PRIVACY POLICY FOR PENNOTE

Effective Date: 28 April 2026
Last Updated: 01 May 2026

This Privacy Policy describes how Step Technovision ("we", "us", or "our") collects, uses, stores, and shares information when you use the Pennote mobile application ("App", "Pennote"), available on Google Play under the package name com.pennote.tracker.

By installing or using Pennote, you agree to this Privacy Policy. If you do not agree with any part of this policy, please uninstall the App and stop using it.

1. ABOUT PENNOTE
Pennote is a privacy-first personal finance application that helps users track expenses, plan budgets, manage subscriptions, and view spending insights. The App operates primarily offline and does not require any account, sign-up, or login. Financial data you enter is stored locally on your device.

2. INFORMATION WE COLLECT
We have designed Pennote to minimise data collection. Information falls into two categories.

2.1 Information Stored Only on Your Device
The following data is stored locally on your device using Android's standard SQLite database and SharedPreferences. It is never transmitted to our servers — we do not operate any servers that store user financial data:

- Transactions you log (amount, category, date, payment method, and any optional notes)
- Subscriptions and bills you add (name, amount, billing cycle, renewal dates, and notes)
- Budgets you set (monthly limits, category-specific limits)
- App preferences (theme, currency, notification settings, reminder times, biometric lock preference)
- Receipt or attachment images you choose to add to transactions or bills
- Your selected language and locale settings

You may delete this data at any time by clearing the App's storage in your device settings or by uninstalling the App.

2.2 Information Collected by Third-Party Services
Pennote integrates with the following third-party services, which may collect technical or aggregated data:

(a) Google AdMob — Advertising
We display advertisements through Google AdMob in the free version of Pennote. AdMob and the advertisers it serves may collect:
- Advertising Identifier (Android Advertising ID / AAID)
- IP address
- Device information (model, brand, OS version, language, country)
- Approximate location derived from your IP address (we do NOT collect precise GPS location)
- Ad-interaction data (impressions, clicks, time spent)

You can reset your Advertising ID or opt out of personalised advertising at any time in your Android device settings under Settings → Privacy → Ads.

AdMob's privacy policy: https://policies.google.com/technologies/ads
Google's privacy policy: https://policies.google.com/privacy

(b) Google Firebase — Analytics, Crashlytics, and Remote Config
We use Firebase to understand how users interact with Pennote and to detect and fix technical issues:

- Firebase Analytics: Aggregated, anonymised usage events (e.g. screens visited, features used, conversion funnels) along with device model, OS version, and country (derived from IP).
- Firebase Crashlytics: Crash reports including stack traces, device model, OS version, and a randomly assigned installation identifier. This helps us fix bugs.
- Firebase Remote Config: Used to deliver app configuration updates without releasing new versions. Does not collect personal user data.

Firebase privacy and security: https://firebase.google.com/support/privacy

(c) Google Play Billing — In-App Purchases
Subscriptions and in-app purchases are processed by Google Play. We do not receive your credit card or payment details. Google Play provides us only with a transaction identifier, the product purchased, and the purchase status (active / expired / refunded).

Google Play Terms of Service: https://play.google.com/intl/en-US_us/about/play-terms/
Google's privacy policy: https://policies.google.com/privacy

2.3 Information We Do NOT Collect
Pennote does not collect, store, or transmit:
- Your name, email address, phone number, or any contact details
- Your bank account, credit card, or debit card information
- Your SMS messages, call logs, or contacts
- Your precise GPS location
- Photos, videos, or files outside of receipts you explicitly attach within the App
- The actual text content of transactions, budgets, subscriptions, or notes
- Any biometric data — fingerprint and face authentication is processed entirely by your device's secure hardware

Pennote does not require an account, email, login, or user registration of any kind.

3. HOW WE USE INFORMATION
We use the limited data collected through third-party services to:
- Display advertisements (free version only)
- Detect, diagnose, and fix application crashes and bugs
- Understand which features are popular and how to improve the App
- Process in-app purchases and subscriptions through Google Play Billing
- A/B test new features, prices, and copy via Firebase Remote Config
- Comply with legal obligations and respond to lawful requests

We do NOT sell, rent, trade, or share your personal data with any third party for marketing purposes.
We do not send marketing emails. We do not engage in cross-app behavioural profiling.

4. PERMISSIONS WE REQUEST
Pennote requests the following Android permissions:
- INTERNET: To load advertisements, send anonymised analytics, check for app updates, and validate in-app purchases. Your transactions and financial data are never sent over the internet.
- POST_NOTIFICATIONS: To send daily summary reminders, bill due alerts, subscription renewal warnings, weekly recaps, and other notifications you have enabled.
- SCHEDULE_EXACT_ALARM and USE_EXACT_ALARM: To schedule notifications at the exact time you configure. If you decline this permission, notifications still work but may fire within a 15-minute window.
- RECEIVE_BOOT_COMPLETED: To re-schedule your notifications after your device restarts.
- USE_BIOMETRIC and USE_FINGERPRINT: To enable optional biometric app lock. Biometric data is processed entirely by your device's secure hardware and is never accessed, transmitted, or stored by Pennote.
- com.android.vending.BILLING: To process in-app subscriptions through Google Play.

