Privacy Policy for Cavio – Invoice Maker

1. Introduction

Cavio is a professional, offline-first invoice creation and business document utility designed for small businesses, contractors, and freelancers. We respect your privacy and believe that your business data belongs to you.

This Privacy Policy explains how Cavio handles data on your device, what information is processed locally, what information may be transmitted to third-party services, and your choices regarding your data in Release 1.0 of the Android application.

2. Core Architectural Principle: Local-First Primary Storage

Cavio does not operate a custom proprietary backend, cloud database, user authentication server, or custom document repository.

All core business data entered into the App is stored exclusively on your device in a local SQLite database (premium_business_kit.sqlite managed via Drift).

Business Data Processed Locally

• Business Profile: Business name, physical address, email address, phone number, tax identification numbers (Tax ID / VAT / GST), and bank transfer / payment details.
• Customer Information: Client name, billing/shipping address, email address, phone number, and tax identification numbers.
• Invoice & Document Data: Invoice numbers, dates, payment terms, line items (descriptions, unit prices, quantities), discounts, tax rates, currency codes, and custom invoice notes.

We do not automatically upload, synchronize, or transmit your business profiles, customer details, or invoice records to any Cavio-owned or proprietary servers.

OS Cloud Backup and Device Transfer Disabled

To prevent automatic OS cloud backup and device transfer:

• Android Auto Backup is explicitly disabled (android:allowBackup="false").
• Data Extraction Rules: Explicit configuration (data_extraction_rules.xml for Android 12+ and backup_rules.xml for Android 11 and below) completely excludes all application-private directories, SQLite databases, and preferences from both cloud backups (such as Google One / Google Drive backups) and Device-to-Device (D2D) migration transfers.
• Your business records will not be silently uploaded to cloud backup storage. You control the export and storage of your backup files through our explicit, manual .caviobackup export utility.

3. User-Initiated External Transfers

Cavio provides features that allow you to export and distribute your documents. Your business documents and backup data are transferred outside the App through these export and sharing features only when you explicitly initiate the action:

1. PDF & Image Document Export (Share Sheet):
   When you choose to share an invoice as a PDF or image, the App renders the file locally in memory or temporary device cache. The file is transferred to the native Android System Share Sheet (ACTION_SEND). You choose the recipient application (e.g., your email client, messaging app, cloud storage, or file manager). Once handed over to your chosen application, data handling is governed by that application’s privacy policy.
2. Document Printing:
   When you select “Print”, the rendered document is handed directly to the native Android PrintManager. Spooling occurs locally on your device or across your local network to your selected printer.
3. Local Backup Export (.caviobackup):
   When you create a backup, Cavio packages your local database into a .caviobackup archive (a standard ZIP archive containing manifest.json and database.sqlite).
   Important Security Notice: The .caviobackup archive is not encrypted and does not contain digital signatures. The SHA-256 hash stored within manifest.json is used solely for integrity verification to detect file corruption. When exported, this archive is passed to your chosen destination via the Android file picker or share sheet. You are responsible for safeguarding your exported backup files.

4. Third-Party Software Development Kits (SDKs) and Data Collection

To provide monetization, payment processing, application stability, and optional usage metrics, Cavio integrates trusted third-party SDKs provided by Google.

A. Firebase Analytics (Google LLC)

• Collection Status: Default OFF (Opt-in required).
• User Control: Firebase Analytics is completely disabled by default in both application configuration and the native Android manifest (firebase_analytics_collection_enabled = false). It is enabled only if you affirmatively turn on “Share Usage Analytics” within the App’s Settings. You can turn this off at any time. When turned off, the collection is disabled (setAnalyticsCollectionEnabled(false)) and your analytics identifier is immediately reset (resetAnalyticsData()).
• Data Processed When Enabled:
  • Custom App Events (23 pre-defined events): Low-cardinality functional events such as screen views (ScreenId), document creation counters, status changes, template selection, and export format. Cavio custom telemetry never includes customer names, invoice numbers, monetary amounts, notes, or business identifiers.
  • Automatically Collected SDK Data: In accordance with Google Analytics for Firebase specifications, the SDK automatically collects App-instance ID, Android Advertising ID (AD_ID), coarse/approximate geographic location derived from masked IP addresses, app lifecycle events, and in-app purchase events (in_app_purchase including Product ID, item price, and currency).

B. Firebase Crashlytics & Firebase Sessions (Google LLC)

• Collection Status: Default ON (Opt-out available).
• User Control: You can disable crash reporting at any time in the App’s Settings under “Crash & Error Reports”. Turning this off disables collection (setCrashlyticsCollectionEnabled(false)) and immediately deletes all unsent reports stored on the device (deleteUnsentReports()).
• Data Processed:
  • Stack traces, error logs, and runtime diagnostics when an unexpected failure occurs.
  • Device model, operating system version, available storage/RAM, and app orientation.
  • Allowlisted low-cardinality context keys (screen_id, operation, template_id, invoice_status, maintenance_state, entitlement_state). Non-fatal exceptions are strictly sanitized to error type names to prevent accidental leakage.
  • Firebase Sessions: Collects application lifecycle and session timing metrics to assess stability.
  • No User Tracking: Cavio never invokes setUserIdentifier(). Your identity, customer information, and invoice contents are never linked to crash dumps.

