Privacy Policy

Last updated: October 4, 2026  |  Effective: August 30, 2026

Welcome to Maliaty ("the App", "we", "our", "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and associated website. Please read this policy carefully. If you disagree with its terms, please discontinue use of the App.

1. Our Privacy-First Principle

Maliaty is architected as an offline-first application. All financial data — transactions, budgets, wallets, savings goals, and settings — is stored locally using Drift and a SQLCipher-encrypted database on Android. Zero mandatory cloud uploads. We do not have access to this data unless you explicitly enable cloud synchronization.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: If you create an account, we collect your email address and display name for authentication purposes (via Firebase Authentication).
• Financial Data (Local Only by Default): Transactions, categories, budgets, goals, and wallet information — stored locally and never transmitted without your consent.
• Local Assistant and Insights: The first release processes financial summaries on your device. It does not ask for a personal API key or an external AI subscription.

2.2 Information Collected Automatically

• Crash Reports: We may collect anonymized crash logs to improve stability. These logs do not contain financial data.
• App Version & Device Type: Used for compatibility and support purposes only.

2.3 Information We Do NOT Collect

• Your transaction history, balances, or budgets (without cloud sync enabled)
• Location data
• Contacts or messages
• Browsing history or device identifiers for advertising
• Biometric data (processed entirely on-device by your OS)

3. Cloud Synchronization (Optional)

Maliaty offers an optional Cloud Sync feature powered by Google Firebase Firestore. If you enable this feature:

• Your financial data is encrypted in transit using TLS 1.3.
• Data is stored in Google's Firestore with at-rest encryption (AES-256).
• You control which data is synced via the Settings screen.
• Disabling sync does not delete data already uploaded. Account-deletion availability and scope are explained on the deletion page.
• Cloud data is governed by Google's Privacy Policy.

4. Local Assistant and Financial Insights

The first release provides local financial summaries, assistant responses and projections. This processing stays on your device and does not send prompts or financial context to a cloud AI provider. Optional Firebase synchronization is a separate feature described above.

Cloud chat is not available in the first release. Before any future cloud AI service is enabled, its provider, data sharing, consent and retention arrangements must be disclosed separately. Provider credentials must remain on the server and must not be supplied by users or embedded in the app.

5. Biometric Authentication

Maliaty uses your device's native biometric authentication (Face ID, Touch ID, or fingerprint). Biometric data is processed entirely by your device's operating system secure enclave. Maliaty never has access to raw biometric data.

6. Account Deletion and Retention — Draft Update

See the Maliaty account deletion request page, accessible without installing the app. You can start a request by email to support.maliaty@gmail.com. The form opens a prepared email; you must review and send it yourself. Opening email does not confirm submission or deletion. Account ownership must be verified before deletion; a typed address or sender address alone is not proof. In-app automated deletion remains inactive pending separate server activation and production verification.

After activation and identity verification, the reviewed server flow deletes the Firebase Authentication account, its Firestore profile and descendants, and associated cloud-assistant quota records. App-local cleanup removes only records reliably attributed to that account when the app executes cleanup. A web request cannot erase data on other devices. Disabling synchronization alone does not delete existing cloud data.

Shared or unknown-owner data, exported/shared copies, recovery archives, legacy backups, SDK caches and freed storage pages may remain. Temporary files, notifications, service/crash/provider logs and backups need separate review. Minimal deletion jobs and locks remain for retry and preventing data recreation. Processing deadlines, retention periods and reasons for these remaining categories still need approval; emailing a request does not guarantee a deletion date. No complete or forensic-erasure promise is made. Partial failures remain pending; confirmed cloud/account progress is reported separately.

7. Data Sharing

We do not sell, trade, rent, or otherwise transfer your personal information to third parties for advertising, marketing, or commercial purposes. We may share information only in the following limited circumstances:

• Service Providers: Google Firebase (authentication and optional sync), subject to their privacy policies.
• Legal Requirements: If required by law, court order, or governmental authority.
• Business Transfer: In the event of a merger or acquisition, user data would be subject to the successor's privacy policy.

8. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion by email to the approved support address on the deletion page. Ownership verification and retained-data limits apply; sending a request is not confirmation of deletion.
• Export your local data via Settings → Export Data (CSV/PDF).
• Control optional synchronization in the app settings. Local assistant processing does not send financial context to an external AI provider in the first release.

To exercise your rights, contact us at privacy@maliaty.app.

9. Children's Privacy

Maliaty is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

10. International Data Transfers

If you use cloud sync, your data may be processed in data centers operated by Google Firebase, which may be located outside your country of residence. Such transfers are subject to Google's data processing agreements and applicable data protection laws.

11. Security

We implement industry-standard security measures including:

• AES-256 encryption for local database (SQLCipher)
• TLS 1.3 for all network communications
• Biometric authentication at app level
• Secure OS-level key storage (Keychain/Keystore)
• No advertising SDKs or third-party analytics that access financial data

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date at the top of this page and, where appropriate, via in-app notification. Your continued use of the App after such changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@maliaty.app
• Support: support.maliaty@gmail.com