Privacy Policy for DukaanRoznamcha

At DukaanRoznamcha (operated by NexCodea Tech), we take your privacy and the security of your business accounting data with utmost seriousness. DukaanRoznamcha is designed primarily as a 100% Offline-First Point of Sale (POS), inventory management, and Udhaar Khata bookkeeping application for mobile devices (Android and iOS).

This Privacy Policy explains what information is collected, how it is used, how your local shop data is stored, and how optional integrations (such as Google Drive backup) operate under strict compliance with Google's API policies.

1. 100% Local On-Device Data Storage (Offline-First)

All your core business operational data—including your product catalog, Tijarat Multi-UoM hierarchies (Carton, Box, Piece), sales invoices, supplier purchases, customer/supplier credit records (Khata), expense journals (Roznamcha), and loan accounts—is stored locally on your device in an encrypted/structured SQLite database (expo-sqlite).

NexCodea Tech does not upload, copy, inspect, or sell your shop's transactions, customer names, or sales numbers to any central or third-party marketing server. You retain 100% ownership of your business data.

2. Google Account & Google Drive API Integration

DukaanRoznamcha offers an optional cloud backup feature powered by Google Drive. When you choose to link your Google Account:

• Authentication (Google Sign-In): We use OAuth 2.0 PKCE to authenticate your identity (name, email address, profile picture). Your email is used to identify your account and enforce single-device authorization to protect your business records.
• Google Drive Backup (drive.file Scope): When you manually trigger or schedule an automated backup, DukaanRoznamcha requests access only to the restricted https://www.googleapis.com/auth/drive.file scope. This scope grants our app permission to access only the specific backup files created by DukaanRoznamcha (saved in a designated folder such as DukaanRoznamcha_Backups). We cannot see, read, modify, or delete any other documents, photos, or files in your Google Drive.
• No Third-Party Transmission: Your backup archives are stored directly in your personal Google Drive account. NexCodea Tech does not receive or store copies of your Google Drive backup files on any intermediary servers.

3. Device Permissions & How They Are Used

DukaanRoznamcha requests minimal device permissions, strictly when necessary for business operations:

• Contacts (Read-Only via Single-Contact Picker): Used exclusively when you choose to import an existing customer or supplier phone number into your Khata. We do not bulk-read, sync, or upload your address book.
• Camera: Used exclusively for real-time barcode and QR code scanning at the POS counter to look up products quickly. Images from the camera are processed in memory and never saved or transmitted.
• Bluetooth / Nearby Devices: Used strictly for communicating with ESC/POS thermal receipt printers for printing bills.
• Storage / Media: Used solely to allow you to export PDF receipts, 1-month WhatsApp statement images, or save local SQLite JSON backup files to your phone's download directory.

4. Advertising & Analytics

For users on the Free Starter tier, DukaanRoznamcha may display non-personalized banner or interstitial advertisements provided by Google AdMob. AdMob may collect pseudonymous device identifiers in accordance with Google's Advertising Privacy Policy. Upgraded users (Standard Ad-Free and Pro) experience an entirely ad-free environment.

5. Data Retention & Deletion Policy

Because all operational shop records reside on your physical phone:

• Local Data Wipe: You can permanently wipe all shop records at any time directly within the application by navigating to Settings → Reset / Wipe Shop Data or by uninstalling the app.
• Google Drive Backup Deletion: You can delete any backup files at any time directly through the app's Backup management screen or by logging into your Google Drive and deleting the DukaanRoznamcha_Backups folder.
• Account Deletion Request: For complete deletion of your registered email, device binding records, or demo inquiries from our Firebase systems, visit our dedicated Data & Account Deletion Page or email us at nexcodea.tech@gmail.com.

6. Security

We employ industry-standard security practices, including cryptographic checksums (SHA-256) on backup exports, TLS 1.3 transport security for all network requests, and OAuth 2.0 with Proof Key for Code Exchange (PKCE) for Google authorization tokens.

7. Contact & Developer Information