GigPrism Privacy Policy

Effective date: October 13, 2026
Operator: VediQ Inc
Privacy contact: gigprism@gmail.com

1. Scope and responsibility

VediQ Inc operates GigPrism and is responsible for the personal information it handles in providing the service. This policy explains how information is used by the app, our account and subscription backend, and optional features such as Drive backup and report sharing. Google and other providers may also process information under their own policies for their independent services.

2. Information and where it goes

Local financial data is not routinely synchronized into our Firestore database. However, account and purchase data is processed online, and financial files leave your device when you choose cloud backup, file export or sharing. Do not interpret “stored locally” as “nothing ever leaves the phone.”

Firebase handles email/password authentication; GigPrism does not create a separate plaintext password database or ask for your Google password. Google Play handles payment details; we do not receive your full payment-card number. Receipt images themselves may contain sensitive information, including partial card details or information about others. Include only what is necessary.

The current Android app offers Google and email/password sign-in. This policy does not claim Apple sign-in is available. It has no bank-sync feature or automatic GPS route tracking. We have not integrated advertising or analytics SDKs in the reviewed build; essential authentication, purchase and infrastructure processing still occurs. We do not use your receipt contents to train AI models in the reviewed implementation.

3. How we use information

We use the information described above to authenticate you; separate account workspaces; verify subscription ownership and access; process the actions you request; provide support; prevent fraud and security incidents; and comply with applicable law. We currently do not display advertisements. We do not sell your personal information or use your ledger and receipts for targeted advertising.

Optional permissions and transfers are tied to requested features. Where consent is required, we explain the relevant use and obtain it; installing the app or accepting terms is not blanket consent for unrelated new uses. You may withdraw optional authorization, but the dependent feature may stop working. We may still process information where law permits or requires it for a separate purpose.

4. Google Drive and Google user data

Connecting Drive is optional and may use a different Google account from your GigPrism sign-in. The app requests the drive.file permission for files it creates or that you make available to it; it does not request unrestricted access to all Drive files. It uses private app markers and file identifiers to find its backups, including folders bearing the previous GigLedger name.

Backups may include financial entries, preferences and receipt images. You choose the authorized account. Google processes the files under its own terms and privacy practices. Disconnecting authorization does not delete existing backups. You can revoke access in your Google account's connected-app settings and separately delete files and trash in Drive.

GigPrism's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used to provide the relevant user-facing functions, not sold or used for advertising. Any human access must be limited to permitted situations, such as your explicit support consent, security investigation or legal obligations.

5. Sharing and service providers

We use Firebase Authentication for account access and Google Cloud Functions/Firestore for subscription verification and purchase records. Google Play processes purchases and subscription changes. Optional Drive, device document providers and sharing apps receive the files or data needed for the feature you select. Providers may process technical information when you connect to their services.

We do not email reports automatically from a GigPrism mail server. The app prepares a PDF and opens the phone's sharing interface; review the recipient and content before sending. Recipients and their services may retain copies independently. Statement import does not require sharing your delivery-platform login with us; only supported files you select are processed. Keep original statement PDFs separately.

We may disclose information when legally required or necessary to protect rights and security, subject to applicable law and appropriate limits. If the business is reorganized or transferred, any transfer of personal information must have lawful safeguards and appropriate notice. This is not permission to repurpose your information without a lawful basis.

Provider information: Google Privacy Policy, Firebase privacy and security, and Google API Services User Data Policy.

6. International processing

The current subscription backend and default Firestore database are configured in us-central1 in the United States. Firebase Authentication, Google Play, Drive and support/infrastructure providers may process information in other countries where they operate. Information can therefore be accessible to courts and authorities under those countries' laws. Local records remain on your device unless an action or device service transfers them. We do not promise Canadian-only storage or processing. Contact us for information about relevant providers and safeguards.

7. Security

We use account authentication, account-scoped workspace logic, restricted backend access and encrypted network connections for cloud communications. These measures reduce risk but do not guarantee absolute security. Local storage relies on app and device protections and is not represented as a separately encrypted vault. Exported backup archives and receipt ZIPs are not encrypted or password-protected by GigPrism. Protect your phone with a strong lock and keep exported files and sharing permissions private.

Only send support the information needed to investigate an issue. Never send passwords, sign-in codes or full card numbers. We will handle security incidents and any legally required notices under applicable law.

8. Retention

Local financial entries remain until you delete them, replace them during a restore, clear app storage or uninstall, subject to operating-system behavior. Signing out retains local workspaces. Receipt attachments default to two years from their saved date. In Help → Receipt retention, you may select 1, 2, 3, 5, 7 or 10 years. Receipt cleanup removes attachments, not the underlying financial entries. This setting is not advice about how long you must preserve records for tax or other purposes.

