Privacy Policy

ManualFlow: Cash Tracker · Effective date: August 10, 2025

Introduction

This policy explains how ManualFlow: Cash Tracker ("we", "our", "the App") handles information when you use our mobile application.

Information we collect

We do not collect or store any of your personal data. The data collection described below is performed by third-party services (Google/Firebase), not by us.

1. Financial data (local storage only)

The following is stored only on your device and is never transmitted to us or to any server we operate:

• Account information (names, balances, types)
• Transaction data (income, expenses, amounts, dates, categories)
• Budget information
• Financial goals and savings data
• Custom categories and tags
• Preferences and settings

We have no access to this data.

2. Third-party service data (not collected by us)

These services collect anonymous technical data for app functionality:

• Firebase Analytics (Google): app usage patterns (screens viewed, features used), session duration and frequency, device information (model, OS version, app version), anonymous engagement metrics.
• Firebase Crashlytics (Google): crash reports and error logs, device state at the time of a crash, app version and build information.
• Firebase Performance Monitoring (Google): startup times and screen load performance, network request performance, memory and CPU usage patterns.
• Google AdMob (advertising): advertising ID for ad targeting, IP address and general location (country or region), ad interaction data (views, clicks), device information for ad compatibility.
• Google User Messaging Platform (UMP): consent status for personalized ads, privacy preference settings, regional compliance data.

3. Local security features (no data transmitted)

• Biometric authentication: your fingerprint or face data never leaves your device.
• App lock: PIN or password stored locally in encrypted form.
• Data encryption: local data is encrypted using device security.

4. Optional Google Drive backup

If you enable Google Drive backup (optional):

• Your encrypted backup files are stored in your own Google Drive.
• We have no access to your Google Drive or backup files.
• Access is managed entirely through Google's OAuth system.
• You can disable and delete backups at any time.

How we use information

We do not use your information because we do not collect personal data. Third-party services use the anonymous technical data they collect for:

• App functionality: making sure the app works across devices and OS versions.
• Crash prevention: finding and fixing bugs.
• Performance: improving speed and responsiveness.
• Analytics: understanding general usage patterns (no personal data).
• Advertising: showing ads through Google AdMob, based on an anonymous advertising ID.
• Compliance: meeting legal obligations for privacy regulations.

What we do not do: we do not see your financial data, store your personal information, run servers with your data, sell your data, track your personal identity, or access your Google Drive backups.

Data storage and security

• All financial data is stored locally in a database on your device.
• Data is protected by your device security (PIN, fingerprint, etc.). We recommend device encryption and a screen lock.
• You can export or back up your data locally at any time.

Third-party services

These services may process data under their own privacy policies:

• Firebase Analytics, Firebase Crashlytics, Firebase Performance Monitoring
• Google AdMob
• Google User Messaging Platform (UMP)
• Google Drive API (optional, only if you opt in)
• Google Play Services
• Google Play Core (in-app review prompts)

Other libraries (AndroidX Biometric, Material Design Components, Kotlin Coroutines, Jetpack Compose, Realm Database, WorkManager) operate locally on your device and do not transmit information. Only the Google services listed above may collect and process user data. Their data is anonymous or pseudonymous.

Data sharing and disclosure

We have no personal data to share. We do not share or sell your financial data, we have nothing to provide to law enforcement, and we do not provide data to marketing companies. Firebase/Google process anonymous technical data under Google's privacy policy. AdMob uses the advertising ID for ad personalization under Google's advertising policies. Your Google Drive stores your encrypted backups in your account if you enable that feature.

Your rights and choices

• Access: view all your data in the app.
• Export: export your data as CSV, create complete JSON backups, or generate PDF reports.
• Delete: delete any or all data directly in the app.
• Analytics, crash reports, performance monitoring: you can disable each in app settings.
• Personalized ads: opt out through your device advertising settings (Android: Google Settings, Ads), the AdMob consent dialog, or app settings.
• Google Drive backup: disable and delete backups at any time in app settings.
• Biometric authentication: enable or disable in app settings.
• Complete opt-out: uninstall the app to stop all data collection.

