Privacy Policy

About this policy

This policy describes how Noot, the personal accounting and asset-tracking app for Android distributed on Google Play (package com.arian.noot), handles your information. Noot is developed and operated by [DEVELOPER NAME] (“we”, “us”).

This policy covers only the Google Play version of Noot and the server it connects to. Where we say “our server”, we mean the server that the Google Play version of Noot talks to.

Your crypto wallets

Noot connects to your crypto wallets in read-only mode, so it can count their balances as part of your assets.

Blockchain wallets

To connect a blockchain wallet, you give Noot only its public addresses or its extended public key (xpub). These are enough to read a balance and cannot be used to move funds. However, anyone who has them can see that wallet’s balance and transaction history, so Noot treats them as private data.

Exchange accounts

To connect an exchange account, you give Noot an API key from that exchange (and its secret or passphrase, where the exchange requires one). Please create a read-only key. Where the exchange allows it, Noot checks the key’s permissions and warns you if the key can do more than read balances.

Where this information goes

• Stored only on your phone, encrypted. Addresses, xpubs and exchange keys are kept in encrypted storage on your device, protected by a key held in your phone’s secure hardware (Android Keystore).
• Never sent to our server. They are not included in your backup, and they are not shown in Noot on the web, which shows only a wallet’s name and balance.
• Balances are read directly from your phone. To show a balance, Noot sends the address or xpub straight from your phone to a public blockchain service for that network, or sends a request signed with your API key straight to that exchange. Those services receive the address, xpub or key you are querying, along with your IP address, and handle it under their own privacy policies. For xpub-based Bitcoin, Litecoin and Dogecoin wallets, the xpub itself is sent to the service. For Ethereum-compatible and Tron wallets, Noot derives the addresses on your phone and sends only those.

Information we collect

Most of what you enter in Noot (payments, income, groups, assets and wallets) stays on your phone. The table below lists everything that reaches our server, or Google on our behalf.

Prices and exchange rates are downloaded from our server. Those requests carry your subscription license, never your holdings or wallet details.

Your encrypted backup

Backup is off until you turn it on. When you enable it, Noot creates a recovery code on your phone. Each backup is encrypted on your phone (AES-256-GCM) with a key derived from that code before it is uploaded. Our server stores only the encrypted file and never sees your recovery code, so we cannot read your backup, and we cannot recover it if you lose the code.

A backup contains your payments, income, groups, plans and manually entered assets, plus display settings such as language, currency, calendar and theme. It never contains wallet information: no addresses, xpubs, exchange keys, balances or wallet history.

Showing the recovery code on screen requires your phone’s fingerprint, face or screen lock, if your phone has one set.

Data kept on your phone

Everything you enter in Noot is stored in a database on your phone. The database is encrypted with a random 256-bit key protected by Android Keystore. Your sign-in credentials, license and exchange keys are encrypted the same way.

Android’s own device backup (to your Google account or a new phone) is limited to display preferences such as theme, language and sort order. Your financial data, wallets and credentials are excluded.

Noot checks your phone for signs of rooting and for an active VPN or proxy. These checks run on your phone, and their results are not sent to us.

Noot on the web

You can open Noot in a computer’s browser by scanning a QR code with the app. Before you approve, the app shows you the browser’s IP address and description. The session works only while your phone is available.

Data shown in the browser is end-to-end encrypted between your phone and that browser. Our server only passes the encrypted data along and holds no key to open it. Wallets appear in the browser only by name and balance. Addresses, xpubs and exchange keys are never shared with the browser. We store the browser’s IP address and description with the session so you can see and end it.

Third-party services

Noot uses the following services. Each one processes data under its own privacy policy.