Expiry reminders are stored in Help → Notifications six months, three months, one month and one week before removal. Phone alerts require notification permission. Checks run locally, normally daily and when you open the workspace; Android restrictions, offline or powered-off devices can delay them. Existing receipts receive at least six months of protection when this feature starts, and changing the period starts a new six-month protection period. A delayed final reminder postpones cleanup for at least seven days after the reminder is stored. Historical notifications remain until account/device-data deletion and may show an earlier expiry schedule after a setting change.

Drive backups, downloads and shared reports remain at their destinations until deleted there; removing the source record does not remove those copies. Other users and service providers may independently retain copies they received.

Account and subscription-verification records are retained while the account exists and are removed through account deletion. There is no separate automatic purge based solely on an account being inactive or a subscription expiring.

Our project's default Cloud Logging bucket is configured to retain logs for 30 days. Google's required audit-log bucket is configured for 400 days. These durations apply to those log buckets, not to your receipt files. Our Firestore database currently has no scheduled backups configured and point-in-time recovery is disabled. These settings do not eliminate independent provider processing or residual copies governed by Google's service terms and deletion practices.

Our support mailbox, gigprism@gmail.com, is monitored. We retain support correspondence for 12 months after the request is resolved, then delete it, unless longer retention is required by law. Correspondence subject to a legal retention requirement is deleted when that requirement ends. Provider-controlled residual processing is described in the linked provider policies. Where information is retained after deletion for a legal requirement, explain the category, reason and applicable duration to the requester.

9. Account and data deletion

The in-app path is Help → Account Profile → Delete my account. It requires a recent sign-in and typed confirmation. You may also contact gigprism@gmail.com with the subject “GigPrism account deletion.” Instructions are available on our account deletion page. We may verify control of the account using a proportionate process; never send your password.

The implementation deletes the Firebase sign-in and account-linked purchase-verification records, then clears the account's local financial records, receipt directory, cache, preferences and notification contents on the requesting phone. Pending server deletion requests temporarily contain the account identifier and request time; an hourly task retries interrupted server cleanup and removes the request record on completion. Provider outages can delay completion. If the app cannot confirm completion, it displays a retry/support message. Support correspondence, provider logs and independent provider records require the retention schedule above.

Export information you want to keep before deletion. Account deletion may prevent access to local records that require that account. Offline/other devices and independently saved files need separate removal: clear the app's data or uninstall on each device as appropriate, and remove exports, Drive copies and trash where you control them. We cannot recall reports already sent to other people. Deleting GigPrism does not delete your Google account.

Cancel Google Play renewal separately if you no longer want future charges. We will provide assistance and will not require waiting until the paid period ends before accepting an account-deletion request. Uninstalling, signing out or canceling billing alone does not delete your GigPrism account. Deletion does not itself create a refund entitlement or remove any statutory refund right.

10. Access, correction and other privacy choices

Depending on applicable law, you may request access to information we hold, correction, deletion, information about disclosures, withdrawal of consent, or other privacy rights. Contact gigprism@gmail.com. We verify requests proportionately and respond within applicable legal timelines. We explain lawful exceptions or refusals and available complaint or appeal channels. We do not discriminate against users for exercising applicable privacy rights.

You can correct or remove local records through the available app controls and export records using supported backup/report tools. For provider-held information handled independently, contact the relevant provider. Revoking Drive access or signing out does not by itself erase stored copies. Country-specific rights depend on the applicable law; this policy does not assume every US state law applies to our business.

Country and bookkeeping currency are fixed in the current account setup. For work in a different country or currency, use a separate account; records are not automatically moved or converted. This product limitation does not remove your right to request correction of inaccurate personal information: contact gigprism@gmail.com for assistance. Subscriptions do not automatically transfer to a new account.

11. Children

GigPrism is intended for users aged 18 or older. We do not knowingly seek children's personal information. Contact us if you believe a child has supplied it so we can investigate and take appropriate action.

12. Updates and complaints

We will identify the effective date of changes and provide appropriate notice of material changes. Where a new use requires consent, we will seek it rather than relying solely on a revised policy.

Contact our privacy contact first if you have a concern. You may also complain to the applicable privacy regulator, including the Office of the Privacy Commissioner of Canada or the relevant provincial authority where applicable, or the competent authority in your US jurisdiction. Nothing here limits those rights.

13. Contact

VediQ Inc
Privacy officer/contact: gigprism@gmail.com
Support: gigprism@gmail.com
Account deletion: Account deletion