C. Google Mobile Ads / AdMob (Google LLC)

• Ad Format: Cavio displays Rewarded Ads only (RewardedAdService). These are optional, user-triggered ads that temporarily unlock premium document templates without a paid purchase. Cavio does not serve Banner Ads, Interstitial Ads, or App Open Ads.
• Privacy Controls: All ad requests are explicitly dispatched with nonPersonalizedAds: true. Cavio integrates the Google User Messaging Platform (UMP) to obtain required user consent in relevant jurisdictions (such as the European Economic Area).
• Automatically Collected & Shared Data: In accordance with Google Mobile Ads SDK (v25.4.0) official disclosures, the SDK automatically collects and shares certain information with Google and its partners for ad delivery, fraud prevention, frequency capping, and reporting:
  • IP address (used to derive approximate / coarse location).
  • Device and Account Identifiers (Android Advertising ID AD_ID via com.google.android.gms.permission.AD_ID).
  • User Product Interactions (ad views, ad clicks, video completion status).
  • Diagnostic Information (ad request latency, load errors).
• Data Isolation: Cavio does not pass invoice contents, customer names, or business profile details to the AdMob SDK.

D. Google Play In-App Billing (Google LLC)

• Purchases: Cavio offers an optional one-time, non-consumable in-app purchase (pbk_premium_templates_lifetime) to permanently unlock premium invoice styling templates.
• Financial Information: All financial transactions and payment card details (credit/debit card numbers, billing addresses) are processed directly by Google Play. Cavio does not collect, receive, or store any payment card or banking credentials.
• Purchase Tokens: A local purchase token received from Google Play Billing is cached exclusively on your device in SharedPreferences to enable offline verification of your purchased entitlements. It is not transmitted to any custom Cavio server.

E. Google Play In-App Review (Google LLC)

When prompted, the App may invoke the native Google Play In-App Review dialog. Star ratings and review text are submitted directly to the Google Play Store. Cavio has no programmatic access to your rating or written review.

5. Android Permissions

Cavio requests only the technical permissions necessary to operate its local features and integrated Google SDKs.

• INTERNET: Required for Google Mobile Ads, Google Play Billing, and crash/analytics telemetry.
• ACCESS_NETWORK_STATE: Used to verify network connectivity prior to ad loading or purchase verification.
• WAKE_LOCK: Used by Google Play services to schedule background diagnostic tasks.
• com.android.vending.BILLING: Required for in-app template purchases via Google Play.
• com.google.android.gms.permission.AD_ID: Required by the Google Mobile Ads SDK for advertising identification and fraud prevention.
• ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_TOPICS: Android Privacy Sandbox APIs utilized by the Google Mobile Ads SDK.
• FOREGROUND_SERVICE: Used by background job scheduling libraries.

Permissions We Do NOT Request:
Cavio does not request access to your device camera, external storage root permissions (READ/WRITE_EXTERNAL_STORAGE), device GPS location (ACCESS_FINE_LOCATION), contacts, calendar, microphone, or push notifications.

6. Data Retention and Deletion

1. Local Business Records: All customer, business, and invoice data remains stored in your device’s local database until you edit or delete individual records, or uninstall the App. Uninstalling Cavio deletes the local SQLite database and local preferences entirely.
2. Telemetry and Analytics Data: When enabled, data transmitted to Firebase Analytics and Crashlytics is retained in accordance with Google Cloud / Firebase default data retention schedules (typically 2 to 14 months for analytics events).
3. Data Deletion In-App:
   • Disabling “Crash & Error Reports” triggers deleteUnsentReports(), clearing pending crash logs from your device.
   • Disabling “Share Usage Analytics” triggers resetAnalyticsData(), clearing local analytics client identifiers.

7. Children’s Privacy

Cavio is a commercial productivity tool designed for business owners, contractors, and working professionals. It is not directed to children under the age of 13 (or under 16 in the European Union). We do not knowingly collect personal information from children.

8. International Data Transfers

Cavio does not operate independent international servers. However, when telemetry (Crashlytics, Analytics) or advertising (AdMob) services are active, technical identifiers and diagnostic information are processed by Google LLC on servers that may be located in the United States or other countries where Google operates infrastructure, subject to Google’s standard contractual clauses and privacy frameworks.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our technical architecture, legal requirements, or service enhancements. The revised policy will be posted within the application and at https://cavio-3317d.web.app/privacy with an updated “Last Updated” date.

10. Contact Us

If you have questions, feedback, or concerns regarding this Privacy Policy or our data handling practices, please contact us at: