Information We Collect
We collect and process the following categories of information when you use CashBook:
| Category | Data Collected | Purpose & Processing Details |
|---|---|---|
| Identity & Authentication | Phone number, optional display name | Account creation, SMS one-time passcode (OTP) verification via Firebase Phone Authentication, and user identification within cashbooks. |
| Financial Records | Cash-in / cash-out transaction amounts, entry types, categories, payment modes, timestamps, remarks, and entry edit history | Core cashbook functionality. Stored in your Google Cloud Firestore documents and synced across devices using an offline-first architecture. |
| Device & App Identifiers | Firebase Cloud Messaging (FCM) push token, stable installation device identifier, OS type (iOS/Android), OS version, device model, and app version | Routing push notifications for shared book activity, managing multi-device sessions, and ensuring compatibility. |
| Media & Receipts | Receipt photos and document images attached to cash entries | Stored in Google Firebase Cloud Storage and accessible only by you and authorized members of that specific cashbook. |
| Usage & Diagnostic Analytics | App navigation events (screen views, feature interactions, user journey milestones), pseudonymous app instance IDs, crash logs, and sync error diagnostics | Monitoring app stability, identifying usability friction points in user journeys, diagnosing sync issues, and improving app performance via Firebase Crashlytics and Google Analytics for Firebase. |
| Contacts (On-Device Only) | Contact names and phone numbers selected from your device address book | Used strictly in-memory on your device when you choose "Add from Contacts" to invite members to a Group Book. Your address book is never uploaded or stored on our servers. |
We use Firebase Cloud Messaging (FCM), provided by Google, to deliver notifications about shared cashbook activity (such as new entries recorded by collaborators, member invitations, and role updates). This service processes notification tokens and app installation identifiers. We associate your notification token with your account in Firestore to deliver relevant notifications. Firebase may also process device and app metadata necessary to route and operate the notification service reliably.
We use Google Analytics for Firebase to understand how users navigate CashBook and use its features, identify difficulties in user journeys, and improve the app experience. Depending on app version and configuration, collected information includes pseudonymous app instance identifiers, screen views, user interaction events, session duration, and device/app metadata (such as device model, OS version, and coarse country/region inferred from standard IP routing).
Analytics information is evaluated in aggregate to understand user workflows and app reliability. Analytics events do not record sensitive financial amounts, transaction remarks, or receipt image contents.
- We do not collect your email address, legal surname, or government identification numbers.
- We do not collect or track your precise GPS location (coarse geographic region may be inferred from standard IP routing by network infrastructure).
- We do not collect web browsing history or activity across third-party applications.
- We do not upload your entire contact book to our servers; contacts are accessed only locally on-demand when you explicitly invite members.
- We do not use third-party advertising SDKs, serve advertisements, or sell your personal data.
How We Use Your Information
- Authentication: Your phone number is used to verify your identity via Firebase Phone Auth (SMS OTP) and create your secure account record. We do not use your phone number for marketing or promotional SMS.
- Cashbook Synchronization: Your cash transactions and balances are stored in Firestore and synced across your authorized devices using an offline-first outbox mechanism.
- Collaboration & Group Books: When you create or join a Group Book, authorized members can view, add, or edit entries and attachments according to their assigned role (Owner, Admin, Member, or Viewer).
- Push Notifications: Your FCM token is used to dispatch alerts about book invitations, member role changes, and entries added or updated by collaborators. You can toggle notifications off at any time in system settings.
- Local PDF & Excel Reports: Cashbook summary reports and receipts are generated entirely locally on your device and are never uploaded to our servers unless you explicitly share or export them.
- Usage Analytics: We use app interaction information to understand feature usage and user journeys, identify usability problems, and improve CashBook. Analytics data is collected pseudonymously and does not include your financial entry amounts or receipt media. You can control analytics and app tracking permissions through your device's operating system settings or by contacting our support team.
- Diagnostics & Stability: Crash reports and synchronization error logs (via Firebase Crashlytics) help us investigate bugs, prevent data conflicts, and keep the app reliable.
Data Storage & Security
We use industry-standard technical, administrative, and physical safeguards provided by Google Firebase & Google Cloud Platform to protect your data:
- Encryption in Transit: We use HTTPS/TLS protocols to protect all data transmitted between the CashBook app and cloud service servers against interception.
- Encryption at Rest: Cloud databases (Firestore) and file storage (Firebase Storage) employ standard AES-256 server-side encryption at rest.
- Server-Side Access Control: Firestore Security Rules and Storage Rules enforce strict authorization. Only verified users can access their own accounts and the specific shared books they have been invited to.
- On-Device Credential Security: Sensitive session tokens are protected on your device using hardware-backed key storage (iOS Keychain and Android Keystore).
- Device Integrity Verification: The application includes security checks to detect compromised (rooted or jailbroken) operating environments to safeguard data integrity.
- Concurrency & Idempotency Controls: All writes use UUID idempotency keys and version checking to prevent duplicate transactions and race conditions during offline synchronization.
Our cloud infrastructure is hosted on Google Cloud Platform facilities located across regions supported by Firebase (including the United States, Europe, and Asia-Pacific). Where data is transferred across borders, transfers are governed by Google's Data Processing and Security Terms and Standard Contractual Clauses (SCCs) to ensure equivalent data protection.
