Privacy Policy
Privacy Policy
App: ResitMudah
Last Updated: 10 October 2026
ResitMudah ("we," "our," or "us") respect your privacy and are committed to protecting your personal and financial information. This Privacy Policy details how we collect, store, sync, and process your data when you use the ResitMudah mobile application, in strict compliance with the Personal Data Protection Act 2010 (PDPA Malaysia) and applicable global privacy standards.
1. INFORMATION WE COLLECT
We collect information necessary to scan, digitize, categorize, and preserve your receipts:
a) Information You Provide to Us
- Receipt Images & Scans: Images of receipts captured via your camera or imported from your device gallery.
- Extracted Receipt Data: Merchant/company names, transaction dates, itemized products/services, payment methods, and total amounts parsed from your receipts.
- User Profile Data: If you sign in via Google, we collect your display name, email address, and profile photo provided by Google Identity Services. If you sign in as an Anonymous Guest, a unique pseudo-anonymous Firebase User ID is assigned to your device.
b) Information Collected Automatically
- Device Information: Device model, Android OS version, screen resolution, and language settings.
- App Analytics & Crash Reports: Anonymous diagnostic logs and error traces collected via Firebase Crashlytics to identify bugs and maintain stability.
- Advertising Identifiers (Free Tier): For users on the free ad-supported plan, Google AdMob may collect the Google Advertising ID (GAID), IP address, and interaction data to serve ads.
c) Device Permissions Required
| Permission | Purpose |
|---|---|
| Camera | To capture clear photos of physical receipts for scanning. Images are only captured when triggered directly by you. |
| Storage / Photos | To allow you to pick receipts from your photo gallery and temporarily save generated Excel reports to your device. |
| Internet | To securely sync your receipts to Firebase cloud storage, process AI categorizations, and verify Google Play subscriptions. |
| Notifications | To send optional expense reminder summaries (daily/weekly) and report generation completion notices. |
2. HOW WE USE YOUR INFORMATION
Your information is used strictly for the following purposes:
- Core Expense Organization: To store, sort, calculate, and display your expense history and tax relief categories.
- AI & Text Extraction: To automatically detect text, numbers, dates, and categories using Google ML Kit and Google Firebase AI Logic (Gemini).
- Cloud Synchronization: To back up and sync your receipts across app sessions using Google Firebase Realtime Database & Storage.
- Report Generation: To generate downloadable Excel (.xlsx) expense reports requested by you.
- Subscription Management: To verify subscription tiers and grant feature entitlements via Google Play Billing.
3. DATA STORAGE, CLOUD SYNC & SECURITY
3.1 Cloud Synchronization with Google Firebase
When you sign in to ResitMudah (either via Google Sign-In or Anonymous Guest Sign-In), your receipts, extracted metadata, and custom settings are synced to secure cloud servers hosted on Google Firebase (Firebase Realtime Database and Firebase Cloud Storage).
3.2 Security Measures & User Isolation
- Server-Side Access Rules: Your cloud database nodes are strictly restricted by server-level Firebase Security Rules to your authenticated User ID (
auth.uid == $uid). No other user can access, query, or view your receipts. - Encryption in Transit: All communication between your device and Firebase or AI endpoints is encrypted using industry-standard Transport Layer Security (TLS 1.2+ / HTTPS).
- Payment Data Protection: We never handle, receive, or store your credit or debit card numbers. All billing is processed securely by Google Play.
3.3 Cross-Border Data Transfer (PDPA Disclosure)
In accordance with Section 129 of Malaysia's Personal Data Protection Act 2010 (PDPA), you acknowledge that your cloud data may be transmitted to and stored on secure Google Cloud servers located regionally (such as Singapore) or internationally. Google operates under rigorous international security certifications (ISO 27001, SOC 2, and SOC 3).
4. THIRD-PARTY SERVICE PROVIDERS
We do NOT sell, rent, or trade your personal data. We engage verified industry-standard third-party sub-processors solely to power the App's functionalities:
| Service Provider | Purpose | Data Processed | Privacy Policy |
|---|---|---|---|
| Google Firebase (Google LLC) |
Authentication, Realtime Database, Cloud File Storage, Crashlytics | User ID, email, receipt images, expense records, crash telemetry | Google Privacy |
| Google Firebase AI (Gemini) (Google LLC) |
Automated receipt categorization and text structuring | Extracted raw receipt text (store names, amounts, line items) | Google Privacy |
| Google Play In-App Billing | Subscription processing and entitlement verification | Purchase tokens, order IDs (no payment card numbers) | Google Payments |
| Google AdMob (Free Tier only) |
In-app banner and rewarded advertisements | Advertising ID (GAID), IP address, app interaction data | Google Ads |
5. YOUR DATA RIGHTS & HOW TO DELETE YOUR DATA
Under the Malaysian PDPA, GDPR, and CCPA, you hold full authority over your personal information:
5.1 Right to Delete (Complete Erasure)
- In-App Deletion: You can delete your entire account and all stored receipt images, records, and settings permanently at any time by navigating to:
Profile > Delete Account
This action executes an immediate and irreversible deletion of all your database records and image files from Google Firebase. - Single Receipt Deletion: You can delete individual receipts at any time by opening the receipt detail and tapping Delete.
- Email Request: You may also email ticherhaz@gmail.com to request account erasure, which will be processed within 7 business days.
5.2 Right of Access & Portability
You can view and export all your recorded receipts at any time via the Excel Export feature within the App.
6. DATA RETENTION POLICY
- Active Accounts: Your receipt data remains stored in your Firebase cloud space as long as your account remains active.
- Deleted Accounts: When you delete your account, your data is wiped permanently from active database nodes.
- Anonymous Accounts: Because anonymous accounts are stored locally on your device instance, clearing your app cache or uninstalling the app may result in permanent forfeiture of your anonymous account keys.
7. DATA BREACH NOTIFICATION
In the unlikely event of a security breach affecting your personal information, we will notify affected users within 72 hours of discovery via in-app alert and/or email, outlining the nature of the breach, affected data categories, and recommended mitigation actions.
8. CHILDREN'S PRIVACY
Our App is not intended for individuals under the age of 13. We do not knowingly collect personal identifiable information from children under 13. If you believe a child has provided us with personal information, please contact us immediately, and we will delete the data promptly.
9. CHANGES TO THIS PRIVACY POLICY
We may periodically update this Privacy Policy to reflect app enhancements or legal requirements. Material updates will be highlighted with a revised "Last Updated" date and announced via in-app notices where appropriate. Continued use of the App following changes constitutes acceptance of the updated policy.
10. CONTACT US
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer / Developer at:
App: ResitMudah
Email: ticherhaz@gmail.com
Location: Selangor, Malaysia
© 2026 ResitMudah. All rights reserved.