Privacy Policy
1. Who Is Responsible for Your Data
TidyCent is developed and published by an individual developer operating as TidyCent Developer ("we", "us"). For the purposes of the GDPR, TidyCent Developer is the data controller for any personal data processed in connection with the app, except where a third-party service below (such as Google) acts as an independent controller for its own purposes (e.g. ad personalization, account-level fraud prevention, or payment processing).
Contact: ypacSupport@gmail.com
2. Information We Do Not Collect
TidyCent has no user accounts, no sign-in, and no cloud sync. All of the following stay only on your device, in a local Room/SQLite database, and are never transmitted to us or to any server we control:
- Transactions, amounts, notes, and dates you record
- Categories, icons, and colors you create or edit
- Accounts / ledgers you set up and their balances
- Currency and exchange-rate settings (auto/manual mode, saved rates)
- Budget, dashboard-period, and week-start preferences
- Your App Lock PIN (stored locally; we cannot see or recover it)
If you use the CSV export feature, the file is generated on your device and handed to Android's standard share sheet — it is sent only to the destination you choose (email, cloud drive, messaging app, etc.). We never receive a copy.
Uninstalling the app, or clearing its data in Android system settings, permanently deletes this information from your device. We hold no copy to restore it from.
3. Information Collected by Third-Party Services
TidyCent uses a small number of well-known third-party SDKs to keep the app stable, understand aggregate usage, show ads to free users, and process optional in-app purchases. These providers act as independent data processors or, in some cases (e.g. ad personalization, payments), independent controllers under their own privacy policies.
Firebase Crashlytics diagnostics
Automatically collects crash reports and error logs if the app crashes or hits an unexpected error: stack traces, device model, OS version, app version, and a Firebase-generated installation identifier. Used solely to find and fix bugs — never to identify you personally or to profile behaviour.
Firebase Analytics diagnostics
Collects aggregate, non-identifying usage statistics — which screens are opened, general feature usage, device model, OS version, app language, and an approximate country/region derived from IP address. Used to understand which parts of the app are useful; not linked to your financial data, which never leaves your device.
Google AdMob (advertising) ads consent-gated in EEA/UK
Free-tier users see banner and native ads served by Google AdMob. AdMob can collect an advertising identifier, IP address, general device information, and coarse location inferred from IP, and may use this to select and measure ads (personalized or non-personalized, depending on your consent/region). TidyCent uses Google's User Messaging Platform (UMP) to show an EU-standard consent form before requesting ads for users in the EEA, UK, and Switzerland, in line with the IAB Transparency & Consent Framework. Outside those regions, ads are governed by your device's Google Ads Settings.
TidyCent's Play Store listing is configured for a mixed audience that may include children under 13. For any ad request identified as coming from a child, TidyCent follows Google Play's Families Policies: only non-personalized, family-safe ads are requested, no interest-based profiling or remarketing data is collected, and the UMP consent form above is not shown to them, since a child cannot legally provide that consent. See Section 12 for more on children's privacy.
Google Play Billing payments
The optional one-time "lifetime Pro" purchase is processed entirely by Google Play. TidyCent never sees or stores your payment card, bank details, or Google account password — it only receives a purchase confirmation token from Google's Billing Library to unlock Pro features on your device.
Google Play In-App Review
May occasionally prompt you to rate the app via Google's standard in-app review dialog. Governed by Google Play's own privacy policy; TidyCent does not receive your review content or identity through this API.
Exchange-rate lookups
To convert between currencies, TidyCent queries the free public APIs Frankfurter and, for a few currencies Frankfurter doesn't cover, open.er-api.com. These requests contain only currency codes (e.g. "USD to EUR") — no personal or financial data, no API key, no account identifier.
Each provider's own privacy practices apply to the data described above: Google Privacy Policy, Firebase Privacy & Security, and How Google uses information from sites or apps that use our services.
4. App Permissions
TidyCent requests only two Android permissions:
| Permission | Why |
|---|---|
INTERNET | Fetch exchange rates, load ads, send crash/analytics reports, process purchases. |
ACCESS_NETWORK_STATE | Check connectivity before attempting network requests, so the app can fail gracefully offline. |
TidyCent does not request camera, microphone, contacts, precise location, SMS, or file-storage permissions.
5. Legal Basis for Processing (GDPR)
- Consent (Art. 6(1)(a)) — for personalized advertising and any non-essential measurement cookies/identifiers used by AdMob for EEA/UK/Swiss users, collected via the UMP consent form. You can withdraw this consent at any time (see Section 10).
- Legitimate interests (Art. 6(1)(f)) — for crash diagnostics (Crashlytics) and aggregate product analytics (Firebase Analytics), which we rely on to keep a free-to-use app stable and functional, balanced against your right to privacy through data minimization (no account, no financial data leaves your device).
