# Buy&Track Privacy Policy
**Last updated: October 5, 2026**
**Applies to Buy&Track version 3.0 and later**
## 1. Application publisher
The Buy&Track application is published by:
- Publisher: FT Mobile Studio
- Email address: buyandtrack.official@gmail.com
- Country: France
For any question concerning this policy or the protection of personal data, users may contact the publisher at the address indicated above.
## 2. Purpose of the application
Buy&Track enables users to:
- store invoices and proofs of purchase;
- photograph purchase documents, or select an existing image from the device;
- record information about their purchases and the items purchased;
- view an overview of their items and an indicative estimate of their value;
- create an inventory report (PDF) of their items, for example for their home insurer;
- estimate and track warranty expiry dates;
- receive local reminders before a warranty expires;
- display a home screen widget listing warranties that expire soon;
- search for and view stored documents;
- export a backup file;
- restore a previously created backup;
- optionally, turn on the Android system backup to the user's Google account;
- choose the interface language.
Warranty-related information is provided for guidance only. It does not constitute legal advice or a guarantee regarding the warranty period that actually applies to a purchase.
## 3. Data processed
Depending on how the application is used, Buy&Track may locally process the following information:
- purchase name or description;
- seller's name;
- purchase date and country of purchase;
- purchase amount and, if entered, the current value of the item;
- item category, brand, model and product reference;
- serial number and IMEI, if entered by the user;
- warranty duration and estimated expiry date;
- notes entered by the user;
- images imported from the device;
- photographs taken with the device camera;
- exported or restored backup files;
- application preferences, including the selected language, the number of invoices created and the time the last advertisement was displayed.
The serial number and IMEI are optional. They are stored only on the device, are masked on screen by default, and are included in an inventory report only if the user explicitly chooses to include them. The inventory report is created on the device and is shared only with the recipients the user chooses through the Android share menu. The value estimate is calculated on the device; no information is sent to an online service to obtain it.
This information may contain personal data if imported documents include details such as a name, postal address, email address, customer number, order number or partially displayed payment information.
Buy&Track is not intended to receive particularly sensitive information. Users should not import medical records, passwords, complete banking information, secret codes, identity documents or other information that is not necessary for tracking a purchase.
Separately from the information above, the advertising component described in section 9 processes technical data, including the advertising identifier of the device.
## 4. Local storage
Buy&Track stores information and documents directly on the user's device, in the private storage area associated with the application. Purchase details are held in a local database; photographs are held as files in the application's private folder.
Stored invoices and information are not transmitted to a server operated by the publisher. The publisher cannot remotely access invoices, photographs, notes or purchase information stored locally in Buy&Track.
The application also creates an automatic backup file every three days, retaining the five most recent ones, in the application's own storage area on the device. These files never leave the device unless the user moves or shares them.
**Optional Google backup.** By default, Buy&Track does not use the Android system backup service: no invoice, photograph or preference is copied to Google Drive or to a new device by the operating system. Users may turn on the "Automatic Google backup" option in the application's Settings. When it is on, and Google backup is also enabled in the device settings, Android periodically copies the invoice database, photographs and application preferences, encrypted, to the user's own Google account, and restores them when the application is reinstalled or when the user sets up a new device. This copy is handled by Google under the user's Google account and Google's own policies (<https://policies.google.com/privacy>); the publisher has no access to it. Turning the option off stops further copies, and users can delete existing backups from their Google account settings. Android limits this backup to 25 MB per application; beyond that limit, the copy may fail. When the option is off, replacing or resetting a device does not restore the data automatically: users must export a backup and import it themselves.
Local data may be deleted in the following situations:
- the application is uninstalled;
- application data is deleted from Android settings;
- the device is reset, lost or replaced;
- an invoice is deleted by the user within the application, which also deletes the associated photograph;
- a technical incident affects the device.
Users are responsible for regularly exporting a backup to an appropriate location.
## 5. Camera, photographs and files
Buy&Track can open the device camera application so that the user can photograph an invoice or proof of purchase. The application does not declare the Android camera permission: the photograph is taken by the camera application chosen by the user, which returns the resulting image to Buy&Track.
The application may also open the Android photo picker to select an existing image, and the Android document picker to choose where a backup file is written or which backup file is read.
**Document scanner and automatic reading.** When adding an invoice, the user may open Google's document scanner, provided by Google Play services, which crops and straightens the photographed page before returning the image to Buy&Track. The user may also choose a PDF file through the Android document picker; Buy&Track converts its first page into an image stored in the application's private folder, like a photograph.