Children's privacy

The App is not intended for children under 13. We do not knowingly collect personal information from children under 13. No account is required, all data is stored locally, and there are no social features. If you believe your child has used the app, delete it from the device to remove all local data, or contact us at appkadag@gmail.com.

International data transfers

We do not transfer personal data internationally. Google operates data centers worldwide, mainly in the United States and the European Union, and uses standard contractual clauses and adequacy decisions for international transfers. If you use Google Drive backup, its location is governed by your Google account settings. Your financial data never takes part in international transfers because it never leaves your device.

App permissions

Required:

• INTERNET: for Firebase Analytics, AdMob ads and Google Drive backup (if enabled).
• ACCESS_NETWORK_STATE: to check connectivity before cloud operations.
• WAKE_LOCK: to prevent device sleep during backup or export.
• BILLING: reserved for premium features.

Optional:

• USE_BIOMETRIC: fingerprint or face unlock, only if you enable app lock.
• WRITE_EXTERNAL_STORAGE: to save export files, only when you export data.
• CAMERA: reserved for a future receipt scanning feature (not implemented).
• GET_ACCOUNTS: for Google Drive backup authentication, only if you enable backup.

We do not request location, contacts, SMS, phone, calendar or microphone access.

Data retention

• On your device: transactions, accounts, categories and settings stay until you delete them or uninstall the app.
• Firebase Analytics: deleted automatically after 14 months.
• Firebase Crashlytics and Performance: deleted automatically after 90 days.
• AdMob: retained under Google AdMob's policies (typically 13 months).
• UMP consent records: up to 13 months.
• Google Drive backups: kept until you delete them from your Google Drive.

Local data is deleted immediately when you use the app's delete functions, and when you uninstall the app. To request deletion of data tied to your Firebase installation ID, contact us.

Your consent

By using ManualFlow: Cash Tracker, you consent to the collection and use of anonymous analytics data, the display of ads through AdMob, and the processing of crash reports for app improvement.

Exercising your privacy rights

Because we do not collect personal data, most requests do not apply to us. You can ask us how to contact Firebase/Google about their data collection, for instructions to remove all app data from your device, or report a privacy concern. To reach the providers directly, see the Google Account Help Center, Google Ad Settings and privacy.google.com.

Security

• Financial data is stored in encrypted databases on your device.
• Optional biometric or PIN protection for app access.
• Network communication uses HTTPS.
• App code is obfuscated.
• We release regular updates to address vulnerabilities.

We have no servers and collect no personal data, so there is nothing for us to breach. Security incidents at Google/Firebase could only affect anonymous technical data and would be handled by Google. Your transaction data is never involved.

Legal basis (GDPR, EEA, UK, Switzerland)

• Consent (Art. 6(1)(a)): analytics, personalized advertising, optional features such as Google Drive backup.
• Contract (Art. 6(1)(b)): core app functionality.
• Legitimate interests (Art. 6(1)(f)): crash reporting, performance monitoring, security, app improvement.
• Legal compliance (Art. 6(1)(c)).

Your rights: access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and the right to lodge a complaint with your local Data Protection Authority.

California (CCPA/CPRA)

California residents may request to know, delete or correct personal information, opt out of sale or sharing (we do not sell your data), limit use of sensitive information, and not be discriminated against for exercising these rights. Categories processed by third-party services: identifiers (device identifiers, advertising ID, Firebase installation ID), internet activity (app usage, ad interaction), general geolocation (country or region), and inferences from usage.

Other regions

Users in Brazil (LGPD), Canada (PIPEDA) and Australia (Privacy Act 1988) have rights of access, correction and, where applicable, deletion and portability. Contact us to exercise them.

Changes to this policy

We may update this policy. We will update the effective date, show an in-app notice for significant changes, and ask for your consent for material changes that affect your rights.

Contact