Privacy Policy

1 Who We Are

zerolate is a financial management application that helps users track credit cards, statements, payments, and reminders. zerolate includes features such as:

• Account creation and login
• Local device storage
• Cloud sync
• Payment reminders
• AI-assisted credit card statement extraction

If you have any questions about this Privacy Policy or your data, you can contact us at hello@zerolate.app.

2 Information We Collect

2.1 Account and profile information

When you create and use a zerolate account, we may collect: name, email address, monthly income, and avatar or profile image.

2.2 Financial information

To provide zerolate's core features, we may collect and store:

• Credit card name or nickname
• Last 4 digits of your card
• Card type
• Billing and due dates
• Statement details
• Total outstanding amount, minimum payment, credit limit, available credit
• Transaction descriptions and amounts
• Payment records

2.3 Uploaded statement data

If you use statement scanning or extraction features, we may process credit card statement images, OCR-extracted text, and structured data extracted from statement content.

2.4 Notification and device-related information

If you enable reminders or notifications, we may collect FCM token, device platform information (iOS/Android), notification preferences, and reminder preferences.

2.5 Security-related information stored on device

To support app security features, zerolate may store locally on your device: PIN hash, biometric preference settings, app lock settings, and local security event logs.

3 How We Collect Information

We collect information in the following ways:

• Directly from you when you sign up, edit your profile, add card details, record payments, or upload statements
• Automatically through app functionality when the app syncs data, stores preferences, or registers for notifications
• Through third-party processors when you use features powered by services such as cloud sync, push notifications, email reminders, or AI extraction

4 How We Use Your Information

We use your information only to provide and improve zerolate's services:

• Creating and managing your account
• Authenticating your login
• Storing and syncing your financial data across your devices
• Displaying your cards, statements, payments, and reminders
• Sending payment reminder emails and push notifications
• Processing uploaded statement images for AI-assisted extraction
• Supporting local security features such as PIN, biometrics, and app lock
• Maintaining service reliability and preventing misuse

5 AI Processing

zerolate offers AI-assisted statement extraction. When you use this feature, statement images or extracted statement content may be processed by our AI service providers.

AI Providers used in production:

• Google Gemini
• Mistral

We use these providers only to support the statement extraction functionality you choose to use.

6 Third-Party Service Providers

We use trusted third-party service providers to operate zerolate. These providers process data only as needed to deliver their services.

6.1 Supabase — Authentication, secure cloud data storage, database operations, sync functionality, and backend functions.

6.2 Firebase Cloud Messaging — Push notifications and payment reminders.

6.3 Resend — Payment reminder emails.

6.4 AI Providers — Gemini and Mistral for statement extraction features.

7 Data Sharing

We only share data with third-party processors when necessary to provide zerolate features such as cloud sync, login/authentication, push notifications, reminder emails, and AI-assisted statement extraction.

8 Human Access to User Data

zerolate is designed so that no human reviews or accesses your financial data as part of normal service operations. We do not provide manual support access to view user financial records.

9 Data Retention

• Synced financial records: until account deletion
• Reminder logs: until account deletion
• FCM tokens: until account deletion
• Locally stored data on device: until logout or uninstall

If you log out, locally stored app data is cleared. If you uninstall the app, local app data is also removed according to your device platform behavior.

10 Account Deletion

You can request and perform account deletion in-app. When your account is deleted, zerolate will delete your account data in accordance with our retention rules, subject to any limited technical delay required to complete deletion.

11 Data Security

We take reasonable technical measures to protect your information:

• Secure authentication
• Row-level access controls in the backend
• Local secure storage for sensitive app security settings
• Hashed PIN storage
• Biometric and app-lock protections on supported devices

However, no system can guarantee absolute security, and you use zerolate at your own risk.

12 Children's Privacy

zerolate is not intended for children. We do not knowingly collect personal information from children.

13 International Processing

zerolate is intended for users in Sri Lanka, but some of our service providers may process data on infrastructure located outside Sri Lanka. By using zerolate, you understand that your information may be processed by these providers as necessary to deliver the service.

14 Analytics and Crash Reporting

zerolate does not use analytics or crash reporting tools to track user behavior.

15 Your Rights and Choices

Depending on how you use zerolate, you may have the ability to:

• Access and update your profile information in-app
• Enable or disable reminders and notifications
• Delete your account in-app
• Contact us regarding privacy concerns

16 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page.