Privacy Policy

Proof Panda ("the app", "we", "us") is a local-first money and records app: a simple budget plus a vault for your receipts, warranties, return windows, tax records, and important documents. This policy explains what the app does and does not do with your information.

Who we are

Proof Panda is made by Pondering Phoenix, a sole proprietorship based in Ontario, Canada. Pondering Phoenix is responsible for this app and for this policy.

• Person in charge of privacy (PIPEDA, and Quebec's Law 25): the owner of Pondering Phoenix. Reach them at support@proofpanda.ca; put "Privacy" in the subject.
• Email: support@proofpanda.ca (a real person reads every message).

Information we collect

We don't collect your records. Proof Panda has no user accounts, no advertising, no tracking SDK, and nothing that records how you use the app. Your records (receipts and photos, warranties, returns, budgets, income, savings and debts, Proof Vault documents and attachments, and, on older installs, saved passwords) are never sent to us. They go to someone else only if you send them yourself: a backup or export you share, or a sharing file you send your partner.

What does leave your phone: the Pro purchase check. On the Android and iPhone apps, Proof Panda connects to RevenueCat only when you open the Pro screen, buy Pro, or tap Restore. If you have bought Pro, the app also re-checks it when it starts, about once a week, so a refund is picked up; while a purchase is waiting for the store's approval, it checks at each start (for up to two weeks) so Pro unlocks once it's approved. If a check can't connect, your Pro keeps working from what the app already knows. Just opening and using the app never contacts RevenueCat. RevenueCat uses the connection to answer one question: "does this install own Pro?" In that exchange RevenueCat receives:

• a random app user ID that RevenueCat creates for this install. It isn't your name, email, phone number, or store account, and we don't link it to them. It stays the same for this install, so privacy law treats it as personal information: it is pseudonymous, not anonymous;
• your purchase receipts from Google Play or the App Store, if you have bought or restored Pro;
• the store's price for Pro, and the store country it applies to;
• basic technical information that any internet connection carries, such as your IP address, device type, operating-system version, app version, and language setting.

RevenueCat uses this to unlock and restore Pro, and to give us sales totals (for example, how many people bought Pro this month). Those totals come from the purchase records above; they never include anything you store in the app.

RevenueCat never receives your receipts, budgets, documents, saved passwords, or any other data you store in the app.

Everything else runs on your device. Fonts and the text-recognition (OCR) engine that reads receipts are bundled inside the app, so reading a receipt never uses the internet.

Outside the app: email and our website. If you write to support@proofpanda.ca, your message (with your email address and anything you put in it) passes through Cloudflare Email Routing and lands in our Gmail mailbox, where we read and answer it. The app's "Send feedback" email adds only the app version and the kind of phone (iOS or Android). When you visit proofpanda.ca, the site is served by Cloudflare Pages, which receives your IP address and browser details.

Who handles data for us (processors)

Apple and Google handle all payment details (card numbers and so on). We never see them. Because these companies are outside Canada (and outside Quebec), the information above may be stored and processed in the United States and other countries and be subject to the laws there, including requests from courts and authorities there. Each company's own privacy policy explains how it handles data: Apple, Google, RevenueCat, and Cloudflare.

Where your data lives

Everything you add is stored locally on your device using the device's own storage (WebView storage and IndexedDB). It is not uploaded anywhere. Only files you choose to export or send leave it (see below).

• Receipts, Proof Vault documents, and their attachments are encrypted at rest on the device (AES-256-GCM). The encryption key is created on the device and kept in the platform's secure key storage — the Android Keystore or the iOS Keychain, which is hardware-backed on most modern phones. On the rare phone where secure key storage won't accept it, the key is kept in the app's own private storage on the device instead (lighter protection), and More → Settings → Security says so. It is never derived from your passcode, never included in backups you export, and never leaves the device. It isn't copied to iCloud, to Google, or to a new phone either, so to move to a new phone you make a Proof Panda backup file and restore it there.
• Saved passwords (older installs only). New installs don't have a place to save passwords. On older installs that still have them, they are additionally encrypted with a separate key made from a master passphrase you chose (AES-256-GCM). That passphrase is never stored and never leaves your device. If you forget it, those entries can't be recovered, by design.
• For extra protection against someone holding your unlocked phone, use the optional App Lock and your device's own lock screen. While Let my phone's passcode open Proof Panda is on (it is unless you turn it off in More → Settings → Security), anyone who knows your phone's passcode can open the app.

How strong these protections are can depend on your device and its operating system.

Device permissions

The app may ask for these permissions. Each is used only for the stated purpose, on your device:

• Camera / Photos — to take or attach a picture of a receipt or document. Text recognition runs on your device; images are not sent anywhere.
• Notifications — to remind you before return windows, warranties, bills, or document expiry dates. Reminders are scheduled on the device.
• Face ID, Touch ID, or fingerprint or face unlock (where available) — to unlock the optional App Lock. Your fingerprint or face data is handled by your phone's operating system; the app never sees it.
• Internet — used only for the RevenueCat Pro check and purchases described above.

Data you choose to export

You can export your data yourself: a backup, a tax CSV, or a tax ZIP bundle. The file goes wherever you choose to save or share it. A backup is locked with four words you choose or accept (AES-256; the words are never stored or sent anywhere), unless you pick the plain file for your accountant. The plain backup, tax CSV and tax ZIP are not encrypted and may contain personal information, so store and share them carefully. We never receive a copy.

Sharing with your partner

Share with your partner (part of Pro) lets two people put their money records together. One phone makes a locked sharing file (it ends in .ppshare). You send it to your partner, and their phone combines it with their records. There is no server and no account, and the app makes no new internet connection. We never get a copy.

