Privacy Policy

Section 1 — Introduction

CertAlert (the "App") is committed to protecting your privacy. This Privacy Policy explains how information is handled when you use this certificate and license management app.

By using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

The App is a standalone mobile application for personal use. All data is processed and stored locally on your device.

Section 2 — Information We Do Not Collect

The App is designed with privacy in mind. By default, we do not collect, transmit, or store:

• Your name, phone number, or home address
• Certificate or license numbers
• Government-issued identification details
• Location data or GPS coordinates
• Device identifiers for tracking purposes
• Browsing history or behavioral data
• Contacts or photos (beyond those you attach to records)
• Biometric data

Optional account creation (for OS transfer only): The App uses anonymous authentication by default — no account creation is required to use the App. If you choose to create an account in order to transfer your Pro subscription to a different operating system (e.g. Android to iPhone), you may voluntarily provide an email address. This data is processed by Firebase Authentication (Google LLC). See Section 5 for details.

Section 3 — Local Data Storage

The following data is stored locally on your device in a SQLite database and SharedPreferences:

• Certificate and license records (name, issuer, category, issue date, expiry date)
• Renewal information (cost, required documents, notes)
• Reminder schedules and notification preferences
• Photo attachments of certificates and licenses
• App settings (currency, language, notification preferences)

The following data is managed externally (not stored solely on your device):

• Authentication state — an anonymous or signed-in Firebase UID is managed by Firebase Authentication (Google LLC) and cached locally. This identifier contains no personal information unless you choose to sign in with an email address.
• Pro subscription status — subscription entitlements are verified and cached by RevenueCat, Inc. See Section 5 for details.

Your certificate records leave your device only when you export a backup file, or when you turn on automatic cloud backup (Pro), which sends an encrypted backup to your own Google Drive. They are never sent to our servers.

Section 4 — Backup and Encryption

You can save a backup of your data to a file at any time, on both the free and Pro plans. Pro users can also turn on automatic cloud backup to Google Drive.

• Backups are encrypted on your device with AES-256-GCM, using a key derived from a passphrase you choose. Neither the passphrase nor the key is stored in the backup file.
• Backup files are saved to a location you choose. Restoring a backup file on another device requires the passphrase.
• Cloud backups are stored in your personal Google Drive account, in an app-specific hidden folder, on both Android and iOS. We do not have access to your Google Drive.
• So that you can restore from Google Drive on a new device without typing the passphrase, the derived key is also saved in the same app-specific hidden folder of your own Google Drive. It never goes to our servers. If you delete the app's data from Google Drive settings, this key is deleted too; after that, restoring on another device requires the passphrase.
• We cannot access, read, or decrypt your backup data

Section 5 — Third-Party Services

The App integrates with the following third-party services, which may collect information independently:

A. App Stores (Apple App Store / Google Play Store)

• Download and installation data
• App version and update information
• Crash reports (if enabled in device settings)
• Payment processing for Pro subscriptions
• Subject to Apple's and Google's respective privacy policies

B. RevenueCat (Subscription Management)

The App uses RevenueCat, Inc. to manage and validate Pro subscriptions. RevenueCat acts as an intermediary between the App and the App Stores to provide reliable receipt validation and cross-platform subscription tracking.

Information RevenueCat receives:

• An anonymous app user ID (your Firebase UID — contains no personal information by default)
• Purchase receipts from Apple App Store or Google Play for validation
• Subscription status (active/expired/refunded) and entitlement data
• Platform and app version information

Information RevenueCat does not receive:

• Credit card numbers, billing address, or payment credentials
• Your certificate records or personal documents

RevenueCat's privacy policy: https://www.revenuecat.com/privacy

C. Firebase Authentication (Google LLC)

The App uses Firebase Authentication to provide anonymous authentication by default and optional account creation for Pro subscription transfer across platforms.

By default (anonymous mode):

• An anonymous user ID is created automatically — no personal information is associated with it
• This ID is used as the RevenueCat app user ID to link your subscription to your device

If you choose to create an account (for OS transfer only):

• Your email address and hashed password (if using email sign-in) are stored in Firebase Authentication
• Google account information (name, email) may be received if you sign in with Google
• Apple account information (email, if shared) may be received if you sign in with Apple

Firebase Authentication's privacy policy: https://firebase.google.com/support/privacy

D. Google Drive API (Cloud Backup)

• Used exclusively for storing and retrieving encrypted backup files and the backup key described in Section 4, and only when you turn on cloud backup or restore from Google Drive
• The App accesses only its own app-specific hidden folder — it cannot read your other Google Drive files
• No user data beyond the encrypted backup and the backup key is sent to Google Drive

E. Device Operating System

• iOS and Android may collect diagnostic data
• Crash reports may be sent to Apple/Google depending on your device settings
• We do not control OS-level data collection

F. Google Play In-App Review

• When the App asks for a rating, the review prompt is shown by the Google Play In-App Review API
• The rating and review you enter are handled by Google Play, subject to Google's privacy policy; the App does not receive them

Section 6 — Data Sharing and Disclosure

We do not sell, rent, or trade your data to third parties.

