Summary
What we collect, at a glance
| Data | When | Where it goes | Why |
|---|---|---|---|
| Your commitments — name, amount (NPR), dates, cycle, category, payment method, notes | Always | Your phone only | The core of the app: tracking and reminding. |
| App settings — language, theme, currency symbol, calendar, reminder preferences | Always | Your phone only | Remember how you like the app. |
| Backup PIN (salted hash, never the PIN itself) | If you turn on app lock | Your phone only | Unlock the app if fingerprint fails. |
| Google account name, email, profile photo, account ID | If you sign in | Google Firebase Authentication | Identify your backup. |
| Copy of your commitments | If you sign in | Google Cloud Firestore | Restore your list on a new phone. |
| App-usage events, device model, OS & app version, country, app-instance ID | Always | Google Firebase Analytics | Count how many people use the app. |
| Advertising ID, IP-derived approximate location, device info | Only when ads are shown | Google AdMob | Serve and measure ads. |
What stays on your phone
Every commitment you add — its name, amount, dates, cycle, category, payment method and notes — is stored in the app's private storage on your device. So are your settings. Reminders are scheduled by your phone's own notification system; no server is involved and no internet connection is needed.
If you turn on the app lock, your fingerprint or face data stays inside your phone's secure hardware — the app only learns whether verification passed. The backup PIN is stored as a salted hash and never leaves the device.
Optional Google sign-in & backup
Signing in is optional and only started by you, from the Profile tab. If you sign in with Google:
- We receive your Google account's name, email address, profile photo and account ID through Firebase Authentication.
- A copy of your commitments is backed up to Google Cloud Firestore (asia-south2 region), readable only by your signed-in account.
- Changes sync quietly in the background. Deleting a commitment while signed in also removes it from the backup.
- Signing out stops all syncing immediately.
Usage analytics
We use Google Firebase Analytics to understand how many people use Nabikaran. It records coarse events — the app being opened, a commitment being added, or one being marked renewed — together with device model, Android version, app version, country and a random app-instance ID.
These events never include commitment names, amounts, notes, or your Google identity.
Advertising
To keep the app free, Nabikaran may show ads served by Google AdMob. When ads are shown, Google may collect your device's advertising ID, approximate location derived from your IP address, and device information to serve and measure them, as described in Google's advertising policy.
We never share your commitments or amounts with advertisers. You can reset your advertising ID or opt out of personalised ads in your phone's Settings → Google → Ads.
Permissions the app uses
- Notifications — to show renewal reminders.
- Alarms & reminders (exact alarms) — so reminders arrive on time, even in battery-saver mode.
- Run at startup — to restore scheduled reminders after your phone restarts.
- Biometrics — only if you turn on the app lock.
- Internet — only for optional backup, analytics and ads. Tracking and reminders work fully offline.
What we never do
- Sell or rent your personal data.
- Access your bank accounts, eSewa, Khalti, cards or make payments.
- Read your SMS, contacts, photos, files or precise location.
Retention & deletion
- Deleting a commitment removes it from your phone (and from your backup, if signed in).
- Uninstalling the app erases everything stored on the phone.
- To delete your Google backup and account entirely, follow the steps on Delete your data. We complete requests within 30 days.
- Analytics data isn't linked to your identity and is deleted automatically under Firebase's data-retention settings.
Security
Data sent to Google services is encrypted in transit (HTTPS/TLS). Backups are protected by Firestore security rules so only your signed-in account can read or write them. No method of storage is perfectly secure, but we use industry-standard protections and keep what we collect to a minimum.
Children
Nabikaran is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child has signed in, contact us and we'll delete it.
Changes to this policy
If this policy changes, we'll update this page and the date at the top.