Dinly — Privacy Policy

1. Who we are and who this policy covers

This Privacy Policy describes how Dinly ("Dinly", "we", "us", "our") collects, uses, stores, and shares information when you use the Dinly mobile application ("App"), available on the Apple App Store and the Google Play Store. Dinly is developed and operated by Nixelion Ltd., a company registered in Malta (registration number: <tba>, pending).

This policy covers all users of the App worldwide, including users located in the European Union and European Economic Area ("EU/EEA"), the United Kingdom ("UK"), the United States ("US"), and all other territories where the App is available.

If you are located in the EU/EEA or UK, we process your personal data as described in Section 11 (GDPR and UK GDPR Rights) of this policy.

2. Summary of what we collect

We collect the minimum data necessary to provide the App's core functionality: shared family budget management, group money request and approval, and payment coordination.

We do not collect: bank account numbers, card numbers, government identifiers, biometric data, location data, contacts, browsing history, or health data.

3. Information you provide directly

3.1 Account and profile information

When you create or join a group you provide a display name. If you sign in using Apple Sign In or Google Sign In, we receive a unique identifier and, where you permit it, your name and email address from those providers.

3.2 Group content

You provide group names, envelope names, budget amounts, request notes, and optional payment handle details (such as a PayPal email address or Venmo username). This content is stored in Firebase Firestore to enable the shared group functionality.

3.3 Payment handles

If you choose to add payment handles (PayPal, Venmo, Cash App, Revolut usernames or email addresses), these are encrypted using AES-256-GCM on your device before transmission. The encryption key is derived from your group's invite code. We cannot read the plaintext value of your payment handles. You are not required to provide payment handles to use the App.

4. Information collected automatically

4.1 Device and technical information

We collect a device-local identifier generated on first launch. This identifier is stored locally on your device and is used solely to identify your membership within a group. It is not linked to your name, email, or Apple/Google identity unless you sign in.

4.2 Authentication tokens

Firebase Authentication issues authentication tokens to verify your identity when reading or writing group data. These tokens are managed by Firebase and are not accessible to us directly.

4.3 Advertising identifiers (members on Free and Plus tiers only)

If you use the App as a group member on the Free or Plus subscription tier, the App displays advertisements served by Google AdMob. AdMob may collect your Advertising Identifier (IDFA on iOS, Advertising ID on Android) to serve relevant advertisements, subject to your consent via Apple's App Tracking Transparency prompt on iOS or your Android device settings. If you decline tracking, AdMob will serve contextual advertisements that do not use your advertising identifier. Group owners never see advertisements regardless of subscription tier.

5. How we use your information

We use the information we collect to:

• Create and manage your group and budget envelopes
• Identify you to other members of your group by your display name
• Enable you to submit, review, and resolve money requests
• Display your payment handle to the group owner when a request is approved, enabling them to initiate a payment through a third-party payment application
• Authenticate your identity across devices using Firebase Authentication
• Deliver relevant advertisements to group members on Free and Plus tiers (never to group owners)
• Comply with legal obligations
• Respond to your support requests

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

6. Legal bases for processing (EU/EEA and UK users)

If you are located in the EU/EEA or UK, we process your personal data under the following legal bases under the General Data Protection Regulation (GDPR) and UK GDPR:

7. How we share your information

7.1 Within your group

Your display name, request notes, and payment handles (if set) are visible to the group owner. Your display name is visible to other group members.

7.2 Service providers

We share data with the following third-party service providers who process data on our behalf:

Google Firebase (Firestore and Authentication) — Stores group data and manages authentication. We use the europe-west1 (Belgium) data center. Google's privacy policy: policies.google.com/privacy.

Google AdMob — Serves advertisements to group members on Free and Plus subscription tiers. Google's privacy policy: policies.google.com/privacy.

Apple (Sign In with Apple, App Store, StoreKit) — Manages optional Apple Sign In and iOS subscription billing. Apple processes all iOS payment transactions; we never receive your payment card details. Apple's privacy policy: apple.com/legal/privacy.

Google Play (Sign In with Google, Play Billing) — Manages optional Google Sign In and Android subscription billing. Google processes all Android payment transactions; we never receive your payment card details. Google's privacy policy: policies.google.com/privacy.

