Privacy Policy

Proof Panda ("the app", "we", "us") is a local-first money and records app: a simple budget plus a vault for your receipts, warranties, return windows, tax records, and important documents. This policy explains what the app does and does not do with your information.

Who we are

Proof Panda is made by Pondering Phoenix, a sole proprietorship based in Ontario, Canada. Pondering Phoenix is responsible for this app and for this policy.

• Privacy contact: the owner of Pondering Phoenix, who is the person accountable for privacy at Proof Panda.
• Email: [email protected] (a real person reads every message).

Information we collect

We don't collect your records. Proof Panda has no user accounts, no analytics, no advertising, and no tracking SDK. Your records (receipts and photos, warranties, returns, budgets, income, savings and debts, Proof Vault documents and attachments, and Password Vault entries) are never sent to us or anyone else.

What does leave your phone: the Pro purchase check. On the Android and iPhone apps, Proof Panda connects to RevenueCat only when you open the Pro screen, buy Pro, or tap Restore. If you have bought Pro, the app also re-checks it when it starts, about once a week, so a refund is picked up; while a purchase is waiting for the store's approval, it checks at each start (for up to two weeks) so Pro unlocks once it's approved. If a check can't connect, your Pro keeps working from what the app already knows. Just opening and using the app never contacts RevenueCat. RevenueCat uses the connection to answer one question: "does this install own Pro?" In that exchange RevenueCat receives:

• an anonymous app user ID that RevenueCat creates for this install (it is not linked to your name, email, phone number, or store account on our side);
• your purchase receipts from Google Play or the App Store, if you have bought or restored Pro;
• the store's price for Pro, and the store country it applies to;
• basic technical information that any internet connection carries, such as your IP address, device type, operating-system version, app version, and language setting.

RevenueCat never receives your receipts, budgets, documents, passwords, or any other data you store in the app.

Everything else runs on your device. Fonts and the text-recognition (OCR) engine that reads receipts are bundled inside the app, so reading a receipt never uses the internet.

Who handles data for us (processors)

Apple and Google handle all payment details (card numbers and so on). We never see them. Because these companies are outside Canada, the information above may be stored and processed in the United States and be subject to the laws there. Each company's own privacy policy explains how it handles data: Apple, Google, and RevenueCat.

Where your data lives

Everything you add is stored locally on your device using the device's own storage (WebView storage and IndexedDB). It is not uploaded anywhere.

• Receipts, Proof Vault documents, and their attachments are encrypted at rest on the device (AES-256-GCM). The encryption key is created on the device and kept in the platform's secure key storage — the Android Keystore or the iOS Keychain, which is hardware-backed on most modern phones. On the rare phone where secure key storage won't accept it, the key is kept in the app's own private storage on the device instead (lighter protection), and Settings → Security says so. It is never derived from your passcode, never included in backups you export, and never leaves the device.
• Password Vault entries are additionally encrypted with a separate key made from a master passphrase you choose (AES-256-GCM). That passphrase is never stored and never leaves your device. If you forget it, those entries can't be recovered, by design.
• For extra protection against someone holding your unlocked phone, use the optional App Lock and your device's own lock screen.

How strong these protections are can depend on your device and its operating system.

Device permissions

The app may ask for these permissions. Each is used only for the stated purpose, on your device:

• Camera / Photos — to take or attach a picture of a receipt or document. Text recognition runs on your device; images are not sent anywhere.
• Notifications — to remind you before return windows, warranties, bills, or document expiry dates. Reminders are scheduled on the device.
• Biometrics (where available) — to unlock the optional App Lock. Your fingerprint or face data is handled by your phone's operating system; the app never sees it.
• Internet — used only for the RevenueCat Pro check and purchases described above.

Data you choose to export

You can export your data yourself: a backup, a tax CSV, or a tax ZIP bundle. The file goes wherever you choose to save or share it. A backup is locked with four words you choose or accept (AES-256; the words are never stored or sent anywhere), unless you pick the plain file for your accountant. The plain backup, tax CSV and tax ZIP are not encrypted and may contain personal information, so store and share them carefully. We never receive a copy.

Sharing and selling

We never sell your information, and we never share the records you store in the app — we don't have them. The only outside companies involved are the ones in the table above, and only to make the app store and the Pro upgrade work.

How long data is kept

• Your records stay on your device until you delete them in the app or uninstall the app.
• RevenueCat's records (the anonymous ID and any purchase receipts) are kept by RevenueCat so your Pro upgrade can be restored later. You can ask us to delete them (see "Your rights" below).
• Emails you send us are kept only as long as we need them to help you.

Children and teens

Proof Panda is suitable for people aged 13 and older. Children under 13 should use it only with a parent or guardian.

Proof Panda does not collect personal information from anyone, of any age. No name, email, birthday, or contact list is asked for, and nothing you store is sent to us. The only thing that leaves the device is the anonymous Pro check described above. Buying Pro goes through Apple's or Google's store, where parents can use tools like Ask to Buy (Apple) or Family Link (Google) to approve purchases.

If you're a parent or guardian and have a question, email [email protected].

Your rights

Depending on where you live, privacy laws give you rights over your personal information. In Canada that includes the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, Law 25. In the European Union and United Kingdom it includes the GDPR. These rights include asking to see, correct, delete, or get a copy of your personal information, and withdrawing consent.

Because your records live only on your device, you can use most of these rights yourself, right away:

• See or get a copy: use Export in the app.
• Correct: edit any entry in the app.
• Delete: delete entries in the app, or uninstall it. See our data deletion page.

For the anonymous purchase record RevenueCat holds, email [email protected]. We'll help you find your anonymous ID and ask RevenueCat to share or delete that record. We'll reply within 30 days. We don't hold any other information about you, so there is nothing else for us to release or erase.

Complaints

If you have a concern, please email us first at [email protected] and we'll try to fix it. If you're not satisfied, you can complain to a privacy regulator:

• Canada: the Office of the Privacy Commissioner of Canada.
• Quebec: the Commission d'accès à l'information du Québec.
• European Union / United Kingdom: your local data protection authority.

Our website

The proofpanda.ca website has no cookies, no analytics, and no tracking. Its pages load fonts from Google Fonts, so Google receives your IP address and browser details when you visit. Our web host may keep standard server logs.

Changes to this policy

If this policy changes, we'll update the date above and post the new version at this URL. If a change affects what leaves your device, we'll also mention it in the app's release notes.

Contact

Questions about this policy? Email [email protected]. See also our Terms of Use.