• Your sharing name and phone ID. You type a name to share with, like "Sam". The app keeps it on your phone and puts it in the sharing file. After your partner combines, their phone keeps it too and shows "Added by Sam". The app also makes a random phone ID for your phone, kept on your phone and put in each sharing file. Your backups don't hold your phone ID or your sharing name. Once you have combined, your backups do hold your partner's sharing name and phone ID, so "Added by Sam" still shows after a restore. Clear all data (and Start fresh) removes your phone ID too: the app makes a new one, so sharing files you make after that can't be tied to earlier ones.
• What the file holds. Only your shared money records: pay, bills, budgets, goals, debts, accounts, categories, and receipts with their photos. That includes receipts you marked for work, with their GST/HST amounts, expense line and notes. It does not hold saved passwords, Proof Vault papers, warranties, trips, work settings, app settings or your Pro upgrade.
• How it is locked. The file is locked with four words, the same AES-256 lock as a backup. The words are never stored or sent anywhere.
• Where it goes. The file leaves your phone only the way you send it: Messages, email, AirDrop, Files, or another app you pick. That app keeps its own copy, for example in the message thread or the email.
• What each phone keeps. When your partner combines your file, their phone keeps your shared records and your sharing name. When you combine their file, your phone keeps theirs. Deleting a record on your phone doesn't delete your partner's copy. If they combine a new file from you within 180 days, a record you deleted is removed on their phone too.

Sharing and selling

We never sell your information, and we never share the records you store in the app — we don't have them. You can share them with your partner yourself (see above). The only outside companies involved are the ones in the table above, and only to make the app store, the Pro upgrade, our email and our website work.

How long data is kept

• Your records stay on your device until you delete them in the app or uninstall the app. If you sent a sharing file, your partner's phone and the app you sent it with keep their own copy until it is deleted there.
• RevenueCat's records (the random ID and any purchase receipts) are kept by RevenueCat, under its own policy, so your Pro upgrade can be restored later. If you bought Pro, you can ask us to have them deleted (see "Your rights" below).
• Emails you send us are kept only as long as we need them to help you. You can ask us to delete them at any time.
• Website logs are kept by Cloudflare under its own policy.

Children and teens

Proof Panda isn't made for children under 13. If you're under 13, use it only with a parent or guardian.

Proof Panda doesn't ask for or store personal information: no email, birthday, or contact list, and no name, except a first name you choose to type for Share with your partner, kept on your phone and in files you send (and your partner's first name, once you combine their file). Nothing you store is sent to us. Things leave the device in only two ways: the Pro check described above (a random ID, and purchase receipts if Pro was bought, through RevenueCat), and files you choose to send yourself, like a backup or a sharing file. Buying Pro goes through Apple's or Google's store, where parents can use tools like Ask to Buy (Apple) or Family Link (Google) to approve purchases.

If you're a parent or guardian and have a question, email support@proofpanda.ca.

Your rights

Depending on where you live, privacy laws give you rights over your personal information. In Canada that includes the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, Law 25. In the European Union and United Kingdom it includes the GDPR. These rights include asking to see, correct, delete, or get a copy of your personal information, and withdrawing consent.

Because your records live on your device and never on our servers, you can use most of these rights yourself, right away:

• See or get a copy: use Export in the app.
• Correct: edit any entry in the app.
• Delete: delete entries in the app, or uninstall it. See our data deletion page. If you sent a sharing file, ask your partner to delete their copy.

The purchase record RevenueCat holds. The app doesn't show the random ID, so we find your record from your purchase. If you bought Pro, email support@proofpanda.ca with the order number from your Google Play or App Store receipt email, and we'll ask RevenueCat to give you a copy of that record or delete it. (Restore can still unlock Pro later from your store purchase; that may create a new record.) If you only opened the Pro screen and never bought Pro, the random ID isn't tied to anything we can look up, so we can't find or delete it for you; RevenueCat handles it under its own privacy policy.

Emails you sent us. Ask, and we'll send you a copy or delete them.

We'll reply within 30 days. We don't hold any other information about you, so there is nothing else for us to release or erase.

How we look after privacy (Quebec Law 25)

• Person in charge: the owner of Pondering Phoenix, at support@proofpanda.ca (subject "Privacy").
• If something goes wrong: if we learn of a confidentiality incident involving personal information that we or our service providers hold (for example, a breach at RevenueCat or in our support mailbox), we record it, act to reduce the harm, and, where there is a risk of serious injury, tell the people affected, the Commission d'accès à l'information du Québec and the Office of the Privacy Commissioner of Canada, as the law requires.
• Information leaving Quebec: every service in the table above is outside Quebec. Before we use one that receives personal information, we look at how sensitive the information is, why it's needed and how the service protects it. What goes out is small: a random ID and purchase receipts (RevenueCat), emails you choose to send us (Cloudflare, Gmail), and website visit logs (Cloudflare).

Complaints

If you have a concern, please email us first at support@proofpanda.ca and we'll try to fix it. If you're not satisfied, you can complain to a privacy regulator:

• Canada: the Office of the Privacy Commissioner of Canada.
• Quebec: the Commission d'accès à l'information du Québec.
• European Union / United Kingdom: your local data protection authority.

Our website

The proofpanda.ca website sets no cookies and doesn't run analytics or tracking. Its pages load fonts from Google Fonts, so Google receives your IP address and browser details when you visit. The site is hosted on Cloudflare Pages, and Cloudflare may keep standard server logs (IP address, browser, pages asked for) to deliver the site and protect it from attacks.

Changes to this policy

If this policy changes, we'll update the date above and post the new version at this URL. If a change affects what leaves your device, we'll also mention it in the app's release notes.

Contact

Questions about this policy? Email support@proofpanda.ca. See also our Terms of Use.