Privacy Policy — Cassander

Effective date: 5 November 2026.

1. Controller and scope

The controller is SPINELLI MARCO, Marco Spinelli’s Italian sole proprietorship, Via Gabriele D’Annunzio 18, 84091 Battipaglia (SA), Italy; VAT 06221310656, Salerno Business Register, REA SA-506457. Roviqa Studio is a trading brand, not a separate company. Website: https://roviqastudio.com. The sole public support and privacy contact is support@roviqastudio.com.

This notice covers Cassander, the website and support. The app is intended for adults and is not designed or promoted specifically for children; this does not itself impose an automatic access restriction on minors. The version and effective date are stated at the beginning of this page.

2. Local financial records

Accounts, transactions, categories, budgets, goals, notes, recurring entries, local profile and preferences are stored on the device. There is no Cassander account for synchronising these records and no bank synchronisation. The app does not execute bank payments. It does not automatically send transaction details to Roviqa Studio, RevenueCat or AdMob. The controller has no synchronised copy from which to recover your records. Information you voluntarily send to support is processed as part of that request.

3. Security, PIN and biometrics

Records use AsyncStorage: Cassander does not encrypt the entire financial database. Android protections and app isolation are distinct from application-level encryption. The PIN controls access; its configuration is protected through SecureStore and Android Keystore, without thereby encrypting all records. The operating system handles biometrics: the app receives the result and does not store fingerprints or biometric templates. Protect your device and external copies; no measure guarantees absolute security.

4. Backups and exports

Password-protected backups use AES-256-GCM, with PBKDF2-HMAC-SHA-256 key derivation. The correct file and password are needed; the controller cannot recover the password. This protection covers the backup, not the whole database. CSV, PDF and older unencrypted JSON files do not receive this encryption. Exported files, attachments, clipboard contents and cloud copies also depend on device settings and recipients you select. They remain separate from the financial reset, as do operating-system backups.

5. Google Play and RevenueCat

Google Play handles payments, renewals and store accounts; Cassander does not collect full payment-card details. RevenueCat verifies purchases and Premium entitlement and supports compatible purchase restoration. It may process pseudonymous SDK identifiers, technical device data and information about orders, products and subscriptions. These identifiers are not necessarily anonymous. Local financial transaction details are not needed for these checks. Deleting financial records does not automatically delete store or RevenueCat records.

RevenueCat also processes purchase information for service functionality and subscription-service analytics. This does not mean receiving or analysing income, expenses or balances recorded in your local financial records.

6. Advertising and UMP

AdMob is intended only for Free, with no banners for Premium; the app suspends requests while Premium status remains undetermined. Advertising services may process IP addresses, advertising or technical identifiers, device characteristics, interactions and diagnostics. These differ from local financial records.

UMP manages applicable privacy forms and choices. Personalised advertising is permitted only where the law and your choices allow it. Otherwise non-personalised or limited ads may be requested where permitted; no ads are requested when requests are not permitted. Refusal does not activate Premium or guarantee the absence of all technical data. Privacy options are available in Profile when UMP requires them. Rules and availability may vary by territory.

7. ECB, notifications and website

For exchange rates, the app contacts public ECB endpoints over HTTPS and keeps a local cache. Connections disclose technical data such as IP addresses, but the examined requests do not include balances or transactions. Notifications are scheduled locally according to settings and Android permissions: amounts, if enabled, may appear on the lock screen. Website infrastructure processes connection and security data; these are not described as nonexistent or necessarily anonymous.

Native notification dependencies include Google/Firebase Cloud Messaging and Installations components, which may handle installation identifiers and technical data when activated. The examined application flows do not request push-token registration with a Roviqa server. The presence of these components does not demonstrate use of Firebase Analytics or Crashlytics. Local notifications and any external technical services are distinct processing activities.

8. Support and email providers

We process your email address, messages and attachments voluntarily submitted. The draft opened by the app may include app version, platform and operating system without automatically attaching financial records, PINs or passwords. Do not send secrets or unnecessary financial information. support@roviqastudio.com uses ImprovMX to forward messages to a Gmail mailbox managed by the controller: both services participate in technical email processing. The Gmail address is not an additional public support channel.

