NirevonCards Privacy Policy

Version: 1.0
Effective / last updated: 25 August 2026

This Privacy Policy explains how the NirevonCards mobile application (package ID com.nirevoncards.app) processes personal data. It applies to the app and its related cloud features.

1. Controller and contact

Controller: aleksandrs baranovs, independent developer of NirevonCards, established in Latvia.

Privacy contact: nirevoncards@gmail.com.

Website: https://nirevoncards.com/

NirevonCards is currently provided free of charge for testing and does not contain advertising, paid subscriptions, paid retailer placement, or the sale of personal data. If the service is monetized or the legal status of the provider changes, these disclosures will be reviewed and updated before the relevant commercial activity begins.

2. Our privacy approach

• Core loyalty-card data is stored locally on the user's device.
• Google sign-in is required to use NirevonCards. Cloud backup is a separate optional feature.
• NirevonCards does not sell personal data.
• NirevonCards does not use personal data for targeted advertising or advertising profiling.
• Smart Point Search (SPS) compares location locally against downloaded GEO data.
• Current coordinates are not sent to Nominatim, Overpass, or another coordinate lookup service.
• New cloud backups are encrypted on the device before upload using AES-256-GCM.

3. Data processed

3.1 Data stored locally

The app may store on the device:

• shop and loyalty-program names;
• loyalty-card number, barcode or QR-code value;
• country, category, brand identifiers and related card details;
• user-saved GEO points, including latitude, longitude, address, radius and creation time;
• app settings;
• locally cached brand/GEO data and map tiles;
• temporary map-preview files;
• a local record of legal-document acknowledgement for the current account, which may include the Firebase UID reference, accepted Terms version, acknowledged Privacy Policy version and confirmation timestamp.

Account-local data remains on the device until the user deletes it, confirms Sign out, clears app data, or uninstalls the app, subject to Android's own device-storage behavior. A confirmed Sign out clears the current user's local card/GEO data and local legal-acknowledgement state. Public/non-personal caches may remain.

3.2 Google account and Firebase data

If the user signs in with Google, Firebase Authentication may make available to the app:

• Firebase user ID (UID);
• name;
• email address;
• profile-photo URL;
• sign-in provider information;
• account-creation and last-sign-in timestamps.

NirevonCards does not receive or store the user's Google password.

3.3 Cloud backups

If the user creates a cloud backup or enables automatic cloud backup, the backup may contain loyalty-card data, card-code values, user GEO points, addresses and portable settings.

New backups are encrypted on the device using AES-256-GCM before upload. The recovery key is not stored in Cloud Firestore. It may be stored locally in protected Android storage and, if the user chooses, through a credential/password provider configured on the device. NirevonCards cannot recover a lost recovery key and cannot read encrypted backup content without it.

Technical metadata may be stored separately from encrypted content, including backup ID and time, app/format version, card and GEO-point counts, sizes, checksum, upload state and encryption parameters.

3.4 Location

With Android permission, the app may obtain approximate or precise foreground location to:

• find a relevant loyalty card nearby;
• operate Smart Point Search (SPS);
• add a user GEO point;
• display GPS status and prepare nearby-search functionality.

NirevonCards does not request background location. If location permission is already granted, the app may obtain a current location when it starts so that nearby features are ready. Permission can be withdrawn in Android settings.

SPS matching is performed locally. Current user coordinates are not sent to an address/shop lookup service. Saved GEO points can reach the cloud only inside an encrypted backup chosen by the user.

When map tiles are requested, the map-tile provider may receive ordinary network information such as IP address, User-Agent and requested tile identifiers. Tile identifiers can indicate the map area being viewed.

3.5 Camera and selected images

The camera is used after a user action to scan a barcode or QR code. An image selected from the gallery may be processed to recognize a code. Recognition is performed on the device; NirevonCards does not upload the source image to its own server or retain it as part of a loyalty card.

3.6 Technical and security data

Google/Firebase may process technical data needed for sign-in, cloud functions and abuse prevention, including IP address, app/device version information, session data, authentication tokens, Play Integrity attestation material and Firebase App Check tokens.

The current NirevonCards version does not use first-party advertising analytics or Crashlytics.

4. Purposes and legal bases

Where GDPR applies, processing may rely on the following legal bases:

• Performance of requested services / steps at the user's request: sign-in, local card functions, backup, restore, export and account deletion.
• Consent or the user's explicit action: Android permissions for location/camera and optional features where consent is the appropriate legal basis.
• Legitimate interests: protecting accounts and cloud data, preventing abuse, verifying app integrity and maintaining security, provided those interests are not overridden by the user's rights.
• Legal obligations: processing necessary to comply with applicable law or valid legal requests.

5. Service providers and recipients

NirevonCards may use the following service providers only as needed for their functions:

• Google LLC / Firebase: Google Sign-In, Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase App Check, Play Integrity-related services and Credential Manager. Google Privacy Policy · Firebase privacy and security information
• OpenStreetMap Foundation / map-tile infrastructure: map-tile delivery. Privacy Policy
• GitHub, Inc.: delivery of public brand/GEO files. NirevonCards does not add the user's current coordinates to those downloads. GitHub Privacy Statement
• Credential/password provider selected on the device: optional storage/retrieval of recovery credentials according to the provider chosen by the user.