You may grant or revoke any non-essential permission in your Android device settings.

5. DATA STORAGE AND SECURITY
All financial data you enter is stored locally on your device using Android's standard SQLite database. Receipt and bill image attachments are stored within the App's private storage directory, accessible only to Pennote.

Because your data is stored solely on your device:
- You are solely responsible for backing up your device data. Pennote does not provide cloud sync or remote backup.
- If you lose your device, change devices, or uninstall the App, your data may be permanently lost. We cannot recover, retrieve, or migrate your data without your explicit action.
- We do not have any access to your data and cannot retrieve it on your behalf.

We implement reasonable security measures within the App, including optional biometric/PIN locking. However, no security method is 100% impenetrable. We strongly recommend that you also use device-level security such as a screen lock, biometric authentication, and full-disk encryption.

6. SHARING OF INFORMATION
We do not share your personal financial data with anyone — we do not have it. The limited data collected by Google AdMob and Firebase is governed by their respective privacy policies (linked above).

We may disclose limited information if required to do so by law, court order, or governmental authority. As we do not store your financial data, the only data we could be compelled to share is the aggregated analytics described in Section 2.2.

We do not sell, lease, trade, or rent your personal data under any circumstances.

7. CHILDREN'S PRIVACY
Pennote is not directed to children under the age of 18 (or under the minimum age required by your jurisdiction, whichever is higher). We do not knowingly collect personal information from children.

In compliance with the U.S. Children's Online Privacy Protection Act (COPPA) and similar laws, the App is rated for users 18+ on Google Play.

If you believe a child has provided us with personal information, please contact us at steptechnovision@gmail.com and we will take prompt action to delete it.

8. INTERNATIONAL DATA TRANSFERS
Pennote is operated from India. Data collected by Google AdMob and Google Firebase may be processed in the United States and other countries where Google operates data centers. By using Pennote, you consent to the transfer of such data outside your country of residence.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the legal basis for our processing of your data is your consent (provided by your continued use of the App and acceptance of this policy) and our legitimate interest in providing, securing, and improving the App.

9. YOUR RIGHTS
Depending on your jurisdiction, you may have the following rights regarding your personal data:

For users in the European Economic Area (EEA), United Kingdom, and Switzerland (under GDPR / UK GDPR):
- Right to access, correct, delete, or restrict processing of your personal data
- Right to data portability
- Right to object to processing
- Right to withdraw consent at any time
- Right to lodge a complaint with your local data protection authority

For California residents (under the CCPA / CPRA):
- Right to know what personal information is collected and how it is used
- Right to delete personal information
- Right to opt out of the sale or sharing of personal information (we do not sell or share personal information)
- Right to non-discrimination for exercising your privacy rights
- Right to limit use of sensitive personal information

For India residents (under the Digital Personal Data Protection Act, 2023):
- Right to access information about your personal data
- Right to correction and erasure
- Right to grievance redressal
- Right to nominate another individual to exercise your rights

To exercise any of these rights, contact us at steptechnovision@gmail.com. Because most of your data is stored only on your device, you can exercise the right to deletion immediately by clearing the App's storage or by uninstalling the App.

10. DATA RETENTION
- On-device data: Retained until you delete it or uninstall the App.
- Firebase Analytics data: Retained per Google's defaults (currently up to 14 months).
- Firebase Crashlytics data: Retained for up to 90 days.
- Google AdMob data: Retained per Google's policies.

We retain data only for as long as necessary for the purposes described in this policy or as required by law.

11. ACCOUNT DELETION
Pennote does not require an account or sign-up. To delete all your data:
- Open your Android Settings → Apps → Pennote → Storage → Clear Storage. This deletes all your transactions, settings, and attachments immediately.
- Or simply uninstall the App. All on-device data is erased automatically.

For any data potentially held by Google AdMob or Firebase, please contact us at steptechnovision@gmail.com and we will request its deletion in compliance with applicable law.

12. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Update the "Last Updated" date at the top of this policy
- Where significant, display an in-App notice to you
- For substantial changes affecting how we handle your data, we may seek your renewed consent

Your continued use of the App after changes have been posted constitutes your acceptance of the updated Privacy Policy.

13. CONTACT US
If you have any questions, concerns, complaints, or requests regarding this Privacy Policy, your data, or your rights, please contact us at:

Step Technovision
Email: steptechnovision@gmail.com

We respond to privacy enquiries within 30 days, in accordance with applicable data protection laws.