NoteVault ("the app", "we") helps you identify banknotes from photos. This policy explains what data the app handles, where it goes and why. It applies to the Android and iOS apps.
You can use NoteVault as a guest without providing your name or email. The app uses an anonymous Firebase identifier to apply usage limits, prevent abuse, manage Premium access and recover retried scans. If you choose to sign in with Google or Apple, Firebase Authentication processes the identifier, name and email supplied by that provider. These details are used for authentication, account management and access to your purchases. Your collection remains on your device; signing in does not upload it. Firebase App Check (Google Play Integrity on Android; Apple App Attest or DeviceCheck on iOS) verifies that requests come from the genuine app.
When you tap Identify, the front photo (and back photo, if you add one) is resized and sent over an encrypted connection to our Google Firebase cloud function. The function sends the photos to Google Cloud Vision (text recognition and web matching) and to OpenAI (image analysis), together with your app language. Nothing is sent until you tap Identify.
Banknotes you save — photos, results, serial numbers, favorites — and your five most recent identifications are stored on your device and are not uploaded to our servers. If you use your device's own backup (Google or iCloud), your saved collection may be included in that backup under your account; recent history is excluded. You can delete saved notes in the app; deleting the app removes the data from the device.
A result may show look-alike images found by Google Cloud Vision. When you view them, your device loads those images directly from the third-party websites that host them, which can see your IP address like any web request. Tapping an image opens it in your browser.
The free app shows Google AdMob ads (for example when the app opens). AdMob may process device identifiers, IP-derived approximate location, ad interactions and diagnostics to deliver and measure ads and prevent fraud. We never send your banknote photos, results or collection to AdMob.
Where required (including the EEA, United Kingdom and Switzerland) Google's User Messaging Platform asks for your choices before ads are requested. You can change them later in Settings through the ad privacy choices entry. The iOS app does not request App Tracking Transparency permission and does not track you across other companies' apps.
Google Firebase (authentication, App Check, cloud functions, Firestore), Google Cloud Vision, OpenAI and Google AdMob process data for the functions described above. Google Play handles Android payments. The iOS app also uses RevenueCat to manage App Store subscription access, including your Firebase identifier and subscription status. Providers may process data outside your country under their privacy terms: Firebase, Google Cloud, OpenAI, Google advertising, RevenueCat.
NoteVault offers optional Premium subscriptions. Google Play or the App Store processes payment; we do not receive your card number or banking credentials. Our service verifies purchase or subscription identifiers and stores subscription status, expiry and a hashed purchase binding associated with your Firebase identifier to grant access, restore purchases and prevent misuse.
Identifications, condition grades and values are AI-generated estimates, not certified grades or professional appraisals. See the Terms of Use.
Because your collection stays on your device, you control it directly. In the app, open Profile and choose Delete account to request deletion of your Firebase account and its associated scan, quota and purchase-access records. You can also request deletion without the app through our account and data deletion page. Deleting an account does not cancel an active store subscription; manage or cancel it in Google Play or App Store subscription settings.
Depending on where you live, you may have rights to access or delete data we hold. Contact http.ccare@gmail.com. Global service counters that are not linked to your account and records retained independently by service providers are not removed by the in-app deletion function. Provider retention is governed by their respective policies.
NoteVault is not directed at children under 13 and does not knowingly collect their data.
Updates will be posted at this address with a new date. Contact: http.ccare@gmail.com.