Committee Book – Privacy Policy
Last updated: 2025-12-15
This Privacy Policy explains how the Committee Book mobile application (“App”) collects, uses, shares, and protects information. The App is a committee (ROSCA) tracking tool only and does not process, hold, or transfer money. All payments occur directly between members outside the App.
1) Information We Collect
1.1 Account Information
We collect:
Display name
Phone number
Optional email address
Avatar URL
Firebase user ID
Account status timestamps (e.g., created/updated)
1.2 Device and Token Data
We collect:
Firebase Cloud Messaging (FCM) token (to deliver push notifications)
We store locally on your device:
System language preference
Theme preference
1.3 Committee Data
We collect and store committee-related information, including:
Committee titles and descriptions
Membership status and roles (Admin/Co-Admin/Member)
Eligibility rules
Draw seeds and results
Audit logs of actions (e.g., overrides, mark-paid)
1.4 Communications
We collect:
Group chat messages
Announcements
Notification records (title/body, related committee IDs)
Read/unread timestamps
1.5 Payment Tracking Data (No In-App Payments)
We collect payment tracking information, including:
Payment amounts
Cycles and due dates
Statuses (paid/verified/rejected/overdue)
Proof metadata
Rejection reasons and notes
1.6 Uploaded Files
We collect and store:
Payment proofs and dispute evidence (images/PDFs)
Files are stored in Cloudflare R2 (S3-compatible), with URLs and related metadata stored in Firebase.
1.7 Disputes
We collect:
Dispute type, reason, and description
Related cycle/payment/proof identifiers
Resolution details
1.8 Optional Analytics and Diagnostics
We may collect limited standard Firebase service logs (e.g., initialization and notification events).
No crash reporting or performance SDK is included in this build.
1.9 Data We Do Not Collect
We do not collect:
Precise location
Contacts
SMS content
Calendar data
2) How We Use Information
We use collected information to:
Provide core functionality (authentication, committee creation/joining, draws, notifications, chat, announcements, payment tracking, disputes)
Communicate with you via push notifications (draws, reminders, proof status, announcements, chat mentions)
Support security and trust (enforce eligibility rules, prevent duplicate proofs, maintain audit trails, detect defaulters)
Troubleshoot and support (investigate issues using audit logs and minimal service logs)
3) Sharing and Transfers of Information
3.1 Service Providers
We use third-party services to operate the App:
Firebase (Authentication, Firestore, Storage, Cloud Messaging)
Cloudflare R2 (S3-compatible object storage for uploaded files)
These providers process and host data on our behalf.
3.2 Admin Visibility and Access Controls
Committee admins and payout recipients can view payment proofs for their committee.
Other members cannot access other members’ proofs.
3.3 Legal and Compliance
We may disclose information if required to:
Comply with applicable laws or lawful requests
Enforce terms
Protect users, our services, or the public
3.4 No Sale of Personal Data
We do not sell your personal data.
4) Data Retention
We retain information as follows:
Active committees: retained for the life of the committee
Payment proofs and related records: retained while the committee is active; archived 6 months after completion and deleted within 24 months of dissolution (configurable in operations)
Audit logs and disputes: retained for accountability during the above periods
Local preferences (theme/language): remain on your device until you remove the App
Account deletion: when you delete your account, access is removed and profile data is deleted after required operational tasks (e.g., admin transfer). Certain records that affect other members (e.g., announcements, audit entries) may remain to preserve integrity.
5) Security
We apply reasonable technical and organizational measures to protect information:
Firebase and Cloudflare provide encryption in transit and at rest for stored data
Firestore security rules restrict access to authorized members/admins; proofs are scoped to the related committee
App Check exists in code but is currently disabled; enable before production for improved abuse protection
6) Your Choices and Controls
You can:
Manage your account: update profile information in the App
Delete your account: use in-app deletion controls
Control notifications: disable push notifications via device settings (some core updates may still appear in-app)
Manage files: replace/delete your own payment proof for a cycle before finalization; historical proof deletion follows the retention policy
7) Children’s Privacy
The App is intended for adults. Do not use the App if you are under the age permitted by your local law without parental consent.
8) Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be highlighted in the App or release notes. Continued use of the App after changes means you accept the updated policy.
9) Contact Us
For privacy questions or requests, contact: m.usmanconsol@gmail.com