Cashora Privacy Policy

Application: Cashora: Travel & Expense  |  Last Updated: October 21, 2026

Thank you for using Cashora: Travel & Expense ("the App", "we", "us", or "our"), operated by AYYAN NOORY LLC. On your phone the App is called Cashora. It helps you keep track of your own money: your accounts, income, expenses and transfers. We respect your privacy and believe you should have complete control over your personal data. This Privacy Policy explains what information the App uses, why, who processes it, and how you can delete it.

1. What Is Saved on Your Phone

Everything you add to the App is saved on your phone first, so it also works without internet:

• Your accounts: name, type (for example cash, bank or credit card), currency, opening balance, icon, and the optional bank or provider name and notes you type.
• Your transactions: income, expenses and transfers, with their amounts, accounts, category, date and time, and any notes, reference, fee or amount received that you enter.
• Your categories, including the ones you create.
• Your settings: the name you choose to show in the App, currency and number format, light or dark theme, App Lock and your daily reminder time.
• Recycle bin: a transaction you delete stays in the recycle bin for 30 days by default, so you can restore it. After that it is permanently deleted.

2. Using the App Without an Account

Signing in is optional. If you use the App without signing in, your accounts and transactions stay only on your phone and are never sent to us. Only the crash reports and genuine-app checks described in section 5 are sent.

3. Signing In with Google or Apple (Optional)

If you tap "Continue with Google" or "Continue with Apple", sign-in is handled by Google or Apple through Firebase Authentication (from Google). We receive:

• your email address (with Apple, this can be a private relay address if you choose "Hide My Email");
• your name and, with Google, a link to your profile photo, if your account has them;
• a sign-in identifier and which provider you used (Google or Apple).

We use them only to create and secure your account, keep your data in sync and help you if you contact support.

4. Backup and Sync

When you are signed in, a copy of your accounts, categories and transactions (everything listed in section 1 except your settings) is kept on our own server. That way your data is backed up, and you get it back on a new phone or after reinstalling the App. Your settings stay on your phone.

• Also sent with your data: a random ID created when you install the App (so your devices sync correctly), your platform (Android or iPhone), the App version, and when each record was created, changed or deleted. Our server also notes when your account was created and when it was last used.
• Kept safe on the way: your data is encrypted while it travels between your phone and our server (HTTPS).
• Only you: our server accepts requests only from your own signed-in account in the genuine App, and it never gives one user's data to another.
• Our team: authorized members of our team can view account details and synced records in our admin system, only to provide support and run the service.

5. Crash Reports and Genuine-App Checks

If the App crashes, it sends a crash report (Firebase Crashlytics, from Google) so we can find and fix the problem. A crash report contains technical details about the error, the state of the App when it happened, your type of phone and system version, the App version, and a random number used to count how many people a crash affects. Crash reports never include your accounts, transactions, amounts, notes, name or email.

To protect our server from misuse, the App uses Firebase App Check (from Google) with Google Play Integrity on Android or Apple App Attest on iPhone. These confirm that a request comes from the genuine App on a real device. They do not include your financial data.

The App has no usage statistics or analytics, does not read your phone's advertising ID, and never shows ads.

6. Exports, Backup Files and Sharing

• Your files: CSV exports, backup files and PDF statements and reports are created on your phone. They leave your phone only when you choose where to share or save them, for example in an email or a messaging app.
• Restoring a backup: the App reads only the backup file you pick.
• Keep them private: these files contain your financial records, so keep them somewhere safe.

7. Permissions and Device Features

• Notifications and alarms: if you turn on the daily reminder, the App asks for permission to show notifications and schedules the reminder on your phone, including again after your phone restarts. Nothing is sent anywhere for it, and the App does not use push notifications.
• Face ID, Touch ID and fingerprint: the optional App Lock is handled by your phone. The App never receives your biometric data.
• Internet and network status: used for sign-in, sync and crash reports, and to wait for a connection before syncing.
• Google Play: on Android, Google Play may show in-app updates and the in-app review prompt. These are handled by Google Play.

8. What We Never Collect

• No bank logins, card numbers or payment details. The App does not connect to your bank.
• No location.
• No contacts, photos, camera or microphone.
• No advertising ID, no ads and no advertising profiles about you.

We never sell, rent or share your financial data or personal information with advertisers, marketers or anyone who buys data.

9. Who Processes Your Data

We use these service providers to run the App:

• Google Firebase (Authentication, Crashlytics and App Check) and Google Sign-In. See the Google Privacy Policy.
• Sign in with Apple, if you choose it. See Apple's Privacy Policy.
• Hostinger, which hosts our own server, where your synced data and account details are stored.
• Google Play (Android), for in-app updates, in-app reviews and Play Integrity checks.

These providers process data on our behalf, under their own privacy and security terms. Your data may be stored on servers outside your country.

10. How Long We Keep Your Data

• Your synced data: kept for as long as your account exists, until you delete it.
• Deleted transactions: kept in the recycle bin for 30 days by default, then permanently deleted. When a transaction is permanently deleted, its notes and reference are erased. A small deletion record stays so your other devices know to delete it too. It no longer counts anywhere, and it is removed when you delete your account.
• When you delete your account: your data on our server and your sign-in account are deleted straight away. Copies in our server's automatic backups are deleted when those backups expire, within 60 days.
• Crash reports: kept for 90 days, then deleted automatically.

11. How to Delete Your Account and Data

You can delete your account and all of your data at any time:

1. In the App (fastest): open Cashora, go to Settings, tap your name at the top, then tap "Delete account". The App shows what will be deleted and lets you save a backup file first. Type DELETE, confirm, and sign in again when asked. Your accounts, categories and transactions are deleted from our server and from your phone straight away, and your sign-in account is closed. This cannot be undone.
2. Without the App: send an email to support@mobikhata.com from the email address of your account and ask us to delete your Cashora account. We will delete your account and all of its data within 30 days.

Delete some of your data and keep your account: open a transaction and tap "Delete" to move it to the recycle bin. From Settings › Recycle bin you can restore it, or empty the bin to delete it permanently. Accounts and categories that have no transactions can be deleted; ones with history can be archived to hide them.

Signing out: signing out does not delete anything. Your data stays in your account, and the App returns to its device-only mode.

Crash reports: these are not linked to your account, your name or your email, so we cannot find or delete them for one person. They are deleted automatically after 90 days.

12. Data Security

Your data is encrypted in transit between the App and our server, and our server accepts requests only from your signed-in account in the genuine App. On your phone, you can lock the App with Face ID, Touch ID or your fingerprint. No system is perfectly secure, but we work hard to protect your data.

13. Children

The App is not made for children under 13, and we do not knowingly collect personal information from them. If you think a child has signed in without a parent's permission, contact us and we will delete that account and its data.

14. Changes to This Policy

If we change this policy, we will update it on this page and change the "Last Updated" date at the top.

15. Contact Us

If you have any questions or privacy requests about Cashora: Travel & Expense, please contact us:

AYYAN NOORY LLC
Support Email: support@mobikhata.com
Developer Contact: fatih.noory@gmail.com
Website: https://mobikhata.com/