Buy&Track then reads the text of the image to suggest the store, purchase date, total amount and product name. This reading is performed entirely on the device by Google ML Kit text recognition, provided by Google Play services: the image and the text read are not sent to the publisher or to any server for this purpose. The suggested values only fill empty fields, are marked as to be checked, and can be corrected by the user before saving. Google Play services may collect technical metrics on the use and performance of these components, under Google's own policies (<https://developers.google.com/ml-kit/terms>).
These functions operate only at the user's request. Buy&Track does not take photographs, record videos or select documents without the user's knowledge. The system pickers allow users to control precisely which items are made available to the application.
## 6. Notifications
Buy&Track schedules local reminders and may display a notification thirty days before a warranty expires, seven days before, and on the expiry date.
These notifications are generated on the device from locally stored data. No notification is sent from a remote server, and no notification service processes the content of invoices. On Android 13 and later, notifications require the user's authorization, which may be withdrawn at any time in the Android settings.
## 7. Purposes of processing
Locally stored data is used solely to:
- record and display purchases;
- store documents selected by the user;
- calculate an estimated warranty expiry date;
- identify active, expired or soon-to-expire warranties;
- display reminders and the home screen widget;
- search stored purchases;
- personalize the interface language;
- create a local backup and restore a backup selected by the user;
- limit how often advertisements are displayed;
- ensure the operation and security of the application.
Invoices, photographs, notes, amounts and any other information entered by the user are never used for advertising, profiling or marketing purposes, and are never transmitted to the advertising provider.
## 8. Legal basis
Where the General Data Protection Regulation applies, local processing is carried out at the user's request in order to provide Buy&Track's functions. Depending on the circumstances, processing may be based on:
- performance of the service requested by the user;
- the user's consent, for notifications and for advertising as described in section 9;
- the publisher's legitimate interest in ensuring the security and proper operation of the application.
Advertising and any associated storage or reading of information on the device rely on the user's consent where such consent is required, in particular in the European Economic Area, the United Kingdom and Switzerland.
## 9. Advertising
Buy&Track displays advertising provided by **Google AdMob** (Google Mobile Ads SDK). This section describes that processing in full.
**When an advertisement is displayed.** A full-screen advertisement may appear when the user opens the form used to add a new invoice. It never interrupts the saving of an invoice, never appears while editing an existing invoice, and its frequency is limited: none before the second invoice, then at most one for every two invoices created, and never twice within sixty seconds.
**Provider and recipient.** Google Ireland Limited and Google LLC, acting as independent controllers for this processing.
**Data collected by the advertising component.** The advertising identifier of the device, IP address, device and operating system characteristics, application identifier, and data relating to the display of and interaction with advertisements. This data is collected by Google's software component embedded in the application, not by the publisher, and the publisher does not receive a copy of it.
**Purposes.** Displaying advertisements, measuring their delivery, limiting repetition, detecting fraud and invalid activity, and, where the user has consented, personalizing advertisements.
**Legal basis.** Consent, where required. Buy&Track uses Google's User Messaging Platform to present a consent form to users located in the European Economic Area, the United Kingdom and Switzerland before any advertisement is requested. Where consent is not given, the application continues to operate in full; only advertising personalization and the associated processing are affected.
**Withdrawing or changing consent.** When the consent framework applies to the user, the application's Settings screen offers an option allowing the user to review and change their choice at any time. Independently of the application, users may reset or delete the advertising identifier of their device in the Android settings, under Privacy and then Ads.
**Advertising identifier permission.** In accordance with Google Play requirements, the application declares the `com.google.android.gms.permission.AD_ID` permission, which is provided by the advertising software component.
**International transfers.** Google may process this data outside the European Economic Area, including in the United States, under the safeguards it puts in place, such as the European Commission's standard contractual clauses and its adequacy commitments.
**Retention.** Retention of the data collected by the advertising component is determined by Google and governed by its own policies, available at <https://policies.google.com/technologies/partner-sites> and <https://business.safety.google/privacy/>.
## 10. Other third-party services and components
Beyond the advertising component described in section 9, the current version of Buy&Track contains no analytics tool, no crash reporting service, no behavioural tracking software and no user account system. The application creates no user account and provides no cloud synchronization.
