This page explains what information Darakav (the darakav.com website and app) keeps about you, why, for how long, and the control you have over it. We have tried to write it plainly and accurately, and not to promise more than we actually do.
Who runs Darakav
Darakav is run by Seyyed Ali Mirsalari as an individual. For any privacy question, write to support@darakav.com.
What we keep
Your account
- Your email address, to sign in, confirm your account and send messages about your account’s security.
- Your password, stored only as a one-way hash. The password itself is never kept.
- Your settings, such as language, calendar, currency and appearance.
- What two-step sign-in needs, if you turn it on, such as your authenticator app key or your passkey’s public key.
- Your mobile number, only if you verify it yourself through the Bale or Telegram messenger. It is stored encrypted.
Financial records you enter
Accounts, transactions, holdings, loans and installments, budgets, goals, recurring payments and notes. They are kept on the server so the app can calculate your balances, reports and net worth. Card and Sheba numbers are encrypted separately.
Security records
To protect accounts, we record events such as successful and failed sign-ins, with the time and part of the network address (never the full IP address). Administrative actions in the server’s operator console are also recorded in an activity log.
Messages you send us
If you email support@darakav.com, your message is forwarded to the personal mailbox of Darakav’s operator and kept so it can be answered.
What we don’t do
- Darakav doesn’t connect to any bank and never asks for your online-banking password or details.
- We don’t show ads and don’t use third-party tracking or analytics tools.
- We don’t sell your information or share it with anyone for advertising.
Cookies and browser storage
- Session cookie: keeps you signed in.
- Security cookie (XSRF-TOKEN): protects against forged requests from other sites.
- Browser storage: keeps settings such as language and appearance on your own device.
There are no advertising or analytics cookies.
Other services
- Market prices: Darakav’s server fetches public prices from outside sources. No information about you is sent in these requests.
- Google Calendar (optional): if you turn on Google Calendar sync, it runs directly in your browser, and your Google access is not stored on Darakav’s server. Google’s privacy policy also applies to your calendar events.
- Bale and Telegram (optional): to verify your mobile number, you share it yourself with Darakav’s bot in that messenger.
- Email: Darakav’s emails are sent from Darakav’s own mail server.
Where and how your information is kept
Information is kept on servers in Iran. To protect it:
- All connections to the server are encrypted (HTTPS).
- Sensitive details such as card, Sheba and mobile numbers are encrypted separately.
- The server’s administration tools don’t show users’ financial data.
No system is perfectly safe. Your financial records are kept on the server in a form the app can process, so Darakav does not use end-to-end encryption. The server’s operator only touches this information when it is needed to keep the service running, fix a problem or meet a legal requirement.
How long we keep it
- Your information is kept for as long as your account is open.
- If you delete your account, your information is removed from the live database straight away. Encrypted backups are replaced by newer ones within 14 days.
Your control
- You can see and edit your information at any time.
- Under “Data & privacy” in Settings, you can download an encrypted export of all your information.
- In the same place, you can permanently delete your account.
- For any other request, write to support@darakav.com.
Children
Darakav is made for adults and is not intended for anyone under 18.
Changes to this policy
If this policy changes, the date at the top of this page is updated. We also announce important changes in the app or by email.