9. Purposes, legal bases and recipients

Requested services, Premium verification and support rely on performance of a contract or relevant pre-contractual steps; statutory compliance relies on legal obligations. Where required, advertising and tracking technologies need consent that can be withdrawn. Security, abuse prevention and protection of rights may rely on assessed legitimate interests, without replacing mandatory consent. Local analyses are not used to make credit decisions or comparable automated decisions producing legal effects.

Recipients include Google for Play, AdMob/UMP and Gmail; RevenueCat; ImprovMX; website infrastructure; the ECB for connections; and recipients selected by you. Roles and responsibilities depend on applicable services and agreements: a provider’s notice does not replace the controller’s obligations.

10. Retention

Local data remain until deleted through the app or operating system. Reset covers operational records and recognised technical copies, but preserves preferences and PIN configuration and does not erase external files, purchase data or provider records. The ordinary support-email retention policy provides for 90 days after the request is closed, through a process that is currently manual; exceptions require a documented necessity or applicable obligation. Privacy requests, complaints and administrative documents are assessed separately: the 90-day support-email policy does not replace statutory retention duties. Website logs follow necessity criteria for operation and security; providers also apply their own terms.

11. International transfers

Providers may process data outside the EEA. Where the GDPR applies, a valid Chapter V basis is required, such as an applicable adequacy decision or appropriate safeguards, including standard contractual clauses where relevant. A provider’s compliance statement alone does not establish a safeguard. Contact us for information on recipients and safeguards. Additional applicable territorial requirements remain relevant.

12. Rights and updates

Within applicable limits you may request access, rectification, erasure, restriction, portability and objection, and withdraw consent without affecting prior lawful processing. Under the GDPR, responses are normally provided within one month, subject to permitted, explained extensions; you may complain to the Italian Garante or the competent authority. Additional local rights, including advertising and sale/sharing opt-outs where applicable, remain unaffected. Only proportionate verification information is requested, without penalising the exercise of rights.

The controller cannot remotely recover or delete records held only on your device. See Data deletion and Terms. Material changes will be communicated as legally required. Provider references: Google, RevenueCat, ImprovMX, ECB.

13. Additional information for the United States

Where the relevant state law applies, you may exercise rights to know and access data, obtain a copy, correct or delete it, opt out of targeted advertising and sale/sharing, and limit sensitive-data use where provided. You will not suffer prohibited discrimination for exercising these rights. The conditions for each law to apply differ.

We do not offer your local financial records for sale. Advertising disclosures of identifiers and interactions may fall within state definitions of “sale” or “sharing”, even without payment: non-personalised advertising is not a promise that all processing stops.

For advertising choices, use Profile privacy options where available through UMP. For controller-held data or assistance with choices, email support@roviqastudio.com. An email does not automatically change SDK settings. You may use an authorised agent where permitted; verification is proportionate. Where a law provides an appeal against refusal, reply to the decision with “Privacy appeal”; competent authorities and legal remedies remain available. Applicable statutory deadlines and extensions govern.

14. Age, other territorial safeguards and complaints

Cassander does not independently collect identity documents or dates of birth to verify age. Google Play may perform its own checks and require parental approvals. Download or purchase approval does not replace advertising-data consent where required. If you report processing involving a child, the controller checks applicable duties before continuing it.

Local safeguards also apply outside the EEA: you may seek information, access, correction or deletion and contact the competent authority, including the UK ICO, Canadian federal/provincial privacy authorities, Swiss FDPIC, Australian OAIC and New Zealand Privacy Commissioner. The controller remains reachable at support@roviqastudio.com. No local representative is identified unless actually appointed.

