Privacy Policy — NoBuy

The short version: NoBuy has no account and no login. Everything you type — your notes, reward names, envelope and category names, and every amount of money — lives only on your device, and we never receive it. We do use Google Analytics for Firebase to see anonymous, aggregated usage: that a check-in happened, that a challenge was started, which screens get opened. That is counts and categories, never the words or numbers you typed. The one exception is a note you choose to send us from the app — an idea, a bug, or how it’s going. We receive what you write, and your email only if you add it, so we can read it and answer. We show no ads, do no cross-app tracking, and never sell anything.

This Privacy Policy explains how the NoBuy mobile app (“NoBuy,” “we,” “us”) handles information when you use it. By using NoBuy you agree to this policy.

1. Information you enter stays on your device

NoBuy is designed to work without an account. The information you create in the app — your challenges, daily check-ins, streaks, freezes, notes, spending categories and envelope amounts, your name, avatar, and reward — is stored locally on your device. We never receive the text or the amounts themselves and cannot access them — except a note you choose to send us (section 3). (Anonymous events describing your activity — that a check-in happened, that a challenge was started — are a separate thing, and section 2 sets out exactly what they contain.) If you delete the app, this data is removed with it (unless you have enabled a device backup such as iCloud or Google backup, which is controlled by your device settings, not by us).

2. Anonymous usage analytics

NoBuy uses Google Analytics for Firebase to understand how the app is used in aggregate. This helps us see which features people actually reach and where they get stuck.

What we receive: anonymous events describing that something happened — a challenge was started, a check-in was completed, a paywall was viewed, a widget was added, an error occurred. Alongside them we store four coarse properties: your challenge mode (no-buy or low-buy), a bucketed challenge length, a bucketed day count, and whether Premium is active. Firebase also assigns a resettable, app-scoped installation identifier.

What we never receive: the text you type — except a note you choose to send us (section 3). Your check-in notes, reward names, envelope names, category names, your name, and every amount of money you enter stay on your device and are never included in an event. We do not receive your contacts, location, photos, or health data. Error reports contain fixed diagnostic strings, never your content.

No advertising, no tracking. As of version 1.1.0 NoBuy links the Firebase Analytics build that does not collect Apple’s advertising identifier (IDFA). We show no ads, we run no advertising SDKs, and we do not combine your data with information from other companies’ apps or websites. In Apple’s terms, NoBuy does not “track” you.

NoBuy does not yet offer an in-app switch to turn analytics off — we intend to add one. Today, deleting the app stops all collection, and you can email us to have the analytics records for your installation deleted. Note that iOS’s Allow Apps to Request to Track setting does not affect this collection, because NoBuy does not use the advertising identifier it governs. See Firebase’s privacy information.

3. Feedback you choose to send

NoBuy has a feedback form (Settings → Suggest a feature or report a bug), and now and then Hazel asks whether the app is helping. Nothing is sent unless you tap Send. When you do, we receive: what you wrote (up to 1,000 characters); the kind of note and where in the app you sent it from; the app version, build, platform and language setting; how far into your challenge you are and how long it is, in coarse ranges; whether Premium is active; the anonymous app-user ID that RevenueCat already uses (section 4); and your email address — only if you type one into the optional field.

Notes are stored in Google’s Firebase Realtime Database (United States), in a box the app can write to but never read back. We use them only to read them and answer. If you left an email, we may reply by email. Otherwise our answer is stored in the same database under that anonymous ID, and the app looks for it — only on a device that sent us a note, or for 30 days after updating to version 1.6.1 — and shows it to you. An answer contains no personal data.

We keep a note and its answer until they are no longer needed, and we delete a note, its email and its answer whenever you ask: email [email protected].

4. Purchases and subscriptions

NoBuy Premium and Freeze Packs are sold as in-app purchases processed by Apple (App Store) or Google (Google Play). We use RevenueCat to manage subscription status. Your actual payment details (card number, billing address) are handled by Apple or Google — we never see or store them. RevenueCat receives a purchase token and an anonymous app-user ID so the app knows whether Premium is active.

5. What we do NOT do

• We do not link to your bank, cards, or financial accounts.
• We do not sell or rent your personal information to anyone.
• We do not use your data for third-party advertising, and we show no ads.
• We do not collect Apple’s advertising identifier (IDFA) or track you across other apps and websites.
• We do not receive the notes, reward names, or money amounts you enter (a feedback note you choose to send is the one exception — section 3).
• We do not require you to create an account.

6. Children

NoBuy is not directed to children under 13, and we do not knowingly collect personal information from them.

7. Your choices and rights

You can delete all app data at any time by removing the app or using any in-app reset option. Depending on where you live (for example under GDPR or the CCPA), you may have rights to access or delete personal data. Because the content you create is stored entirely on your own device, deleting the app removes it. The anonymous analytics described in section 2 are not linked to your identity and cannot be traced back to you individually, so there is no personal profile for us to hand over — but if you would like us to delete the analytics records associated with your app installation, or a feedback note you sent us (with its email and answer), email us and we will do so. For any question, email [email protected].

8. Data retention & security

On-device data is retained until you delete it, and its security rests on your device’s own operating system protections. The anonymous usage events described in section 2 are retained by Firebase for up to 14 months and then deleted automatically. Feedback notes and their answers are kept until they are no longer needed, or deleted sooner at your request. No method of storage or transmission is 100% secure.

9. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected by the “Last updated” date above.

10. Contact

Questions about privacy? Email [email protected].