The short version:
your card data is yours alone.

KasCash (“the app,” “we,” or “us”) is a credit-card tracker for iPhone and Android. One screen for every card you own, every statement, every due date. Operated independently from Manila, Philippines.

This Privacy Policy applies to the KasCash iOS app on the App Store and the KasCash Android app on Google Play. The website at kascashapp.xyz is a marketing page; what it logs is described in section 07.

Whatever the sign-in option you choose hands us — and nothing more.

Sign-in option	What we receive	Why
Continue with Google	Your Google email, display name, and a unique Google account ID.	So we know it’s you on each return visit, and your data stays separate from anyone else who signs in on the same device.
Continue with Apple	A unique Apple user ID, plus — only the first time you sign in — your name and an email address (either your real one or Apple’s private relay address if you choose “Hide My Email”).	Same reason as Google. If you used Hide My Email, we never see your real address, and we don’t try to.
Continue as guest	A random anonymous ID generated by Firebase. No name, no email.	Lets you use the app without sharing anything personal.

That’s the full list of identifying information. We do not collect your phone number, address, location, contacts, photo library, browsing history, or device advertising IDs.

To know whether the app is working — which features get used, where people get stuck — the app sends pseudonymous usage events to Google Analytics for Firebase. Google attaches a random app-instance ID, your device model and OS version, and an approximate country derived from your connection. We also set two account-level properties: how many cards you have, and whether you’re on Pro.

What goes in	What doesn’t
Event name (e.g. sign_up, card_created, transaction_logged, paywall_viewed, notification_opened)	Your name, email, or any other identifier outside the random Firebase ID
Timestamp of the event	Card numbers, last 4, bank names, nicknames
Coarse labels such as the card network you picked, the transaction type, or the plan you tapped	Balances, credit limits, statement days, due days
Success or error code (so we can fix bugs)	Transaction amounts, merchants, memos, notes

Analytics never uses your device’s advertising ID (IDFA / AAID); that part of the SDK is removed from the app, so there is no App Tracking Transparency prompt.

Everything you type into KasCash lives in encrypted storage on your phone. If you sign in with Google or Apple, the same data is also synced to a private document in Google Cloud Firestore, keyed to your account, so it follows you to a new phone. Guest accounts are device-only — nothing below is uploaded.

Information	What it covers
Card metadata	Bank, nickname, last 4, expiry, network, credit limit, current balance, statement day, due day and due-date rules, color, notes
Transactions	Payments, purchases, and fees you record yourself
Reminder preferences	Which reminders are on for which card
Installments	Plans you add: name, category, term, and amounts
App settings	Theme, accent color, display preferences, name, email, monthly budget, currency, biometric lock, in-app reminder history
Profile photo	Optional. Saved to your device’s sandboxed storage. If you’re signed in, a copy syncs with the rest of your data so it shows on your other devices.

On the phone, storage is encrypted using your operating system’s native secure storage (iOS Keychain on iPhone, the Android Keystore equivalent on Android). Turn on the biometric app lock in Settings and the app demands Face ID, Touch ID, or your device passcode before any of this is decrypted.

Designed out of the app on purpose:

• Full card numbers. Last 4 digits only. There’s no field in the app to enter the rest.
• CVV / card verification codes. Never asked. Never stored.
• Bank login credentials. We don’t connect to your bank. No Plaid, no Yodlee, no MX, no aggregator of any kind. Your bank password never touches this app.
• Location. We don’t ask for it.
• Contacts or address book. We don’t ask for it.
• Your photo library. Beyond a profile picture you pick yourself — which stays on your device and, if you’re signed in, in your private synced copy.
• Advertising IDs. We don’t track you across other apps or sites. Ads on the free iPhone plan are non-personalized: at most one when you open the app each day, plus optional videos you choose to watch.
• Spending profiles. Analytics count that something happened, never amounts, merchants, or banks.

The Google account info or anonymous session ID we receive does one job: it lets the app recognize you across sessions and keep your data attached to the right account on the right device.

Synced card data does one job: it restores your cards when you sign in on another device. Usage events tell us which features are used and which paths to invest in. Referral records let us grant the free Pro months you or your friends earned. That’s it.

We don’t:

• Send marketing emails to your Google address
• Share your account ID with advertisers or data brokers
• Build a profile of your spending, card mix, or financial habits
• Sell, rent, or barter any of this information — under any circumstances

A small set, each with a specific job. Only Firestore holds your card data, and only for your own account.

