Privacy Policy

This policy covers the Much app for iPhone and Android (Much of Money and Much of Macros) and this website ("Much", "we", "us"). Much is run by Zeyad Abdelwahab, based in Cairo, Egypt, who is responsible for your data under this policy. You can reach us any time at hello@getmuch.app.

We only collect what Much needs to work, and most of it is what you choose to enter.

• Account details: your email address, your name if you add one, and a password (stored only as a secure hash by our sign-in provider). If you sign in with Apple or Google, we receive the name and email that service shares with us. If you use Hide My Email, we only see the relay address.
• Profile: an optional photo or avatar, your currencies, the day your month starts, and your settings.
• Much of Money: payments, income, top-ups and transfers you log, with their amounts, currencies, categories, places, notes and dates; the names and balances you give your accounts, cards, wallets and cash; budgets, bills, subscriptions, installments, objects, favorites, routines and dreams.
• Much of Macros: the food, drinks, portions and times you log, with calories, macros and nutrients; water, caffeine and weight; and, if you set a plan, your age or birthday, sex, height, activity level and goal. This is health and fitness information, and we treat it with extra care (see below).
• Photos and files you choose: a photo of a receipt, a nutrition label or your food, and files you import (such as a CSV, an Excel sheet or a PDF statement).
• Voice notes: when you hold the mic to tell Much what happened.
• Payment messages, only if you turn this on: on Android, with notification access you grant; on iPhone, through a Shortcuts automation you set up yourself. See "Payment messages" below.
• Usage events: which features are used (for example "logged an expense by voice"), with an anonymous ID, the app version and the device type. Never what you logged: no amounts, merchants, accounts, food, health values or message text.
• Technical data: when your phone talks to our servers, they see its IP address and request details, which we use for security and to prevent abuse.

On this website we collect only what you type into a form (for the waitlist: your email and, if you pick one, the Much you're most interested in) and the same kind of anonymous usage events. The website uses no advertising or tracking cookies.

• To run Much for you: save and sync what you log, calculate your totals, budgets, plans and progress, and show them back to you.
• To read what you give Much (a sentence, a voice note, a photo or a file) and turn it into entries for you to check and save.
• To write your insights: the weekly story, the morning insight and answers in Ask Much. Every number in them is calculated by our servers from your own data; the AI only puts it into words.
• To keep Much safe and reliable: sign-in, fair-use limits, preventing abuse, fixing errors.
• To improve Much, using anonymous usage events only.
• To contact you about your account (for example a sign-in code), and, if you joined the waitlist, once when Much is ready for your phone.

We don't use your data for advertising, we don't sell it, and we don't share it with data brokers. We don't use your health and fitness information for anything other than showing it back to you and explaining it.

Where the law asks for a legal basis (for example the GDPR in the European Union and the UK), we rely on: providing the service you asked for (your account and what you log); your consent (optional features such as AI reading, payment messages, health details, usage events, the waitlist), which you can withdraw at any time; and our legitimate interest in keeping Much secure.

Much uses AI to read what you tell it and to explain your numbers. Before Much sends anything to an AI provider for the first time, the app asks for your permission, and you can turn AI features off in Settings. Logging by hand keeps working without them.

When you use an AI feature, we send the provider only what's needed for that request: the sentence you typed, your voice note, the photo or file you chose, or, for insights and Ask Much, your question and the numbers our servers calculated. We don't send your name, email or account details.

• OpenAI: turning voice notes into text and understanding what you typed or said.
• Anthropic: Ask Much and your insights.
• Google (Gemini): reading receipts, nutrition labels, statements and food photos.

They process this for Much only, under terms that don't allow them to use it to train their models, and delete it after a limited period according to their own retention terms. Their answers are checked by our servers before you see them, and nothing an AI drafts is saved until you approve it.

Automatic capture is off until you turn it on, and Much explains what it reads before asking for any permission.

On Android, Much asks for notification access and reads only notifications that look like payments (bank, card and wallet alerts). On iPhone, you set up a Shortcuts automation that passes those notifications to Much. In both cases the message is read on your phone. Its full text is never sent to or stored on our servers.

