Privacy Policy for Ganaka

Effective date: August 7, 2026

This policy explains what information Ganaka ("the app," "we," "us") collects, why, and how it's handled. It's written to describe what the app actually does — not a generic template. Ganaka is a home for a growing set of sub-apps; today that's just Squarely, for splitting group expenses. Squarely handles two kinds of sensitive information: personal information about people who may not be Ganaka users themselves (contacts you add), and financial records tied to named individuals (who paid what, who owes whom).

1. Information We Collect

Account information

When you register, we collect your name, email address, and password. Passwords are handled entirely by Firebase Authentication — we never see or store your actual password, only a token proving you're signed in.

Contacts you add

You can add people as "contacts" within the app — their name, email, and phone number. These people may or may not be Ganaka users themselves. If someone later registers with an email or phone number matching a contact you added, their account is automatically linked to that contact record, and any group you added them to becomes visible in their own account.

If you add someone as a contact, you're providing us with their personal information on their behalf. Only add people you have a reasonable basis to share this information about (e.g. people you actually know and are splitting expenses with).

Groups, events, and expenses

Groups: names you give your groups, and which contacts belong to them.
Events: titles, dates, locations, notes, and who's participating, including each participant's role (admin/member) and who's financially responsible for their share.
Expenses: amounts, descriptions, who paid, and how the cost is split among participants. This is financial information, and it's visible to other people in the same group — that's the core purpose of the app.

Information we do not collect

Ganaka does not include advertising SDKs, third-party analytics or tracking libraries, or any mechanism to sell or rent your data. We don't collect precise location, browsing history, or device advertising identifiers.

2. How We Use Information

To operate your account and authenticate you (Firebase Authentication).
To store and display your contacts, groups, events, and expenses back to you and to other members of your groups.
To calculate settlement balances (who owes what to whom) from the expenses you and others log.
To link your account to a contact someone else added, if you register with a matching email — this is how shared group visibility works (see above).

We do not use your information for advertising, and we do not build behavioral profiles for any purpose beyond operating the app's actual features.

3. How Information Is Shared

With other users of the app

Squarely, the group-expense app inside Ganaka, shares information with other members of your groups is the point. Specifically:

Anyone in a group can see the names of other members and events in that group (per each event's participant list).
Expense details (amounts, descriptions, who paid) are visible to participants of the relevant event.
If your account gets linked to a contact someone else added (see Section 1), that person's group becomes visible in your account, and your name becomes visible to them and other group members.

With service providers

We use the following third parties to operate the app. They process data on our behalf and are not permitted to use it for their own purposes:

Firebase Authentication (Google) — account creation and sign-in.
MongoDB (Atlas or self-hosted) — stores app data (contacts, groups, events, expenses).
[Your hosting provider] — runs the backend server.

What we don't do

We do not sell your information. We do not share it with advertisers. We do not share it with anyone outside the app except as described above, or if required by law.

4. Data Retention

Your data is retained as long as your account exists. Removing a contact from a group, or deleting a group or event you own, removes it from active use, though some references (e.g. a contact id that was once a participant) may persist in historical records tied to other people's data — for example, an expense someone else logged that involved you doesn't disappear just because you delete your own contact entry.

5. Your Choices and Rights

Access/correction: you can view and edit your contacts, groups, and events directly in the app at any time.
Deletion: you can delete individual contacts, groups, and events you own directly in the app. To delete your entire account and associated data, contact us at [YOUR SUPPORT EMAIL] and we will process the request. (An in-app account deletion option is planned; until then, deletion is handled by request.)
Withdrawing consent for shared data: if you were added as a contact by someone else and don't want to be, contact us and we'll remove the link.

6. Children's Privacy

Ganaka is not directed at children under 13, and we do not knowingly collect information from children under 13. If you believe a child has provided us with personal information, contact us and we'll remove it.

7. Security

We use industry-standard practices to protect your information, including encrypted connections (HTTPS) between the app and our servers, and Firebase's authentication infrastructure for credential handling. No method of storage or transmission is 100% secure, and we can't guarantee absolute security.

8. Changes to This Policy

We may update this policy as the app changes. We'll update the effective date above when we do. Continued use of the app after changes means you accept the updated policy.

9. Contact Us

Questions about this policy or your data: [YOUR SUPPORT EMAIL]

This policy was drafted to accurately describe Ganaka's actual data practices as of the effective date above, not from a generic template. It has not been reviewed by a lawyer. Given the app handles third-party personal information and financial records, legal review is recommended before relying on this for a real store submission — requirements vary by where your users are located (e.g. GDPR in the EU, CCPA in California), and this document doesn't attempt jurisdiction-specific compliance language.