Service	Role	What it sees
Google Sign-In	Verifies your identity when you tap “Continue with Google”	Your Google email, name, and account ID. Governed by Google’s Privacy Policy.
Sign in with Apple	Verifies your identity when you tap “Continue with Apple”	Your Apple user ID, plus name and email on first sign-in (subject to your “Hide My Email” choice). Governed by Apple’s Privacy Policy.
Firebase Authentication	Issues a session token after sign-in (Google, Apple, or anonymous)	The identifier above. Nothing else. Firebase Privacy.
Google Firestore	Stores your synced card data (section 04, signed-in accounts only) and your referral code and reward status	Keyed to your Firebase ID. Readable only by your account; referral status is written only by our servers.
Google Analytics for Firebase	Usage analytics from section 03	Event names, coarse labels, app-instance ID, device model, OS, approximate country. No advertising ID. Google’s Privacy Policy.
Google AdMob (iPhone, free plan)	Serves the free plan’s ads: at most one full-screen ad when you open the app each day, and the optional video you can watch to open a locked card for 24 hours	Only when an ad is requested: device and network information such as IP address, needed to deliver a non-personalized ad and prevent fraud. No account data, no card data, no advertising ID. How Google uses ad data.
RevenueCat	Verifies Pro subscriptions with Apple and Google	Your Firebase ID, the analytics app-instance ID, and purchase receipts. Never your card data. RevenueCat Privacy.
Amazon Web Services	Runs the small KasCash backend: referral codes and rewards, the current-promos list, the card-benefits catalog, and the daily quote notification	Your Firebase ID token on each request. The promos list and benefits catalog are the same for everyone — matching them to your cards happens on your phone, so no card data is sent. For the daily quote, your device’s push token and platform (iOS or Android), stored against your account so we can send it. When a referral activates, it reads your synced account only to confirm at least one card exists — nothing is copied or kept. AWS Privacy.
Expo push service	Relays the daily quote notification to Apple and Google’s push services	Your device’s push token and the notification text. No account or card data. Turn it off any time in your phone’s notification settings. Expo Privacy.
App Store & Google Play	Distribute the app, report installs and crashes	Whatever Apple and Google show developers in their consoles — aggregated, not user-identifying.

The marketing site at kascashapp.xyz takes no logins. Its home page loads the TikTok Pixel so we can measure our TikTok ads; TikTok may set a cookie and receives the page visit and basic browser details under TikTok’s Privacy Policy. Separately, the site logs one visit record per page per browser session: the page, device type, browser, OS, screen size, language, time zone, referring site, and an approximate city and country looked up from your IP address via ipwho.is. The IP address itself is not stored.

Three layers, in priority order:

• On-device encryption. Card data is written to your operating system’s secure storage (iOS Keychain, the Android Keystore equivalent). The encryption keys belong to the device and are tied to your unlock credentials.
• Per-account isolation. Each account’s data lives under its own keyed namespace, on the phone and in Firestore, where security rules block every account but yours. Switch accounts and you get a fresh, empty app.
• Biometric app lock (optional). Turn it on in Settings and Face ID, Touch ID, or your passcode is required every time the app opens — before any data is decrypted.

Sign-in and sync run against Google’s and Firebase’s production infrastructure over TLS, with short-lived session tokens. Firestore encrypts stored data at rest.

Found a security issue? Email kascashapp.ph@gmail.com. We respond within 72 hours.

Most of your controls live in the app:

• Access. Everything the app holds, including the synced copy, is visible inside the app. Nothing extra is kept about you.
• Export. To request a copy of your data, email kascashapp.ph@gmail.com — we’ll walk you through exporting it. A built-in download option is planned for a future update.
• Correct. Tap any card or transaction to edit it.
• Delete. Profile → “Delete my account” erases your account and its synced cloud copy. Uninstalling or signing out only clears the phone; your cloud copy stays until you delete the account.
• Delete analytics too. Email kascashapp.ph@gmail.com with your account email and we’ll request deletion of the usage events tied to your account.
• Revoke Google access. Open Google Account Permissions any time to disconnect KasCash from your Google account.
• Revoke Apple access. On your iPhone, open Settings → [Your Name] → Sign in with Apple → KasCash → Stop using Apple ID. The app also offers a “Delete my account” option that does the same thing in-app, as Apple requires.
• Disable notifications. Settings → Notifications → KasCash on your device.

If you’re in the EU, UK, California, or another jurisdiction with additional rights (access, rectification, erasure, portability, restriction, objection), email kascashapp.ph@gmail.com. We respond within 30 days.

KasCash is intended for users who are at least 16 years old and legally able to hold a credit card. We don’t direct the app at children under 13 and don’t knowingly collect anything from anyone under that age. If you’re a parent or guardian and you believe your child has used the app, get in touch and we’ll help you delete the account.

KasCash is operated from the Philippines. Your identity information, synced card data, and usage events may be handled on Google’s servers in the United States, the European Union, or other regions where Google operates — under Google’s own contractual data-transfer safeguards.

Your use of KasCash is subject to this policy. Users in jurisdictions requiring explicit consent for cross-border data transfers may contact us to exercise those rights.

When something material changes, we will:

• Update the Effective and Last updated dates at the top of this page
• Bump the Version
• Show a one-tap notice inside the app the next time you open it

Minor edits (typos, clarifications, dead-link fixes) bump the Last updated date but don’t trigger an in-app notice.

Questions, requests, security disclosures, or feedback on this policy — one inbox handles all of it during early access:

kascashapp.ph@gmail.com

We read every message. If you don’t hear back within 7 days, please try again — yours didn’t reach us.