RizqGuard Privacy Policy

1. Introduction

RizqGuard ("we", "our", "the App") is an Islamic personal finance, investment tracking, and Zakat management platform designed from the ground up to protect your privacy. We believe that your personal wealth and financial records are sacred trusts.

Unlike traditional finance apps that aggregate, analyze, or monetize your spending data, RizqGuard is built around Zero-Knowledge End-to-End Encryption (E2EE). We have zero visibility into your transactions, balances, or holdings.

2. Data We Collect & How It Is Handled

A. Account Information (Authentication)

• Google Sign-In Identity: Your display name, email address, and profile photo URL are retrieved solely to authenticate you via Google OAuth 2.0. We never receive or store your Google account password.
• Autonomous Authentication: In the Free tier, authentication operates autonomously on-device without contacting remote Firebase authentication servers.

B. Financial Records (Client-Side Encrypted)

You may enter financial data into RizqGuard, including:

• Wallet accounts, multi-currency ledger balances, and expense/income logs.
• Gold and silver holdings, purchase dates, karat purities, and valuations.
• Halal investments (capital deployed, profit yields, tenure, and Shariah compliance notes).
• Islamic loans (Qard Hasan given or taken, partial repayments, settlement dates).
• Zakat calculations, custom local Nisab thresholds, and Hawl tracking parameters.

3. Zero-Knowledge Client-Side Encryption

RizqGuard uses military-grade AES-256-CBC encryption coupled with client-side key derivation via PBKDF2-HMAC-SHA256 (310,000 computational iterations).

• Encryption and decryption occurs exclusively in your device's memory.
• Ciphertext envelopes sent to remote storage contain only randomized data (__enc), initialization vector (__iv), and schema version (__v: 1).
• Raw plaintext data and private encryption keys never touch our servers or cloud logs.

4. Data Storage and Third-Party Processors

RizqGuard integrates with a minimal set of secure, industry-leading infrastructure providers:

• Firebase Cloud Firestore (Google LLC): Used exclusively to store encrypted ciphertext envelopes for multi-device sync subscribers. Google Cloud cannot inspect the contents of your records.
• Google Play Billing (Google LLC): Securely processes premium subscription transactions and receipt validations without exposing credit card details to RizqGuard.
• Frankfurter API: Provides public foreign exchange rates for multi-currency conversion. No personal or device identifiers are sent in these requests.

5. Data Retention & Irreversible Deletion

You hold sovereign control over your data. If you decide to stop using RizqGuard, you can delete everything immediately:

• Navigate to Settings > Delete Account inside the app.
• This action instantly purges all local SQLite databases and sends deletion requests that permanently scrub all remote encrypted backups from Firestore.
• Alternatively, you can submit a web-based deletion request at our Account & Data Deletion Page or by emailing nadimnesar.cse@gmail.com.

6. Advertising & Analytics Policy

RizqGuard contains zero third-party advertising SDKs, zero user tracking trackers, and zero behavioral analytics. We will never sell, rent, or trade your personal or financial information to third parties or brokers.