Privacy Policy

Last updated: 2026-06-07

ZeniCash is a personal finance, cashflow and invoice-tracking application used by individuals, freelancers and small businesses, published by Manor Systems, Unipessoal Lda (NIPC 519 377 753), Rua da Figueira 126, 4820-645 São Clemente, Fafe, Portugal ("we", "us"). This policy describes what data we process, why, where it is stored, and the rights you have over it.

1. Summary

2. What we collect, and when

2.1 Always — none

A user who installs the app and never signs in produces no data on our servers. The app's local SQLite database is protected by the operating system's per-app isolation and by your device PIN / biometric / app lock.

2.2 When you sign in (optional)

Sign-in is required only if you choose to enable Cloud Sync. We authenticate you through Google Sign-In or Apple Sign-In, and Firebase Authentication returns:

These are used to partition your data in Cloud Firestore under users/{uid}/… so that your devices recognise each other on sync.

2.3 When you enable Cloud Sync (optional)

The financial records you create — accounts, transactions, budgets, categories, invoices, advances, recurring transactions and similar — are copied to your private Firestore namespace, encrypted in transit (TLS) and at rest (Firebase). Only your authenticated session can read or write to your namespace; we do not access it.

2.4 When you subscribe to Premium (optional)

In-app subscriptions are processed by Google Play Billing (Android) or App Store In-App Purchase (iOS). The store handles your payment details; we receive only your subscription state (active / cancelled / expired) so the app can unlock Premium features. We never see card numbers.

2.5 Exchange rates

To convert balances across currencies the app calls public, free-of-charge exchange-rate APIs, in this order:

These requests carry only a base-currency code (e.g. EUR) — no identifier, no account or transaction data. Results are cached locally for 6 hours so subsequent conversions need no network call.

2.6 Receipt OCR — on device only

When you photograph a receipt, the app uses Google ML Kit's on-device text recognition to extract amounts and dates. The image is processed locally; nothing is uploaded to us or to Google for OCR purposes. The extracted text is then stored on the device (and synced via Cloud Firestore if Sync is enabled, exactly like any other transaction note you typed yourself).

2.7 Bank statement imports

You can import a CSV, XLSX or OFX bank statement to populate transactions. The file is parsed locally and discarded; only the transactions you confirm end up in the app (and in Cloud Firestore if Sync is enabled).

3. What we do NOT collect

4. Lawful basis for processing (GDPR / LGPD)

Under Article 6 of the GDPR — and the analogous provisions of the Brazilian LGPD — our lawful bases are:

5. No profiling, no automated decision-making

We do not apply any automated decision-making or profiling within the meaning of GDPR Article 22 to your data. We do not credit-score, risk-rate, target, segment or otherwise analyse your financial data to make decisions that produce legal or similarly significant effects for you. The app's local features (budget alerts, cashflow projections, account-limit notifications) are deterministic calculations performed on data you yourself entered; they are not profiling.

6. Where your data lives

7. Subprocessors

We rely on the following processors and sub-processors. We have a Data Processing Addendum or equivalent contractual protection in place with each.

Calls to the exchange-rate providers (open.er-api.com, jsDelivr, Cloudflare) carry only a 3-letter base-currency code — no user identifier and no financial data.

We notify users when we materially change this list, before the new sub-processor begins processing data.

8. How long we keep it

9. Sharing

We do not sell, rent, or share your personal or financial data with third parties for advertising. We use the processors listed in Section 7 to provide the infrastructure described above. We may disclose data where we are legally compelled to do so (e.g. a binding court order) and will, where lawful, notify you of such a request.

10. Security and breach notification

Connections to Firebase and the exchange-rate APIs use TLS. Cloud Firestore encrypts data at rest. On the device, the SQLite database is protected by the operating system's per-app storage isolation, and you can additionally enable an in-app PIN / biometric lock in Settings > Security. The PIN itself is hashed (salted SHA-256) before being stored.

If we become aware of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (in Portugal, the CNPD) within 72 hours of becoming aware, as required by GDPR Article 33. If the breach is likely to result in a high risk to affected users, we will also notify them without undue delay (Article 34).

11. Your rights

If you reside in the EU/EEA (GDPR) or the UK, you have the right to access, rectify, port, restrict or object to processing of your data, and to lodge a complaint with a supervisory authority. In Portugal the authority is the CNPD. If you reside in Brazil (LGPD), you have analogous rights under that framework.

You can exercise most of these directly inside the app:

For any request we cannot fulfil in-app, email privacy@zenicash.com. We respond within 30 days.

12. Children

ZeniCash is a tool for adults and professional users. We do not direct the product at users under 16, and we do not knowingly collect data from them. If you believe a minor has signed in, email privacy@zenicash.com and we will erase the account.

13. Changes

We may update this policy when the app changes. Material changes will be surfaced in-app and on this page at least 30 days before they take effect. The "Last updated" date above always reflects the current version; older versions can be requested by email.

14. Contact

Controller: Manor Systems, Unipessoal Lda — NIPC 519 377 753.
Privacy and data-protection requests: privacy@zenicash.com.
General support: support@zenicash.com.

Get the app