If such a service were added, this policy would be updated beforehand to identify the provider, the data collected, the purposes, the legal basis, the recipients, the retention periods, any transfers outside the European Economic Area, and the means available to refuse or control the processing.
Google Play and the Android operating system may process certain technical information independently of Buy&Track, for distribution, installation, security, diagnostics or update management. Such processing is governed by Google's policies and those of the device provider.
## 11. Data transmission and sharing
Buy&Track:
- does not sell or rent user data;
- does not transmit invoices, photographs, notes or purchase information to the publisher's server, nor to the advertising provider;
- does not upload user data to the Android system backup service, unless the user turns on the optional Google backup described in section 4;
- does not create user accounts;
- does not provide cloud synchronization.
Apart from the optional Google backup that the user may turn on (section 4), the only data leaving the device is the technical data processed by the advertising component described in section 9.
If a user exports a backup or voluntarily shares a document through another application, any subsequent processing is governed by the service selected by the user. This may include a storage service, messaging application or file manager. The privacy policy of that third-party service will then apply.
## 12. Permissions used
The application requests the following permissions:
- **Internet and network state**: required by the advertising component;
- **Notifications**: required to display warranty reminders on Android 13 and later.
The advertising software component adds further permissions of its own to the application, in particular access to the advertising identifier. The application does not request access to contacts, location, microphone, call logs, SMS or files outside those explicitly selected by the user.
## 13. Data retention
Data recorded in Buy&Track is stored locally until one of the following events occurs:
- the user deletes an invoice, which also deletes its photograph;
- Android application data is deleted;
- Buy&Track is uninstalled;
- the device is reset or lost.
Automatic backup files are limited to the five most recent ones; older files are deleted by the application itself.
Exported backup files remain under the user's control. Buy&Track cannot delete copies stored in a file manager, external storage device, messaging service or cloud service selected by the user.
Retention of advertising data is determined by Google, as indicated in section 9.
## 14. Security
Buy&Track is designed to minimize data collection and to keep purchase information on the device. Users remain responsible for the physical and software security of their devices. Users are advised to:
- protect the device with a secure code or locking mechanism;
- keep Android and the application up to date;
- install Buy&Track only from a trusted source;
- store backups in a secure location;
- avoid sharing backups with unauthorized persons;
- remove or conceal unnecessary information shown on purchase documents.
No information system can guarantee absolute security. A person with access to an unlocked device or to an exported backup file may be able to view the stored documents.
## 15. User rights
Users can directly:
- view stored information;
- edit purchase details;
- delete an invoice, together with its photograph;
- export a copy of their information through the backup feature;
- change or withdraw their advertising consent, where the consent framework applies, from the application's Settings screen;
- reset or delete the advertising identifier in the Android settings;
- withdraw the notification authorization in the Android settings;
- delete all application data at once from the Android settings, under Applications, Buy&Track, Storage, Clear data, or by uninstalling the application.
Because purchase data is stored locally and the publisher holds no copy, the publisher is not technically able to access, correct or delete that information remotely.
Questions concerning personal data rights may be sent to buyandtrack.official@gmail.com.
Users may also lodge a complaint with the competent data protection authority. In France, the relevant authority is the Commission nationale de l'informatique et des libertés, known as the CNIL.
## 16. Use by children
Buy&Track is a general-purpose purchase document management tool. It is not designed for or directed at children, and is not intended for users below the age required to consent to data processing in their country.
The publisher does not knowingly collect children's personal data. As the application displays advertising, it is not suitable for audiences composed primarily of children.
## 17. International transfers
Invoices, photographs and purchase information remain on the user's device, unless the user turns on the optional Google backup described in section 4, in which case they are stored, encrypted, in the user's Google account.
Transfers may occur in two situations: the technical data processed by the advertising component, as described in section 9, and any backup that the user voluntarily exports or shares with a third-party service. In the latter case, the applicable terms and safeguards depend on the service selected by the user.
## 18. Changes to this policy
This policy may be updated to reflect:
- changes to Buy&Track's features;
- the addition or removal of an online service or software component;
- regulatory developments;
- changes to Google Play requirements;
- improvements to security measures.
The date shown at the beginning of this document will be updated accordingly. Any material change affecting data processing will be brought to users' attention by an appropriate means.
## 19. Contact
For any questions regarding this policy:
- Buy&Track
- Publisher: FT Mobile Studio
- Email address: buyandtrack.official@gmail.com
- Country: France