We do not share data with third parties except:

• When required by law (court order, warrant, regulatory requirement)
• To protect our legal rights or prevent illegal activity
• With your explicit consent

Since we do not collect personal data on our servers, there is generally no data to share in most situations.

Section 7 — Analytics and Crash Reporting

The App does not include:

• Analytics SDKs (Google Analytics, Firebase Analytics, Crashlytics, etc.)
• User tracking or behavioral monitoring
• Advertising SDKs or ad networks
• Social media integrations

Note on Firebase: The App uses Firebase Authentication only — not Firebase Analytics, Firebase Crashlytics, or any other Firebase product. No usage data, session data, or crash reports are sent to Firebase.

However, if enabled in your device settings, the OS may automatically collect crash diagnostic information. To disable:

• iOS: Settings → Privacy & Security → Analytics & Improvements → Share iPhone Analytics (Off)
• Android: Settings → Google → Usage & Diagnostics (Off)

Section 8 — Children's Privacy

The App is not specifically targeted at children under 13. While certificate management is generally an adult activity, the App does not collect personal information from any user. If we become aware that a child under 13 has provided information through optional account creation, we will take prompt action.

Section 9 — Data Retention and Deletion

Your certificate data remains stored locally on your device until you:

• Manually delete records within the App
• Uninstall the App
• Perform a factory reset on your device

Account data (if you created an account): Your Firebase Authentication account (email address and anonymous UID) can be deleted in the App from the Account screen ("Delete Account"). You can also ask us to delete it at the address listed in Section 17, and we will delete your Firebase account and associated RevenueCat data. Note that deleting your account will permanently remove the link between your subscription and your account; subscription history managed by the App Stores cannot be deleted by us.

Anonymous sessions (no account created) do not store any personal data on our servers.

Section 10 — Data Security

Security measures in place to protect local data:

• SQLite database stored in an app-specific directory (inaccessible to other apps)
• AES-256-GCM encryption for backup files, with a key derived from your passphrase
• Secure storage for sensitive settings (flutter_secure_storage)
• No network transmission of certificate data, except encrypted backups sent to your own Google Drive when you turn on cloud backup

However, no system is completely secure. Risks such as device theft, malware, and OS vulnerabilities exist. You are responsible for maintaining the security of your device.

Section 11 — International Data Transfers

Your certificate records are stored locally on your device and are not transferred internationally.

The following data may be transferred internationally by third-party services:

• Firebase Authentication (Google LLC): Authentication data (anonymous UID or email if provided) may be processed on servers in the United States or other countries where Google operates. Google LLC is certified under the EU-U.S. Data Privacy Framework.
• RevenueCat, Inc.: Subscription status and purchase receipts may be processed on servers in the United States. RevenueCat, Inc. is based in the United States.

By using these features, you consent to the transfer of applicable data to these services as described in their respective privacy policies.

Section 12 — Your Rights and Choices

You have full control over your data:

• Access: All certificate data is accessible within the App
• Edit: Any record can be edited or updated
• Delete: Individual records can be deleted from within the App
• Export: Encrypted backup files can be created on any plan; PDF reports, CSV export, and cloud backup are Pro features
• Account deletion: If you created an account, delete your account from the Account screen in the App, or contact us to delete your Firebase account and associated data (see Section 9 for details)
• Opt-out of account creation: The App functions fully without creating an account. Anonymous authentication is used by default and requires no personal information

Since certificate data is stored locally on your device, data subject access requests (GDPR, CCPA) do not apply to certificate records — they are already under your control on your device. For account data held by Firebase, you may request deletion as described in Section 9.

Section 13 — California Privacy Rights (CCPA)

Since CertAlert does not collect personal information on servers, does not sell personal information, and stores all data locally on your device, most CCPA provisions do not apply to our operations.

Section 14 — European Privacy Rights (GDPR)

Since we do not collect or store personal data on our servers, our GDPR obligations are minimal. All data is on your device under your control. For data related to App Store or Google Play, please contact Apple or Google directly.

Section 15 — Changes to This Policy

We may update this Privacy Policy. For material changes, we will notify you through an app update. Continued use after changes constitutes acceptance of the updated policy.

We will not reduce your privacy rights without your explicit consent.

Section 16 — Limitation of Liability

To the maximum extent permitted by applicable law, we are not liable for:

• Data loss or corruption
• Unauthorized access to your device
• Backup failures
• Third-party privacy practices (app stores, OS providers, Firebase, RevenueCat)

Section 17 — Contact

For privacy-related requests including account deletion, data access, or questions about this policy, please contact us through the app's store listing (Google Play or App Store) or the support page linked from the App.