Data Sharing & Third Parties
We do not sell, rent, or trade your personal information. We share data only with the third parties and service providers described below:
| Third Party / Provider | Specific Data Shared | Purpose & Safeguards |
|---|---|---|
| Google Firebase Authentication | Phone number, verification tokens | User authentication and OTP delivery. Governed by Google's Cloud Data Processing Addendum. |
| Google Cloud Firestore & Cloud Functions | User profile (display name), cashbooks, financial entries, amounts, categories, and audit logs | Cloud database synchronization, automated notification triggers, and transactional backend operations. |
| Google Firebase Cloud Storage | Receipt photo attachments and document images | Encrypted cloud storage for transaction receipts, accessible only to authorized book members. |
| Google Firebase Cloud Messaging (FCM) | FCM push notification tokens, device installation identifiers | Routing push notifications regarding shared book changes and invitations. |
| Google Analytics for Firebase & Crashlytics | Pseudonymous app instance IDs, interaction events, crash traces, and device OS/hardware metadata | Measuring user journeys, analyzing app stability, and fixing software errors. Financial transaction values are excluded. |
| Book Collaborators | Transaction records, amounts, categories, dates, remarks, and receipt photos within shared books | Collaborative bookkeeping. Invited members can access entries strictly within the books they belong to, according to their assigned role. |
| Legal Compliance | Necessary account or transaction records as legally mandated | Disclosure strictly when required to comply with a valid court order, subpoena, law, or regulatory authority. |
All third-party service providers (Google Firebase and Google Cloud Platform) operate under enterprise service agreements and data processing terms that require them to implement technical and organizational measures providing an equivalent level of security and privacy protection as set forth in this policy.
Push Notifications
CashBook uses Firebase Cloud Messaging (FCM) to keep collaborators synchronized on shared financial records, including:
- New cash entries recorded by collaborators in a shared Group Book
- Modifications or deletions of existing entries in a shared book
- Invitations to join a new cashbook
- Member role and permission updates within a shared book
Your FCM token is linked to your account in Firestore. When you sign out of CashBook, our app marks your device token inactive in the database so that push notifications cease for that device. If you uninstall the app or revoke notification permissions in your device settings, notification delivery to your device stops.
Please note that disabling notification permissions within operating system settings stops alerts from appearing on your screen, but does not immediately remove previously stored device tokens from our database until updated or cleared during account deletion or maintenance.
Data Retention
We retain your information in accordance with the following schedules and operational requirements:
- Account Data & Deletion: Retained while your account remains active. You can initiate deletion of your CashBook account directly inside the app by navigating to Settings > Delete Account, or by emailing our support team at weappsupport@gmail.com. Upon confirmation, your user profile (phone number, display name), device notification tokens, and all private cashbooks owned solely by you are permanently deleted within 30 days. Account deletion overrides normal soft-deletion retention for your personal records.
- Shared Books & Collaborative Ledgers: In a shared Group Book, entries and receipts you created form part of a shared financial ledger relied upon by other book members. To maintain ledger continuity and accounting integrity for the group, entries you recorded in shared books remain visible to remaining book members after your account is deleted; however, your personal identity is disassociated and displayed as a removed user. If you are the owner of a shared book, you should transfer ownership or delete the book before requesting account deletion.
-
Individual Entry & Book Deletion (Soft-Delete vs. Purge): When you delete an individual entry or book inside the app, it is initially soft-deleted (
isDeleted: true) to ensure offline devices sync changes reliably without causing sync conflicts. Soft-deleted records are immediately hidden from your active views and balances, and are permanently purged during scheduled maintenance. - Media Attachments & Entry History: Entry revision history is retained while the entry exists. When an entry is permanently purged, its associated history and Firebase Storage receipt attachments are permanently deleted.
- Analytics Information: Event data processed by Google Analytics for Firebase is retained in pseudonymous, aggregated form for up to 14 months (standard Google Analytics retention period) and automatically deleted thereafter.
Your Rights
Depending on your jurisdiction, you have specific rights regarding your personal information:
- Access Request confirmation of whether we process your data and obtain a copy of your personal information.
- Correction Request correction of incomplete, inaccurate, or outdated personal information.
- Deletion Request permanent deletion of your account and personal records.
- Portability Export your financial transaction data anytime via the app's local PDF or Excel report generator.
- Restriction Request that we restrict processing of your information under certain statutory circumstances.
- Objection Object to specific data processing activities based on legitimate interests.
To exercise any of these rights, or to submit a data deletion request, you can delete your account directly in the app under Settings > Delete Account, or contact us at weappsupport@gmail.com. We verify requester identity before processing requests and respond within 30 days.
Children's Privacy
CashBook is designed and intended for users aged 13 years and older (or the minimum legal age required in your country). We do not knowingly collect or solicit personal information from children under 13. If we discover that personal data of a child under 13 has been collected without verifiable parental consent, we will promptly delete that information. If you believe a child has provided us with personal information, please notify us immediately at weappsupport@gmail.com.
Changes to This Policy
We may amend or update this Privacy Policy from time to time to reflect modifications to our app features, underlying technology, or statutory requirements. When changes are made, we will revise the "Last Updated" date at the top of this policy.
For material changes that affect how your personal data is handled, we will provide prominent notice within the CashBook mobile application (such as an in-app alert or notification). Where required by applicable data protection laws, we will seek your explicit consent before applying new material data processing practices.
Contact Us
Have questions, feedback, or privacy rights requests? Our Data Protection and Support team is here to assist you.