Information We Collect
We collect the following categories of information when you use CashBook:
| Category | Data Collected | Purpose |
|---|---|---|
| Identity | Phone number, display name (optional) | Account creation & authentication via Firebase Phone Auth |
| Financial Records | Cash-in / Cash-out entries, amounts, notes, attachments, entry history | Core cashbook functionality stored in your Firestore documents |
| Device | FCM device token, OS type (iOS/Android) | Delivering push notifications for shared book activity |
| Media | Photos attached to entries (uploaded to Firebase Storage) | Receipt/evidence attachments for cash entries |
| Technical | App crash reports, sync errors (dev mode only) | Debugging and app stability |
- We do not collect your email address, full legal name, or government ID.
- We do not track your precise GPS location.
- We do not collect browsing history or third-party app data.
- We do not use advertising SDKs or analytics trackers.
How We Use Your Information
- Authentication: Your phone number is used solely to verify your identity through Firebase Phone Auth (OTP). We do not use it for marketing.
- Cashbook Sync: Your financial entries are stored in Firestore and synced in real time via an offline-first outbox mechanism.
- Collaboration: If you create or join a Group Book, invited members can view and add entries. You control who is invited.
- Push Notifications: Your FCM token is used to deliver notifications about cashbook activity. You can disable these at any time.
- PDF Exports: Reports are generated locally on your device and never uploaded to our servers unless you explicitly share them.
- App Improvement: Crash and error information (dev builds only) helps us identify and fix bugs.
Data Storage & Security
Your data is stored securely on Google Firebase infrastructure:
- Firestore Security Rules: Every read/write is protected by server-side rules. Only authenticated users can access their own documents.
- Firebase Storage Rules: Uploaded media is restricted to the owning user and authorized book members.
- TLS/HTTPS: All data in transit is encrypted end-to-end.
- AES-256 At-Rest: Firestore and Firebase Storage encrypt all stored data at rest.
- On-Device Security: Tokens are stored in the iOS Keychain / Android Keystore. The app blocks jailbroken/rooted devices and emulators.
- Concurrency Safety: Entries use UUID idempotency keys and optimistic versioning to prevent duplicate or conflicting writes.
Firebase services are hosted on Google Cloud infrastructure. Data may be stored in US, Europe, or Asia-Pacific data centers, subject to Google's standard DPA.
Data Sharing & Third Parties
We do not sell, rent, or trade your personal data. Sharing occurs only in these limited circumstances:
| Third Party | Data Shared | Purpose |
|---|---|---|
| Google Firebase Auth, Firestore, Storage, Cloud Functions, FCM | All app data | Backend infrastructure and cloud services |
| Book Collaborators Users you invite to a Group Book | Entry data within the shared book | Shared expense tracking - under your control |
| Legal Compliance Courts or government authorities | As required by law | Compliance with valid legal requests |
Push Notifications
CashBook uses Firebase Cloud Messaging (FCM) to deliver push notifications, including:
- New cash entry added by a collaborator to a shared book
- Entry updates or deletions in a shared book
- Invitation to join a new Group Book
- Member role changes within a book
Your FCM token is stored in Firestore and associated with your account. You can disable notifications at any time through your device settings without affecting core app functionality.
Data Retention
- Account Data: Retained while your account is active. Deletion initiates permanent removal within 30 days.
- Cashbook Entries: Retained until you delete the entry or book. Deleted entries are soft-deleted (
isDeleted: true) for sync integrity and permanently purged after 90 days. - Entry History: Stored in a Firestore subcollection and retained while the parent entry exists.
- Media Attachments: Deleted from Firebase Storage when the associated entry is permanently purged.
- FCM Tokens: Automatically invalidated by Firebase on sign-out or app uninstall.
Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access Request a copy of the personal data we hold about you.
- Correction Request correction of inaccurate or incomplete data.
- Deletion Request deletion of your account and associated personal data.
- Portability Request an export of your financial data in a structured format.
- Restriction Request restriction of processing in certain circumstances.
- Objection Object to processing based on legitimate interests.
Contact us at the address below to exercise any of these rights. We will respond within 30 days.
Children's Privacy
CashBook is intended for users aged 13 years and older. We do not knowingly collect data from children under 13. If we become aware of such collection, we will delete it promptly. If you believe we have collected data from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy periodically. When we do, we will revise the "Last Updated" date. For material changes, we will provide notice within the app. Continued use of CashBook after changes become effective constitutes your acceptance of the updated policy.