English translation. If there is any difference, the Spanish version prevails.
1. Our privacy commitment
Libreta Simple, developed by NeoRoot, treats your customer balances and store credit records as essential business information. The app is local-first: records are saved on your device first, and cloud backup is used only if you choose it.
2. Information we collect
- Customer details: names, mobile phone numbers for payment reminders, optional addresses and purchase notes that you enter manually.
- Financial records: store credit amounts, payments and the date and time of each transaction.
- Google account: if you connect Google for cloud backup, Firebase Authentication verifies your identity. We keep an account identifier and email address to associate the backup.
- Subscriptions: Google Play processes payments; we never see your card. We store the product, subscription status, expiry and an irreversible SHA-256 hash of the purchase token to verify ownership. Play notifies us about renewals, cancellations and refunds.
- Shopkeeper signature (Pro): a signature drawn for statements is stored on your phone and appears in PDFs you choose to share.
- Device diagnostics and crashes: Firebase Crashlytics receives technical reports such as the failing code, Android version, device model, language and installation identifier. These reports never include customer names, phone numbers, amounts or notes and are used to fix faults.
3. Legal basis
Processing is based on the user’s explicit consent when accepting the Terms and Conditions. Applicable local data protection legislation includes:
- Ecuador: Organic Law on Personal Data Protection (LOPDP, 2021).
- Colombia: Law 1581 of 2012.
- Mexico: Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).
- Guatemala: Decree 57-2008 and constitutional habeas data principles.
- Peru: Personal Data Protection Law 29733.
- European Union: GDPR for users resident in the EU.
4. Where and how data is stored
Records are stored in internal Android storage in a Room database encrypted with SQLCipher AES-256. Android Keystore protects the database key.
When you connect Google with Pro, the customer and transaction backup travels over HTTPS to Cloudflare D1 and is stored with account-bound AES-256-GCM encryption. Database contents are unreadable without the server key, and copying a backup to another account does not make it accessible. A verified session belonging to your account can read or replace your backup, restore it on another phone or view it in the web Viewer.
Daily Google Drive backup (optional and free): when connecting Google, the app proposes enabling it with a checkbox you may clear. You can enable or disable it later in Settings. If accepted, a daily copy of customers, debts and payments is saved in the app’s hidden appDataFolder in your own Drive. The only scope is drive.appdata; it does not grant access to your other files. This copy does not pass through our servers and is not used for advertising or anything beyond restoring your records. Disable it in Settings or delete it through Drive → Manage apps. Declining permission does not prevent local use. Our use of Google API data follows the Google API Services User Data Policy, including Limited Use requirements.
Access by our team: our team does not open, read or inspect your ledgers, and there is no internal tool to view them. Support checks metadata only: whether a backup exists, its date and size. Content would be handled only at your written request for support or under a lawful order, limited to what is necessary and with a record of the action. You control your customers’ data and we act as processor; see section 6 of the Terms. You may also export a backup and keep it in Drive or elsewhere. We do not sell, share or monetize customer records with banks, credit bureaus or commercial third parties.
Customer statements you choose to share (Business)
Creating a link authorizes its recipient to view only that customer’s name, balance and latest 100 transactions, backup date and shop name. It does not open the entire ledger, allow editing or payment, reveal phone numbers, addresses or private notes, or share browser drafts. Anyone with the link can open it: send it to the correct person and revoke it if forwarded by mistake. No statement is shared automatically.
Links last 1, 5, 12 or 24 hours and can be revoked earlier in the Viewer, even after the plan ends. Losing the plan blocks access without deleting your ledger. We store a one-way link hash and a minimal encrypted statement projection, refreshed when a newer backup is available. Expired links and projections are deleted in daily cleanup within 24 hours. Short-lived anti-abuse counters use hashes without ledger contents and are cleaned daily. Deleting your account also removes its links. Our team still does not inspect your records.
We store a hash of the link and an encrypted projection. Statements may use an encrypted cached copy for up to 60 seconds; changes or revocations may take that long to propagate. Expiry is also checked for cached copies. An open statement cannot retract information someone has already seen or copied; reload to obtain changes. Expired links and projections are removed by daily cleanup within the following 24 hours. Access is also blocked when the account is deleted or the customer is removed from the backup. The ledger itself follows the retention periods in section 8.
5. International transfers
Cloudflare Workers and D1 provide backup infrastructure; Firebase Authentication and Crashlytics provide identity and crash reporting. These providers may process and store data in different countries. Transfers use HTTPS and backups require your verified account. Without a connected account, ledger records stay on your device.
6. Advertising and third-party services
The free app includes Google AdMob. AdMob may collect IP addresses, device and advertising identifiers, interactions and diagnostics for advertising, measurement and fraud prevention; these are not considered anonymous data. The app manages consent where required. Google processes this data under its advertising privacy policies. Pro users do not receive advertising.
Suggested exchange rate. When you change your business currency, the app asks our server for a suggested exchange rate, which we obtain from ExchangeRate-API (open.er-api.com). None of your data, your customers' data or any amounts is sent to that service. You can type the rate yourself.
7. Your rights
- Access: request a copy of personal information we store about you.
- Correction: correct inaccurate or incomplete records in the app.
- Deletion: request removal of your data and account.
- Portability: export readable PDF or JSON records.
- Objection: disable backups or sign out in Settings, manage ad consent and request deletion. Uninstalling alone does not erase cloud data.
8. Retention
Local records remain while the app is installed; losing Pro never deletes customers, debts or transactions from your phone. The cloud backup remains until deleted in Settings or through a deletion request. After Pro ends, it is retained for 180 days so you can return, then removed automatically. Voided or superseded purchase evidence is retained for up to 400 days. You control files exported to Drive. Following an account deletion request, cloud data is purged within 30 calendar days.
9. Deleting data
In accordance with Google Play requirements, shopkeepers may request removal of their account and cloud records at any time: request account and data deletion.
10. Information security
- SQLCipher AES-256 for the local database.
- Account-bound AES-256-GCM in cloud storage, with the key outside the database.
- Android Keystore, hardware-backed where available.
- HTTPS/TLS with certificates managed by Cloudflare.
- Verified Google account access to backups; partial customer statements require a temporary link you create.
- Technical logs without customer names, phone numbers, amounts or notes.
- FLAG_SECURE on financial screens.
- EncryptedSharedPreferences with AES-GCM for tokens.
11. Contact
For data protection questions or to exercise your rights, contact NeoRoot (trade name of Adrian Guanoluisa) at [email protected].