Privacy Policy

1. Introduction

Smart Vault ("we", "our", or "us") is a digital receipt vault application developed by Aimpulse Studio. This Privacy Policy explains what information the Smart Vault mobile application ("App") handles, where it goes, and how it is protected.

Your receipt records and receipt images are encrypted on your device with a key that only your device holds before they are uploaded to our cloud storage. To read the text on a receipt you scan, the App sends the receipt image to Google's AI service (see section 3).

2. Information We Collect

2.1 Information You Provide

• Account Data: When you sign in with Google, Firebase Authentication receives your Google account's email address, name and profile photo. We use them only to sign you in and keep your vault linked to your account. The App asks Google for nothing else, and we do not use this data for advertising or share it beyond section 5.
• Receipt Data: Receipt details such as merchant name, date, amounts and line items. These are encrypted on your device before they are stored.
• Receipt Images: Photos of receipts you capture or pick from your gallery. These are encrypted on your device before they are uploaded.

2.2 Information Stored Without Encryption

• Timestamps: The time each receipt record is saved, used to sort your receipts.
• File details: The number and size of the encrypted image files stored for your account.
• AI usage records: For each AI scan, the model name, the number of AI tokens used, the estimated cost and the date, linked to your account ID. These records contain no receipt content.

The App does not use analytics or advertising SDKs, and does not include crash-reporting tools.

3. How We Use Your Information

• Authentication: To sign you in and keep each user's data separate.
• Receipt Storage: To store your encrypted receipts and images in the cloud so you can access them again, including after reinstalling.
• Reading receipts with AI: When you scan or upload a receipt photo, the App sends the image to Google Gemini (through Google Firebase AI Logic) to extract the receipt details. The image leaves your device unencrypted for this step. We use Google's paid Gemini API, under whose terms Google does not use the image or the result to improve its products. Google keeps requests for up to 55 days to detect abuse, authorized Google staff may review content flagged for abuse, and Google may store or cache the data in any country where it has facilities. If the AI service is unavailable, the App reads the receipt on your device instead.
• QR receipts: For Egyptian e-receipts, the App fetches the receipt from the Egyptian Tax Authority (ETA) using the code in the QR. Saudi ZATCA QR codes are decoded on your device; nothing is sent.

4. Data Storage and Security

• Encryption: Receipt records and images are encrypted with AES-256 on your device before they are stored in Google Firebase (Cloud Firestore and Cloud Storage).
• Key protection: The key is kept in your device's secure storage. The App asks for your PIN or, if you turn it on, your fingerprint before showing your receipts.
• Deadline reminders: If you turn them on, reminders before a return window or warranty ends are scheduled on your device only. Nothing about them is sent to us, and they show no receipt details, not even the shop's name.
• Cloud provider: Encrypted data is stored on Google Firebase infrastructure.
• No server-side decryption: We do not hold your encryption key and cannot decrypt your stored receipts or images.
• Exports: PDFs, images or text you export or share from the App are not encrypted. They are handled by the app or person you share them with.

5. Data Sharing

We do not sell or trade your personal data. Data is shared only with:

• Google (Firebase): For sign-in and encrypted data storage, and to check that requests come from a genuine copy of the App on a genuine device (Firebase App Check with Google Play Integrity). Governed by Firebase's privacy and security terms.
• Google (Gemini AI): Receipt images you scan, to extract receipt details (section 3).
• Egyptian Tax Authority: The receipt code from an ETA QR you scan, to fetch that receipt.
• Legal Requirements: If required by law, court order, or governmental authority.

6. Your Choices

• Access: View all your stored receipts within the App.
• Export: Export your receipts as PDF or share them from the App.
• Reminders: Turn deadline reminders on or off in Settings. Turning them off removes every scheduled reminder.
• Delete: Delete individual receipts, or all receipts with their images and quick captures, from within the App. See our Data Deletion Policy for exactly what each option removes.
• Account Deletion: Delete your account and all data stored for it in the App under Settings → Delete Account, or email us (section 7).

7. Data Retention

We keep your encrypted data for as long as your account exists. When you delete your account in the App (Settings → Delete Account), we immediately delete your sign-in record, encrypted receipt records, encrypted images and AI usage records. Deleted image files stay encrypted in Google Cloud's deletion safety net for up to 7 days before they are erased for good. If you cannot use the App, email info@aimpulse.io from the email address you sign in with and we will do the same within 30 days. In-app "Delete All Data" does not delete your account or AI usage records; see the Data Deletion Policy.

8. Children's Privacy

Smart Vault is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top shows the latest version. Continued use of the App after changes means you accept the updated policy.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: info@aimpulse.io