Each payment waits in your review inbox. Only when you approve it are the details Much needs (amount, currency, merchant, account and time) saved as an entry. You can turn capture off at any time in Settings, or by removing notification access or the automation.

What you log in Much of Macros, and your body details, are health and fitness information. We use it only to show you your days, plans and progress and to explain them. We never use it for advertising or marketing, never sell it, and never share it except with the service providers below who help run Much. It is not stored in iCloud.

Much gives general information about food and nutrition. It is not medical advice and doesn't diagnose, treat or prevent any condition.

Much asks for a permission only when you use the feature that needs it, and explains why first. You can change any of them in your phone's settings.

• Camera: only when you take a photo of a receipt, a label or your food.
• Photos: only the photo you pick. Nothing else in your library is read.
• Microphone: only while a voice note is open. Nothing is recorded in the background.
• Face ID or fingerprint: only to unlock Much when you turn on App lock. Your biometric data stays on your phone and never reaches us.
• Notifications: to remind you of bills, insights and other things you choose.
• Notification access (Android): only if you turn on automatic capture.

We share data only with service providers that run parts of Much for us, under contracts that require them to protect it and use it only for Much:

• Supabase: our database, sign-in, file storage and server functions, hosted in the European Union (Frankfurt).
• OpenAI, Anthropic and Google: AI features, as described above.
• PostHog: anonymous usage events, hosted in the European Union.
• Resend: sending emails such as sign-in codes and the waitlist email.
• Apple and Google: Sign in with Apple and Google sign-in when you choose them, and the App Store and Google Play, which distribute the app.
• Our website host and its bot protection, for this website.

We may also disclose information if the law requires it, to protect people's safety, or as part of a merger or sale of Much, in which case this policy keeps applying to your data and we'll tell you first.

Your account and what you sync are stored in the European Union. Some providers, such as the AI providers, may process requests in other countries, including the United States. When that happens we rely on safeguards the law recognizes, such as the European Commission's Standard Contractual Clauses.

• Your account and everything you log: for as long as you have an account. You can delete single entries, everything, or your account at any time.
• When you delete your account: your data, files and sessions are removed from our servers within 30 days, including backups.
• Deleted entries: removed from our servers within 30 days, after every device you use has caught up.
• Weekly stories and recaps: removed shortly after you've read them, or when the next one arrives.
• Voice notes, food photos and imported files: read and then not kept on our servers. A receipt photo you attach to an entry stays with that entry until you delete it.
• Usage events: up to 24 months, then deleted.
• Security logs: up to 30 days.
• Waitlist emails: until we've written to say Much is ready for your phone, and never more than 12 months after launch, or sooner if you unsubscribe.

Data travels encrypted (TLS). On your phone, Much's data is stored in an encrypted database whose key stays in your phone's secure storage (Keychain on iPhone, Keystore on Android), so backups don't carry readable data. On our servers, every record can be read only by its owner's account, all changes go through checked server functions, and keys for outside services are never in the app. You can also lock Much with Face ID or a fingerprint.

No system is perfect, but if we ever learn of a breach that affects you, we'll tell you and the authorities as the law requires.

• See and export your data: Settings › Export.
• Correct it: edit any entry or detail in the app.
• Delete it: delete entries, reset everything, or delete your account in Settings › Delete account. You can also email us.
• Withdraw consent: turn off AI features, automatic capture or Share usage in Settings, or remove a permission in your phone's settings.
• Object or restrict, and complain: you can ask us to stop or limit some uses, and you can complain to your data protection authority (for example in Egypt, the Personal Data Protection Center under Law No. 151 of 2020; in the EU or the UK, your local authority).

To use any of these rights, use the app or write to hello@getmuch.app. We'll answer within 30 days and won't treat you differently for asking. We may ask you to confirm it's you first.

If you live in California or another US state with a privacy law: we don't sell or share personal information for cross-context advertising, and you have the rights above to know, correct and delete.

Much is not meant for children. You need to be at least 16 to use it. If we learn that someone younger has an account, we'll delete it. If you think that's happened, please tell us.

If we change this policy, we'll update the date at the top. If a change is important, we'll tell you in the app or by email before it takes effect.

Questions, requests or worries about your privacy: hello@getmuch.app. We read every message.