Privacy policy

Who operates Vynko

Vynko (com.itoolverse.vynko) is developed and operated by iToolVerse, an individual developer. This policy covers the Vynko Android app and this website, vynko.itoolverse.com. For any privacy question, write to vynko.support@itoolverse.com.

What we collect

Account data. When you sign up with email and password, we store that through Firebase Authentication. If you sign in with Google, we receive your basic Google account profile — name, email, and photo.

Sign-up email screening. When you create an account with an email address and password, we check that the address is a real, usable mailbox rather than a throwaway one. Most addresses are settled without leaving our own systems: well-known providers (Gmail, Yahoo, Outlook, Proton and similar) are accepted straight away, and a bundled list of known disposable-mail domains is rejected on your device. If your address is neither, we send only that email address — never your name, your password, or anything you have entered in the app — to QuickEmailVerification (quickemailverification.com), a third-party email-verification service acting as our processor. It tells us whether the address is deliverable and whether it belongs to a disposable-mail provider, and we use that answer for one purpose only: deciding whether to keep the account. If the address is rejected, the account is deleted immediately and nothing further about you is stored. If the service is unavailable or unsure, we accept the address. Addresses used for Google Sign-In, and addresses that are already verified, are never sent.

Profile data. Your display name, and a profile photo — either your Google photo or a custom image you upload (up to 50MB), stored in Firebase Cloud Storage.

Financial ledger data you enter. Books, transactions (amount, date, category/subcategory, tags, payment mode, currency, and any free-text notes you add), goals, and budgets. This is manual entry only — Vynko never connects to a real bank account, card, or UPI provider.

Shared Books. A Book is only shared if you choose to share it. When it is, every member of that Book can see, edit and delete everything in it — all transactions, amounts, dates, categories, tags, payment modes, budgets, goals, and any free-text notes — no matter which member entered them. There are no private entries within a shared Book. Members also see your display name, your photo, and any nickname the Book's owner has set for you. Only the Book's owner can invite or remove members or delete the Book; any member can leave it at any time. Your other Books stay private to you — sharing one Book never exposes another.

Push notification token. A device-level token used only to deliver alerts such as "a member added a transaction" to other Book members.

Automatically collected technical data. Crash reports and stack traces (Crashlytics), app performance traces such as startup time, screen render, and network timing (Performance Monitoring), and usage/session analytics (Firebase Analytics/GA4). These all include device model, OS version, and app version — they describe the app's behavior, not your finances.

Approximate location. We never ask for location permission, and Vynko never reads your device's GPS or precise location. Google Analytics, Crashlytics and Performance Monitoring do infer an approximate location — typically country or region — from the IP address your device connects from. This is why "Approximate location" appears in the app's Google Play Data safety listing.

Settings and preferences. Your app preferences — theme, language, date and number format, sound effects, which optional fields are shown, and your notification and reminder settings — are stored on your account so they follow you to a new device. A small amount of data stays on the device only and never reaches us: for example, the timestamps that enforce the cooldown between exports.

What we never collect

Vynko has no advertising SDKs and does no ad tracking — we don't sell or share your data with advertisers, and we don't request precise or background location. This website uses Google Analytics 4 to measure page visits, which sets first-party analytics cookies in your browser; it is used for aggregate traffic measurement only and is never combined with anything in your Vynko account. The contact form on our support page is protected by Cloudflare Turnstile, a bot check that loads a script from Cloudflare. We run no advertising or profiling trackers on this website.

Where your data is processed and stored

Your data is processed and stored on Google Firebase / Google Cloud, primarily in the asia-south1 (Mumbai) region, for the database, file storage, and server functions. Some of Google's own infrastructure — Analytics, Crashlytics, and Play services — may process technical data outside that region as part of Google's global infrastructure; this is standard for services built on Google's platform.

The following Google LLC services act as sub-processors on our behalf: Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Crashlytics, Performance Monitoring, Google Analytics for Firebase, Firebase Cloud Messaging, Firebase Remote Config, and Google Play services (In-App Update, In-App Review). In addition, QuickEmailVerification processes sign-up email addresses on our behalf, solely for the throwaway-address screening described above.

The website additionally relies on Cloudflare (hosting, and the Turnstile bot check on the contact form) and Resend (contact-form email delivery) as sub-processors.

This website

This website is a static site served through Cloudflare, which processes each request (including your IP address) as our hosting provider. If you use the contact form on the support page, the name, email address, topic and message you enter are sent to our support mailbox and a copy of the confirmation is sent back to you, using Resend as our email-delivery provider; the submission is checked by Cloudflare Turnstile to keep out automated spam. We use what you send us only to answer you. Visits to the site are measured with Google Analytics 4 as described above. The website is entirely separate from your Vynko account — nothing you enter here is written into your Books, and nothing from your Books is read here.

Retention and deletion

Deleting a Book (owner-only, in-app) deletes its transactions, categories, tags, and everything else stored in it. There is currently no in-app "delete my account" flow — full account deletion is handled manually by our support team on request. See how to delete your account for the exact steps.

Your rights

Access and export. The in-app Export feature lets you download a Book's transactions for a chosen year as a CSV or PDF file. If you need a copy of anything Export doesn't cover, write to us and we'll help.

Correction. Edit any entry directly in the app.

Deletion. Delete a Book in-app at any time; request full account deletion via vynko.support@itoolverse.com.

Depending on where you live, you may also have rights to rectification, erasure, restriction of processing, data portability, and objection to processing, in line with GDPR- and CCPA-style protections. Contact us to exercise any of these rights.

Security

Data is encrypted in transit (HTTPS/TLS) and at rest using Firebase's default encryption. Cloud Firestore security rules restrict a Book's data to that Book's own members only.

Children

Vynko is intended for adults and is not directed at children. You must be at least 18 to create an account, and we don't knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, contact us and we'll delete it.

Changes to this policy

When this policy changes, we post the new version here with an updated "last updated" date. If a change materially affects how your data is handled, we flag it in the app before it takes effect.

Contact and governing law

For any privacy question or request, write to vynko.support@itoolverse.com. This policy is governed by the laws of India, and the courts at Kolkata, West Bengal have exclusive jurisdiction over any dispute arising from it.