Legal

Privacy Policy — Amanah

Effective date

16 October 2026

Last updated

16 October 2026

App

Amanah: Masjid & Charity Bookkeeping

Platform

Android

Developer

Nainnie Labs

Contact

hello@nainnielabs.com

Who we are

Amanah is made by Nainnie Labs. It is a bookkeeping app for masjids, madrasas and small charities: income, expenses, funds, donors, pledges, staff salaries and reports.

If you have a question about this policy, write to hello@nainnielabs.com.

The short version

What the app stores on your device

Everything you type into Amanah stays in private storage that belongs to the app. Other apps cannot read it. That includes:

• Your organization's name, country, currency and logo.
• Entries: amounts, dates, categories, funds, accounts, notes, references and receipt numbers.
• Donors, members, staff and payees — names, phone numbers, areas and notes you add.
• Pledges, salaries, advances, projects, collection counts and cash counts.
• The history log of every change, so a correction is always traceable.
• Receipt photos and payment screenshots you attach, saved as compressed images.
• Your settings: language, theme, number format, reminder days, backup options.

We should be straight with you about two details. Amanah does not add its own encryption to the database on your phone. It relies on Android keeping app storage private, on your phone's own encryption, and on the Amanah PIN or fingerprint lock if you switch it on — which we recommend. And account numbers are never stored in full: an account holds a label and, at most, the last four digits.

If you set an app-lock PIN, we store only a scrambled, one-way fingerprint of it (a salted hash), never the PIN itself. Nobody — including us — can read your PIN back out of it.

Google sign-in and Google Drive backup

Backup is off until you turn it on. When you tap Connect Google Drive, Google's own account picker and consent screen appear, and once the account is connected Amanah asks you to set a backup passphrase— see below. You choose the account; Google handles the sign-in, and Google's privacy policy covers that part. The only thing Amanah keeps afterwards is the e-mail address of the account you picked, on your phone, so scheduled backups can continue without asking you again.

Amanah asks Google for one permission only: the drive.file scope, which lets an app see and manage only the files it created itself — nothing else in your Drive.

Your backups are uploaded into a folder called Amanah Backups in your own Google Drive, with one sub-folder per organization. We upload:

• the .amanah backup file — your full records, and your photos if you include them;
• a readable spreadsheet of your transactions, if you leave that option on;
• reports you choose to save to Drive.

These are your files in your Drive. You can open, move, copy or delete them in the Google Drive app. Amanah keeps a limited number of older backups and deletes the ones it made beyond that (the most recent seven days, four weeks and six months).

When you connect Google Drive, Amanah asks you to set a backup passphrase. That is the normal path, during first-time setup and in Settings alike — not a hidden option.

With a passphrase, the file is encrypted on your phone before it is uploaded, with AES-256-GCM and a key derived from your passphrase using PBKDF2-HMAC-SHA256 at 310,000 iterations. Nothing in an encrypted backup can be read without it: not your records, not your photos, not the organization's name. The name is also kept out of the file name and out of the file's Drive details, so the file does not announce whose it is. Your passphrase is never stored anywhere we or anyone else could recover it — which also means a lost passphrase cannot be recovered. There is no reset, and we cannot help you open the file. Write it down and keep it somewhere away from the phone.

You can still choose Continue without a passphrase, and Amanah remembers that you chose it rather than asking again every time. Being plain about what that means: the backup file is then readable by anyone who gets hold of it, and its file name contains your organization's name. It is sitting in your Google account, so Google can read it like any other file you store there. You can set a passphrase later, under Backup & restore; backups made before then stay as they are.

One part of a folder name stays visible either way: each organization has its own sub-folder, named after the organization, so that you can find, check and delete your own backups in the Google Drive app.

Before Amanah replaces the data on your phone with a restored backup, it first saves a copy of what is already there, in its own private storage (the three most recent copies are kept). Those copies carry your passphrase too: if you have set one, they are encrypted with it; if not, they are not encrypted. They never leave your phone either way, and your phone can still open its own copies if a restore goes wrong.

Reading payment slips

You can attach a payment screenshot or a photo of a bill and let Amanah read the amount, date, reference and sender for you, so you do not have to type them.

That reading happens entirely on your phone, with a text-recognition model that ships inside the app. Nothing is uploaded, nothing is downloaded, and it works in airplane mode. The app always shows you what it read, on screen, before anything is saved — you correct it and you decide.

The image itself never leaves your device unless you choose to send it: by including photos in a backup, or by sharing or exporting the entry yourself. Where a slip shows an account or card number, Amanah keeps only the last four digits; the full number never enters the app's records. Nothing about a slip is written to any log — not the text, not the reference, not the file.

Crash reports

Amanah contains no crash-reporting service. When the app crashes it writes a single small text file to its own private storage, and that file is overwritten by the next crash. It is never uploaded.

If you tap Send report, Amanah opens a draft e-mail to hello@nainnielabs.com in your own mail app with that file attached. You can read it, change it, or abandon it. Nothing is sent until you press send.

The file contains only these fields:

• the date and time of the crash;
• the app version and version number;
• the Android version;
• the device model;
• the language setting;
• a counter of how many times the app crashed in a row;
• the type of the error and the technical stack trace — the list of code locations involved.

It contains no financial and no personal data: no amounts, no donor, member, staff or payee names, no notes, no phone numbers, no organization name, no references, and no file paths that could contain any of those. Error messages are deliberately thrown away, because that is the one part of a crash that can quote what you typed. Every line is checked before it is written, and a line that still looks like it carries data is replaced rather than saved.

There is one more rescue feature worth naming. If the app fails to start three times in a row, it offers a safe screen with Save raw data file, which writes a copy of your database and your photos to a place you choose, so your records are never trapped inside a broken app. Amanah warns you before it writes anything: the file holds all your records and every photo, it is not encrypted, and you should keep it somewhere safe and delete it once you no longer need it. If you decline, nothing is written at all. The file is never attached to a crash report — it goes only where you put it.

Notifications, camera and photos

Notifications are optional. Amanah asks for permission only after you enable a feature that needs one, and the app works without them. They cover backup progress and failures, and a monthly reminder about pledges and salaries. A reminder shows your organization's name and counts — “7 pledges are due this month” — and never a person's name or an amount. None of them shows its content on a locked phone: every notification Amanah posts is marked as private, so while the phone is locked your organization's name is hidden, and anything shown in its place says only “Amanah” and what kind of notification it is. Unlock the phone and you see the whole thing as usual.

Amanah asks for no camera permission and no storage permission. To add a photo it hands the job to your phone's own camera app, or to the Android photo picker, which gives Amanah the one image you chose and nothing else. To save an export, your phone's file picker asks you where to put it. You can also share a screenshot into Amanah from another app, which likewise passes along that one image.

Amanah checks whether WhatsApp is installed, so a pledge reminder can offer to open it. That check is the only thing it does — nothing is sent, and no message goes out by itself. If you choose to send a reminder, WhatsApp (or whichever app you pick) opens with the message typed in and you press send. From that moment the message is in that app's hands, under that company's own privacy policy.

Home-screen widgets show your totals. Amounts are hidden in widgets unless you turn them on, because a widget is drawn by your phone's home screen where other people may see it.

What we do not do

• We do not sell your data. There is nothing to sell, because we never receive it.
• We do not share your data with anyone, and there are no third-party trackers in the app.
• We do not show ads and do not use advertising identifiers.
• We do not collect analytics, usage statistics or device identifiers.
• We do not access your location, your contacts, your calendar, your messages or your call history.
• We do not create an account for you and we have no server that stores your records.
• We do not read your Google Drive. Amanah can only touch files it created itself.

Data retention and deletion

We hold nothing, so there is nothing to ask us to delete and no request to make. You are in control of every copy:

• Delete an organization— in the app's settings. It removes that organization and every entry, member, pledge, salary and photo belonging to it. Amanah offers you a fresh backup first.
• Uninstall Amanah— this removes everything the app stored on your phone: the database, your settings, your photos and the crash log. The app excludes its data from Android's automatic backup, so no copy is left behind in your Google account.
• Delete the “Amanah Backups” folder in your Google Drive — this removes the uploaded backup files, the readable spreadsheet and any saved reports. They are your files; you delete them.
• Revoke Amanah's access to your Google account, in your Google Account settings, to stop any further upload.

Files you exported, shared or sent to someone yourself are outside the app, so you will need to delete them wherever you put them.

If you ever send us a crash report by e-mail, we keep that e-mail only as long as we need it to look into the problem, and you can ask us to delete it at hello@nainnielabs.com.

Children

Amanah is a bookkeeping tool for the people who look after an organization's money. It is not directed at children under 13, and we do not knowingly collect any information from them. In fact we do not collect information from anyone — nothing you enter reaches us.

Changes to this policy

If Amanah ever changes what it stores or where anything is sent, we will update this page and change the effective date at the top before the new version is released. Significant changes will also be mentioned in the app's release notes. The current version is effective 16 October 2026.

Contact

Questions or requests:

Nainnie Labs
Email: hello@nainnielabs.com
Website: https://nainnielabs.com