• Google Sign-In (Google Play services) is used to sign you in.
• Google Play Billing processes subscription purchases. Google handles your payment details.
• Firebase Cloud Messaging (Google) delivers notifications. Notifications contain only an identifier for the support reply, never the message text.
• Google Analytics for Firebase automatically collects app usage information. This includes app opens and updates, screens viewed, session length and engagement, the device model and operating system version, the app version, your approximate country or region from your IP address, a per-installation app instance ID and, where your device settings allow, your device’s advertising ID. We do not send your financial data, wallet details, email address or name to Analytics, and we do not use Analytics for advertising. You can reset or delete your advertising ID in your phone’s settings.
• Google ML Kit reads QR codes. The scanning happens on your phone.
• Blockchain services and exchanges provide wallet balances. See Your crypto wallets.

Google’s privacy policy is at policies.google.com/privacy.

App permissions

Noot does not request access to your location, contacts, SMS messages, call log or phone state.

How we use information

We use the information described above only to:

• create your account, sign you in and keep it secure
• provide the free trial and subscriptions, and prevent abuse
• store and restore your encrypted backup
• answer support requests and notify you of replies
• keep the service running, fix problems and improve the app
• meet legal, tax and accounting obligations

We do not sell or rent your information, we do not show ads, and we do not share your information with third parties for their own marketing. We disclose information only to the service providers listed in this policy, or when the law requires it.

Where data is stored

Our server is hosted in [HOSTING COUNTRY / PROVIDER]. Our encrypted database backups are stored with [BACKUP STORAGE PROVIDER, COUNTRY]. Google and the other services listed above may process data in other countries under their own safeguards.

How long we keep it

• Account details are kept while your account exists. See Deleting your account.
• Sign-in sessions, including their IP address and device description, are kept until you sign out, end the session or delete your account.
• Support conversations are kept while they are open, and are deleted 90 days after they are closed, together with their messages.
• Server logs are kept for up to [N] days.
• Encrypted database backups are replaced on a rolling basis. Deleted data can remain in them for up to about three weeks.
• Purchase and subscription records are kept as long as tax and accounting rules require.

Deleting your account

You can delete your account at any time in the app (Settings → Account → Delete account). This requires confirmation with your phone’s fingerprint, face or screen lock. If you can no longer use the app, email us at [CONTACT EMAIL] from the email address of your Google account, and we will delete your account for you.

Deleted immediately

• Your name, email address and link to your Google account
• Your passkey and all your sign-in sessions
• On your phone: all of the account’s data, wallets, exchange keys, credentials and encryption keys

Kept after deletion

• Purchase and subscription records, linked to an anonymous account number, for accounting, tax and refunds.
• A one-way code derived from your Google account ID (it cannot be turned back into the ID), which records that the account used its free trial.
• Device trial records: the device’s Android ID and security-key public key, to prevent the free trial from being reused.
• Your encrypted backup, if you created one. It stays unreadable without your recovery code. To have it removed, contact us.
• Support conversations, until 90 days after they are closed.

Deleted data can remain in our encrypted database backups for up to about three weeks before those backups are replaced.

Signing out without deleting your account removes your session and notification token from our server. The data on your phone stays there until you uninstall the app or delete the account.

Security

All connections between the app and our server use HTTPS. Each request is also signed with a key bound to your device, so a stolen sign-in token cannot be used from another device. Email addresses are encrypted on our server, and sign-in tokens are stored only as hashes. Our database backups are encrypted.

Support staff see a pseudonym instead of your identity. They see your subscription status but not your name or email. Only a small number of administrators can see account details, and only when a request requires it. Each such access is recorded.

Support messages are stored on our server as plain text, so please never include a seed phrase, private key or password in them. The app rejects messages that look like a seed phrase.

No system is perfectly secure, but we design Noot so that your most sensitive data, your wallets and financial records, never reaches us in readable form.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how it is processed, and to complain to your local data protection authority. You can change your name and delete your account in the app. For any other request, contact us at the address below. We will reply within 30 days.

Children

Noot is not intended for children under 13 (or the minimum age for consent in your country), and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy as Noot changes. We will post every update on this page and change the “Last updated” date. If a change significantly affects how we handle your information, we will also tell you in the app before it takes effect.

Contact us