- Performance of a contract (Art. 6(1)(b)) — for processing an in-app purchase you initiate through Google Play Billing.
- Children / COPPA and GDPR Art. 8 — TidyCent's store listing targets a mixed audience that may include children under 13. We never rely on a child's own consent for any processing: ads served to users identified as children are limited to non-personalized, Families-Policy-compliant ads (see Sections 3, 10, and 12), and no ad-personalization consent is solicited from them.
7. International Data Transfers
Google's infrastructure (Firebase, AdMob, Play Billing) may process data on servers located outside your country, including in the United States. Where this involves transferring personal data out of the EEA, UK, or Switzerland, Google relies on its own safeguards — including the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework — as described in Google's data processing terms. TidyCent Developer does not separately store or transfer your data internationally, since no user financial data is transmitted off your device.
8. Data Retention
- On-device data (transactions, categories, accounts, settings): retained until you delete it in-app, clear app data, or uninstall the app.
- Crashlytics reports: retained by Google for up to 90 days.
- Firebase Analytics events: retained per Google's default analytics retention window (currently 14 months), after which they are deleted or fully aggregated.
- Advertising identifiers processed by AdMob: retained per Google's advertising data policies, not by us.
9. Your Rights (GDPR and Beyond)
If you are located in the EEA, UK, or Switzerland, you have the right to:
- Access the personal data associated with you
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict or object to processing based on legitimate interests
- Data portability, where technically feasible
- Withdraw consent at any time, without affecting processing carried out before withdrawal
- Lodge a complaint with your national data protection supervisory authority
Because TidyCent stores your financial data only on your own device, you can already exercise access, rectification, and erasure directly in the app (edit or delete any transaction, category, or account) or by uninstalling the app / clearing its data. For requests concerning data held by our third-party processors (e.g. a Crashlytics report tied to an installation ID), contact us at the address in Section 14 and we will forward or assist with the request within one month, as required by Art. 12 GDPR.
Residents of California and other U.S. states with comparable privacy laws have similar rights to know, delete, and opt out of the "sale or sharing" of personal information; TidyCent does not sell personal information, and the ad-related choices in Section 10 apply equally here.
10. Managing Ads and Consent
- In-app: if you are in the EEA, UK, or Switzerland and went through the consent form, open Settings → Ads Privacy in TidyCent at any time to review or change your choice.
- Android device settings: go to Settings → Privacy → Ads (or Google → Ads on older versions) to opt out of personalized advertising or reset your advertising ID, which applies across all apps on your device.
- Google Ads Settings: manage ad personalization for your Google Account at myadcenter.google.com.
- Turning off personalized ads does not remove ads from the free version of TidyCent — it means the ads shown are no longer based on your interests. You can also remove ads entirely via the ad-supported 7-day unlock or the one-time Pro purchase in Settings.
- Children: if you are identified as a child (per the app's mixed-audience listing, see Section 12), you are never shown the ad-personalization consent form above — you are only ever served non-personalized, Families-Policy-compliant ads. This is enforced at the ad-request level, not something you need to configure.
11. Data Security
Your financial data is protected by Android's standard per-app sandboxing, so other apps cannot read TidyCent's local database. TidyCent additionally offers an optional in-app PIN lock (App Lock) you can enable in Settings for an extra layer of protection if someone else has physical access to your unlocked phone. No method of storage or transmission is 100% secure, but we do not transmit your financial data anywhere it could be intercepted in the first place.
12. Children's Privacy
TidyCent's Play Store listing is configured for a mixed audience that may include children under 13 (and under the higher age of digital consent that applies in some countries, e.g. 16 in parts of the EU), in line with Google Play's Target Audience and Content policies.
TidyCent has no accounts, no sign-in, and stores all financial data only on your device — so the app itself does not collect any personal data from children, or from anyone else. For advertising, we configure AdMob to follow Google Play's Families Policies and COPPA / GDPR Art. 8 requirements for any user identified as a child: only non-personalized, family-safe ads are requested, no interest-based profiling or remarketing data is collected, and no ad-personalization consent is solicited from them (see Sections 3 and 10).
Parents and guardians who believe a child has been shown advertising that doesn't meet these standards, or who have any question about this section, can contact us using the details in Section 14 and we will investigate and delete any data as needed.
13. Changes to This Policy
We may update this policy as the app evolves (e.g. new features or providers). Material changes will be reflected by updating the "Effective date" above; continued use of the app after changes take effect constitutes acceptance of the revised policy. We encourage you to review this page periodically.
14. Contact Us
Questions, requests, or complaints about this policy or your data: