account is active. When you delete your account, we remove your personal data, except where we must retain limited records to comply with legal obligations or resolve disputes.

Your rights

Under the Saudi Personal Data Protection Law (PDPL) and applicable regulations, you can:

Children

Riyal is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

We may update this policy as the app evolves. When we do, we will change the “Last updated” date above and, for significant changes, notify you in the app.

Contact us

Questions about your privacy? Reach us from Profile → Help & support, or send feedback from inside the app. We are here to help.