15. Technical data and contractual requests: clarifications

The IP address processed by the advertising service may allow an approximate location to be inferred; this is not access to precise GPS location. The verified commercial Android package includes Firebase Cloud Messaging and Installations components; Messaging auto-initialisation and Analytics collection are disabled in the configuration. Firebase Analytics and Crashlytics SDKs were not found in the package. These findings do not promise that other SDKs make no technical transmissions. A contractual or withdrawal request may involve name, email, contract or order reference, statement, date and time, receipt and delivery status. These are used to receive and handle the request, fulfil legal duties and document the protection of rights. Contractual records are retained as necessary for the relevant purposes and legal duties, assessed separately from routine support-email retention. No PIN, password, full card details or financial archive is needed.

16. Restricted reviewer access and Cloudflare infrastructure

The review service’s technical endpoint is deployed on Cloudflare, and Premium access for authorised reviewers has been operational since 5 November 2026. Operator maintenance remains disabled. Requests to the service may also involve network-data processing by the infrastructure. The following description explains the active service’s processing.

Authorised reviewers can request complimentary Premium with a confidential code, without a Cassander account or Google Play purchase. Submission is optional and sends the code and pseudonymous RevenueCat ID over HTTPS. It does not send transactions, balances, budgets or the local financial archive. The code is a confidential credential: do not include it in privacy requests. Each installation receives Premium for up to 30 days from its first activation; re-entering the same code does not renew or extend that period.

D1 stores the code digest, pseudonymous ID, grant association and status, with any validity limits. Security counters include IP hashes and global or per-code buckets. The clear code is processed in transit and memory, not saved in application tables. Hashing does not guarantee anonymity; the backend does not use the IP for geolocation. The coordinator keeps an operation journal containing a token, type, time, phase and, where relevant, an ID hash to prevent duplicate operations or inconsistent revocations.

The server consults the RevenueCat profile, which may include existing purchases, to check promotions. It neither retains the full profile in D1 nor returns it to the app. Access depends on the Premium entitlement verified by RevenueCat; it is not a new purchasable subscription. Purposes are restricted-access authorisation, grant management and revocation, security and abuse prevention. The basis is the controller’s legitimate interest in enabling controlled reviews and preventing unauthorised use, with data minimisation and a balancing assessment. The controller does not use these backend data for advertising or marketing; the statutory right to object remains available.

For data processed on our behalf, Cloudflare acts as processor, with subprocessors and contractual safeguards for possible transfers outside the EEA. Its DPA and current subprocessor list are available on Cloudflare’s official websites. D1 is in the EU jurisdiction and the coordinator is configured for the EU jurisdiction; the Worker entry point nevertheless uses the global network. Processing entirely within Europe is therefore not promised. RevenueCat remains a separate external service. Cloudflare’s own account and network processing is also covered by its privacy notice.

The current configuration does not enable application request logging; logging codes, request bodies or keys is not planned. This does not exclude provider infrastructure logs and metadata, governed by the provider’s retention criteria. These are distinct from database abuse-control counters.

The policy retains authorisation records while needed for access and revocation, with a necessity review every 90 days. Revoked records still needed to prevent reuse are not automatically deleted while a code remains valid: the need is justified and reviewed without excluding data-subject rights. After code revocation and grant reconciliation, records no longer needed are deleted within 90 days, except for specific documented legal duties or exceptions. Counters expire logically after 15 minutes and are deleted on the next request; weekly maintenance is planned while inactive. An uncertain-outcome journal remains until reconciliation, with operational follow-up and no automatic reopening of the grant.

These tasks are currently handled manually. In future, automated tools may support or perform them, subject to prior authorisation and verification, without changing purposes, retention periods, safeguards, data-subject rights or the controller’s responsibility. No automation for this maintenance is currently active. Documented technical recovery windows are up to 7 days for D1 Free and 30 days for SQLite Durable Objects; they are not the retention period for all provider logs. Deletion from the current database does not guarantee immediate erasure from every copy. Following a restore, revocations and erasures must be respected again before reopening the service.

Resetting or uninstalling the app does not erase these external data. To exercise rights, contact support@roviqastudio.com with context and, if needed, the support ID. The ID assists lookup but does not alone prove identity or ownership of a purchase. Do not send the confidential code, PIN, password or financial archive. Data erasure, revocation of promotional access and Google Play cancellation are separate operations. The rights, response periods and safeguards described elsewhere remain applicable.