HSA Hoard

1. Introduction

HSA Hoard ("we," "us," or "our") operates the HSA Hoard mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. Please read this policy carefully. By using the App, you consent to the practices described herein.

If you do not agree with the terms of this Privacy Policy, please do not use the App.

2. Information We Collect

2.1 Information You Provide Directly

• Receipt images and data: Photographs of medical receipts that you capture or import using the App, including any metadata embedded in those images (e.g., date, time, location if present in EXIF data).
• Receipt details: Amounts, dates, merchant names, descriptions, and categories that you enter manually or that are extracted via AI-powered scanning.
• Account and purchase information: Information required to process in-app purchases, such as your subscription status. Payment processing is handled entirely by Google Play and RevenueCat; we do not collect or store your payment card details.

2.2 Information Collected Automatically

• Device and usage data: We collect analytics data through Mixpanel, including device type, operating system version, app version, session duration, feature usage patterns, screen views, and crash reports. This data may be associated with your account information (such as your email address) if you have signed in with Google.
• Diagnostic data: Error logs and performance metrics used to identify and fix bugs.

2.3 Information We Do Not Collect

• We do not collect your name, email address, phone number, or physical address unless you voluntarily provide it via a support inquiry.
• We do not collect precise geolocation data.
• We do not collect health or medical diagnosis information. Receipt images and amounts are financial records; we do not interpret, classify, or store any health conditions.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the App's core functionality, including receipt storage, organization, and total calculations.
• To process receipt images through AI-powered scanning (see Section 4).
• To process in-app purchases and manage subscription status.
• To analyze usage trends, diagnose technical issues, and improve the user experience.
• To communicate with you regarding support requests you initiate.

4. AI-Powered Receipt Scanning

When you opt in to AI-powered receipt scanning:

• Your receipt image is sent to Google's Gemini API over an encrypted connection for the sole purpose of extracting text, amounts, dates, and merchant information.
• We do not retain your images on any server we operate. The image is transmitted directly from your device to Google's API and the extracted data is returned to your device.
• Google's use of data sent to the Gemini API is governed by Google's Privacy Policy and their Gemini API Terms of Service.
• You may decline AI scanning at any time and use manual entry instead, with no loss of core functionality.

5. Google Drive Backup

The App offers optional backup of your receipt data to your personal Google Drive account. If you enable this feature:

• Receipt images and associated data are uploaded to a dedicated folder in your own Google Drive storage. We do not operate backup servers and do not have access to your Google Drive files.
• You control whether images are compressed before upload via a setting in the App.
• You may revoke Google Drive access at any time through your Google Account settings. If access is revoked, the App will notify you that cloud backup is no longer functioning.
• Google Drive storage is governed by Google's Privacy Policy and Terms of Service.

6. Third-Party Services

The App uses the following third-party services, each of which may collect information as described in their respective privacy policies:

7. Data Storage and Security

Your receipt images and data are stored locally on your device. If you enable Google Drive backup, copies are also stored in your personal Google Drive account. We do not operate servers that store your personal receipt data.

We implement reasonable technical safeguards, including encrypted data transmission (TLS/SSL) for all network communications. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

You are responsible for maintaining the security of your device and your Google account credentials.

8. Data Retention

Receipt data stored locally on your device persists until you delete it within the App or uninstall the App. Data backed up to Google Drive persists until you delete it from Google Drive.

Anonymized analytics data collected through Mixpanel is retained in accordance with Mixpanel's data retention policies.

If you contact us for support, we may retain correspondence for up to 24 months to improve our service.

9. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties.

We may share information only in the following circumstances:

• With third-party service providers listed in Section 6, solely for the purposes described, and subject to their respective privacy policies.
• To comply with legal obligations, such as responding to a subpoena, court order, or other governmental request.
• To protect rights and safety, when we believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.
• In connection with a business transfer, if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify users via an in-app notice or update to this policy.

10. Your Rights and Choices

All Users

• You may delete any or all receipt data stored within the App at any time.
• You may disable AI-powered scanning and use manual entry exclusively.
• You may disable or revoke Google Drive backup at any time.
• You may opt out of analytics data collection by contacting us (see Section 15).
• You may uninstall the App at any time to cease all data collection.

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know what personal information we collect and how it is used; (b) request deletion of your personal information; (c) opt out of the sale or sharing of personal information (we do not sell personal information); and (d) not be discriminated against for exercising your privacy rights. To exercise these rights, contact us using the information in Section 15.

European Economic Area, UK, and Swiss Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you may have additional rights including: access to your personal data, rectification of inaccurate data, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to processing. Our legal basis for processing is your consent (which you may withdraw at any time) and our legitimate interest in improving the App. To exercise these rights, contact us using the information in Section 15.

11. Children's Privacy

The App is not intended for use by anyone under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us.

12. Advertising

The App does not display advertisements. We do not share your data with advertising networks or ad exchanges.

13. Permissions

The App may request the following device permissions:

• Camera: To photograph receipts. Images are stored locally and, if you opt in, processed by Gemini AI and/or backed up to Google Drive.
• Storage / Photo Library: To import existing receipt images from your device.
• Internet: Required for AI scanning, Google Drive backup, analytics, and purchase verification.

All permissions are used solely for the stated purposes. You may manage permissions through your device's system settings.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective Date" at the top of this page and, where practicable, notify you through an in-app notice. Your continued use of the App after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: downgatelabsllc@gmail.com

We will respond to all legitimate requests within 30 days.