Allowance: privacy

Allowance privacy policy
Effective 21 October 2026.

Moola operates Allowance. Contact us through https://project-moola-401d0.web.app/support. Allowance is an iPhone app for adults who choose app time budgets and read receipts explaining recorded blocks. We do not sell personal information, show ads or include an analytics SDK.

What stays on your device
The app stores your ledger in SQLite, separately for each account and for a signed-out preview. Minute ticks, Screen Time authorization, opaque app-selection tokens, extension actions and native event records stay on the device. Selections and extension records use Allowance's private App Group. Apple provides app selections as opaque tokens; Allowance does not receive your browsing history or the names of apps inside a selection. iOS controls usage counting and callback delivery. Missing timestamps are marked as gaps rather than invented.

Accounts and synchronization
Firebase Authentication processes the sign-in you choose: Sign in with Apple (an email address, which can be an Apple private relay address, and your name if you share it), Google (your Google account email, name and profile photo link) or your mobile number, to which Firebase sends a sign-in code by text message. Firebase stores account identifiers, email, provider details and the display name you choose. Never send us a sign-in code. Account persistence allows sign-in after reopening the app. Firebase App Check processes device/app attestation signals to protect account services.

Your account ledger includes rule labels and budgets, quiet hours, pauses, counting starts, corrections and their optional notes, block receipts, preferences and onboarding state. It synchronizes through Google Firebase project project-moola-401d0, named database moola. Minute ticks and app-selection tokens are excluded. Avoid putting sensitive information in rule labels or notes. Server app membership and your account identity authorize access. Data uses encrypted transport and Google's encryption at rest. This is not encryption with a key only you hold. Another phone must receive its own Screen Time permission and app selections.

Purchases
Apple processes payment details and subscription billing. Moola verifies signed store transactions and subscription status with Apple. We retain an opaque account-to-purchase identifier, product and transaction references, purchase and expiry dates, renewal state, environment and verification timestamps. These support paid access, restoration, refunds and account ownership. The app never receives your payment card details or Apple password. Verification and subscription events are processed by Firebase Functions. Offline access ends at the earlier of the current paid or approved grace period and the server verification deadline, at most seven days after verification.

Purpose and recipients
We use these records to provide accounts, sync, paid access, recovery, deletion and abuse prevention. Google Firebase and Apple process information needed for those services under their terms. We do not share app selections or minute ticks with them through our ledger sync. Service infrastructure can process technical requests and operational logs to deliver and protect the app. Support receives only the correspondence and attachments you choose to send. Use of providers can involve processing outside your country, subject to applicable protections.

Retention and deletion
Your account ledger remains until you delete the Allowance account. Pending sync retry records expire after seven days. Completed deletion confirmation and released membership records expire after 30 days. Purchase references detached from the deleted account expire after 90 days; they no longer contain your Firebase UID or opaque account-binding token. Provider deletion/TTL processing is asynchronous, and provider backups can persist according to their retention policies. Support correspondence is retained for 12 months after the case closes, unless law requires longer retention. Apple separately retains transaction and billing records under its policies.

Device erasure clears this device's current ledger, selections and monitoring state; it does not delete your server account or cancel a subscription. Export unfinished changes first. Account deletion removes the server ledger and purchase binding, then clears that account's cache when this app confirms completion. Other signed-in devices clear access when they next connect; offline copies can persist until then or until erased. An exported file, an OS backup or a separate signed-out preview is outside the account deletion worker. You control those copies.

Your choices
You can export your saved ledger without an active subscription, sign in again with the same Apple, Google or phone option, revoke Screen Time access, manage or cancel your Apple subscription, and request account deletion in the app or through Moola support. Apple-linked accounts confirm with Apple so its authorization can be revoked. A deletion request is not a completion confirmation. A shared Firebase identity is removed only when no other Moola product account survives. You can contact support about access, correction, deletion and other rights available under your local law.

Changes
We update this policy when the app's actual data practices change and identify the revised date. Material changes are presented before they take effect where required.