7.3 Payment applications

When the group owner approves a money request, the App may launch a third-party payment application (such as PayPal, Venmo, Cash App, or Revolut) with the recipient's handle and the approved amount pre-filled. These payment applications are independent services with their own privacy policies. We do not transmit data to these applications directly — the App opens them via deep link and the user initiates the payment manually. We do not process, hold, transmit, or guarantee any payment.

7.4 Legal requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our legal rights, prevent fraud, or protect the safety of any person.

7.5 Business transfers

If Dinly or its assets are acquired by or merged with another entity, your information may be transferred as part of that transaction. We will notify you by updating this Privacy Policy before your information becomes subject to a different privacy policy.

We do not sell your personal data to third parties. We do not share your data with advertisers beyond what is described in Section 7.2 above.

8. Data retention

We retain your personal data for as long as your account is active or as needed to provide the App's services.

Group data (envelopes, requests, members, activity history) is retained in Firebase Firestore for as long as the group exists. When you delete your account or are removed from all groups your data is deleted within 30 days, except where retention is required by applicable law.

Authentication records held by Firebase Authentication are deleted within 90 days of account deletion.

Advertising identifiers are processed by Google AdMob subject to Google's own retention policies.

9. Data security

We take reasonable technical and organisational measures to protect your data including:

• AES-256-GCM encryption of payment handles, applied on-device before transmission
• Firebase Security Rules requiring authenticated sessions for all Firestore reads and writes
• HTTPS/TLS encryption for all data in transit
• Firebase Authentication token validation on all Firestore operations
• Group data accessible only to verified group members

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify you without undue delay as required by applicable law.

10. Children's privacy

The App is not directed at children under the age of 13 in the United States or under the age of 16 in the EU/EEA. We do not knowingly collect personal data from children under these ages. If we become aware that a child under the applicable age has provided personal data to us without parental consent, we will delete that data promptly.

If you believe a child has provided us with personal data, please contact us at contact@dinly.online.

The App may be used by parents to manage budget allowances for their minor children. In such cases the parent or guardian is the account holder and is responsible for the minor's use of the App.

11. Your rights (EU/EEA and UK users)

If you are located in the EU/EEA or UK you have the following rights under GDPR and UK GDPR:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete personal data.
• Right to erasure — request deletion of your personal data where it is no longer necessary, where you withdraw consent, or where it has been unlawfully processed.
• Right to restrict processing — request that we limit processing in certain circumstances.
• Right to data portability — request a copy of your data in a structured, machine-readable format, where processing is based on consent or contract.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent (such as advertising).

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights contact us at contact@dinly.online. We will respond within 30 days. Nixelion Ltd. is established in Malta; our lead supervisory authority is Malta's Information and Data Protection Commissioner (idpc.org.mt). You also have the right to lodge a complaint with your own national data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk).

12. Your rights (US users — California, Virginia, Colorado, and other states)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete — request deletion of personal information we have collected, subject to certain exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell personal information. We do not share personal information for cross-context behavioural advertising purposes except as described in Section 7.2 (AdMob advertising). You may opt out by declining tracking.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise your rights, contact us at contact@dinly.online. We will respond within 45 days as required by the CCPA. Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other US states with comprehensive privacy laws have similar rights and receive the same response commitments.

13. International data transfers

Firebase Firestore stores group data in the europe-west1 (Belgium) data center within the European Union. If you access the App from outside the EU, your data may be transferred from your location to the EU. Such transfers are protected by standard contractual clauses and Google's compliance with the EU-U.S. Data Privacy Framework.

Firebase Authentication may process data in the United States. Google participates in the EU-U.S. Data Privacy Framework. Transfers to the US are protected by Google's standard contractual clauses approved by the European Commission.

14. Third-party links and services

The App enables you to launch third-party payment applications (PayPal, Venmo, Cash App, Revolut) via deep link. These applications are not operated by us and are not subject to this Privacy Policy. We encourage you to review the privacy policies of any third-party service you use.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the effective date at the top of this policy and notify you through the App or by other means. Your continued use of the App after such notification constitutes your acceptance of the updated policy.

16. Contact us

For privacy-related questions, requests, or complaints:

Email: contact@dinly.online
Entity: Nixelion Ltd. (Malta), registration number <tba>
Registered address: <tba>

EU/EEA users may also contact Malta's Information and Data Protection Commissioner (idpc.org.mt) or their own national data protection authority. UK users may contact the Information Commissioner's Office at ico.org.uk.