These providers may receive standard network data such as IP address and User-Agent. NirevonCards does not send loyalty-card records to retailers and is not part of retailers' loyalty programs unless a future partnership is expressly disclosed.

6. International processing

Cloud data for supported NirevonCards accounts is configured to use European infrastructure where the relevant Firebase service supports regional selection. Firebase Authentication and some security/global services may process data through Google infrastructure in the United States or other countries. OpenStreetMap and GitHub also use distributed/global infrastructure.

Where GDPR requires safeguards for transfers outside the EEA, applicable transfer mechanisms and safeguards provided by the relevant service provider are used.

7. Retention

• Local cards, user GEO data and account-local legal-acknowledgement state remain until deleted by the user, the user confirms Sign out, app data is cleared, or the app is uninstalled. Confirmed Sign out clears this account-local data from the device.
• Account-related cloud data remains while the account is active or until deletion is requested, subject to necessary technical retention.
• NirevonCards is designed to retain no more than two ready cloud backups per account; older/incomplete backups are removed through cleanup processes.
• Account deletion is scheduled seven days after a confirmed request and can be cancelled before the scheduled time.
• At the scheduled deletion time, the Nirevon account and associated cloud data are deleted according to the deletion process. When the app ends the authenticated session after final deletion, the local Sign-out cleanup described above applies.
• Limited residual copies or logs may remain temporarily in infrastructure-provider backup/security systems under those providers' retention rules and are not used to restore the deleted Nirevon account.

8. Your rights

Depending on applicable law, users may have rights to access, correct, delete, restrict or obtain a copy of their personal data, object to certain processing, and withdraw consent for future processing.

NirevonCards provides:

• editing/deletion of local cards and GEO points;
• cloud-data export through Account → Download my data;
• account deletion through Account → Delete account;
• withdrawal of Android permissions through device settings.

Privacy requests may be sent to nirevoncards@gmail.com. For actions that affect account security, NirevonCards may require reauthentication or another reasonable identity-verification step.

Users in the EEA may also lodge a complaint with their competent data protection authority. The Latvian supervisory authority is Datu valsts inspekcija.

9. United States privacy disclosures

These disclosures are provided for users in the United States and apply to the extent a particular federal or state privacy law applies to NirevonCards.

• NirevonCards does not sell personal data.
• NirevonCards does not share personal data for cross-context behavioral advertising or targeted advertising.
• NirevonCards does not use a user's activity across unrelated third-party websites or apps to build an advertising profile.
• Because NirevonCards does not sell data or use it for targeted advertising, there is currently no separate sale/targeted-advertising opt-out to exercise.
• NirevonCards does not offer financial incentives in exchange for personal data.
• Categories of data, purposes, service providers, retention and user-request methods are described in this Policy.

Do Not Track and similar browser signals

NirevonCards does not engage in cross-site or cross-app behavioral advertising tracking. Browser Do Not Track signals therefore do not change NirevonCards' advertising behavior because the app does not perform that type of tracking. If a legally recognized universal opt-out signal becomes relevant to processing performed by NirevonCards, it will be honored where required by applicable law.

Third-party infrastructure providers may receive the technical/network data described in Section 5 when their services are used. NirevonCards does not authorize those providers to use NirevonCards user data for NirevonCards-targeted advertising.

10. Children and age

NirevonCards is a general-audience loyalty-card utility and is not directed to children under 13.

NirevonCards does not intentionally seek to collect personal data online from children under 13. For a general-audience service, if NirevonCards obtains actual knowledge that an account belongs to a child under 13 and parental authorization is legally required, appropriate steps will be taken to obtain the required authorization or delete/disable the affected online account data.

Users who are minors under the law of their country should use the service only as permitted by applicable law and with parent or guardian involvement where required. The current closed-testing version does not impose a separate 16+ or 18+ age gate.

11. Automated decisions

The app may automatically compare the current location with a local database to suggest a relevant loyalty card. This does not produce legal or similarly significant effects for the user.

12. Security

Measures include HTTPS, cloud-access controls, reauthentication for sensitive actions, Firebase App Check/Play Integrity, AES-256-GCM encryption for new backups, Android Keystore and backup-integrity verification. No technical measure can guarantee absolute security.

13. Changes to this Policy

The current Privacy Policy version is shown at the top. NirevonCards may store locally, for the current account, the Privacy Policy version that the user confirmed they had read and the confirmation timestamp.

If a future app version requires acknowledgement of a newer Privacy Policy version, the user will be shown the newer version before continuing. Minor editorial corrections that do not materially change the described processing may be published without changing the acknowledgement version.

Where applicable law requires additional notice or consent for new processing, it will be provided before the relevant processing begins.

14. Contact

Controller: aleksandrs baranovs

Email: nirevoncards@gmail.com

Website: https://nirevoncards.com/