Privacy Policy

Effective date: 13 November 2026

This Privacy Policy explains how Spig ("we", "us") handles information in the Fluffballs app (the "App") and on our website (https://fluffballs.pages.dev). It covers both versions of the App: the version distributed through Google Play (the "Play version") and the version downloaded from our website (the "website version"). Where the versions differ, this policy says so.

1. Summary

Your financial records stay on your phone. We do not run an account system and we do not receive your transactions, balances, budgets or notes.
Google Drive backup is optional and goes to your own Google Drive.
Ads are off unless we switch them on. When they are on, they are rewarded ads you choose to watch, shown only after any required consent.
Purchases are handled by Google Play (Play version) or Razorpay (website version). We never see your card or bank details.
Remote support only happens when you start a session and agree to it.

2. Information that stays on your device

The App stores the information you enter (accounts, transactions, categories, budgets, goals, bills, split bills, notes, moods, settings and mascot preferences) in a database on your device. We do not collect it. If you uninstall the App or clear its data, this information is deleted from the device unless you have made a backup.

3. Backups

Google Drive backup (optional). If you turn on Drive backup, you sign in with your Google account and the App asks for the "drive.file" permission, which only lets it see files it created. Your backup file is stored in your Google Drive under your Google account. We do not receive a copy. Google's handling of that data is covered by the Google Privacy Policy (https://policies.google.com/privacy). You can delete the backup from the App or from Google Drive, and you can remove the App's access in your Google account settings.

Manual backup files. You can also export a backup file to a location you choose. That file is under your control.

4. Our server (the "Worker")

The App talks to a small server we operate on Cloudflare Workers for the features below. Like any internet request, these requests reach Cloudflare with your IP address and basic technical details (such as the app version). Cloudflare processes this data as our service provider (https://www.cloudflare.com/privacypolicy/).

Signed configuration and announcements. The App downloads a configuration file signed by us. It tells the App which optional features are on (for example ads, premium items and remote support) and may include announcements we post. The App checks the signature and keeps a copy offline. No personal information is sent to fetch it.

Install ID. The App creates a random install ID on your device. It does not contain your name, email or device identifiers. It is used to link rewards and purchases to your installation.

What the Worker stores.

Rewards from ads: the install ID, the ad network's transaction ID, the reward and the time, so each reward is granted once.
Entitlements: the install ID and the premium status that applies to it (for example premium until a date, or lifetime premium) and where it came from.
Play purchases (Play version): a one-way hash of the Google Play purchase token, the install ID and the time.
Website purchases (website version): the Razorpay order ID and payment ID, the amount and currency, the order status, the licence ID, and a one-way hash of the email address you entered at checkout. We do not store the email address itself.
Remote support: short-lived pairing and session records (see section 7).
Abuse protection: counters keyed by a one-way hash of the IP address, kept only for short time windows.

What the Worker logs. Operational logs record event types, results and short fingerprints of session codes. They do not include your email, install ID, financial data or screen content. Event records used to prevent duplicates are deleted after 30 days.

5. Ads

Ads are switched off by default. We can switch them on remotely through the signed configuration. When they are on, the App offers rewarded ads that you choose to watch in exchange for premium days. The App does not show banner or interstitial ads.

Ad SDKs. When ads are on, the App uses:

Google AdMob (Google Mobile Ads SDK) to request and show ads;
Google User Messaging Platform (UMP) to ask for and record your consent choices where the law requires it (for example in the EEA, the UK and Switzerland, and for US state privacy laws);
Unity Ads, as an ad source through AdMob mediation. Unity is never started directly by the App; it only runs through AdMob after the consent step.

Data these SDKs collect. When ads are on and you allow it, these SDKs may collect the advertising ID, IP address, device and app information, and ad interaction data, to show ads, measure them, prevent fraud and, where you consent, personalise them. See:

When the SDKs run. The Google Mobile Ads SDK includes a small startup component that Android runs when the App opens. We configure it to delay measurement and initialisation, and the App itself does not start the ad SDKs, request or load an ad, or show the consent form while ads are switched off. When ads are on, nothing happens until you choose to watch a rewarded ad: the App then asks for consent where required, and only after that starts the ad SDKs and requests an ad. Unity Ads only runs through AdMob after this point.

Advertising ID. The App declares the Android advertising ID permission (and the related Android Privacy Sandbox permissions added by the Google Mobile Ads SDK) so ads can work. The advertising ID is accessed by the ad SDKs only after the steps above and in line with your consent choices.

Your choices.

You never have to watch an ad.
You can change or withdraw your ad consent at any time from Settings > Premium > Ad privacy choices (shown once ads have been used on your device).
In the US, you can turn on "Don't sell or share my info for ads (US)" on the same screen.
You can delete or reset your advertising ID, or opt out of personalised ads, in your device settings (Settings > Privacy > Ads on most Android devices).

Server-side reward check. When you finish a rewarded ad, Google sends our Worker a signed callback with your install ID and a transaction ID. The Worker checks it and grants the reward.

6. Purchases

Play version: Google Play Billing. Lifetime premium is sold through Google Play. Google processes the payment under its own terms and privacy policy. We receive a purchase token, which the Worker checks with Google and then stores only as a one-way hash.

Website version: Razorpay. Lifetime premium is sold through Razorpay's checkout. Razorpay collects and processes your payment details and contact details under its privacy policy (https://razorpay.com/privacy/). The email you enter is sent to our Worker to prepare the checkout and pre-fill Razorpay's form. We receive the order and payment IDs and the payment status. The Worker stores a one-way hash of your email, not the email itself.

Licence keys and restore (website version). After payment you get a licence key signed by us. You can restore it on a new install by entering the key, or by entering the payment ID together with the email used at checkout. The Worker compares the hash of that email with the stored hash.

7. Remote support

Remote support lets someone you choose help you with the App. It never starts on its own.

Both versions support screen sharing: the helper can see your screen.
The website version can also let the helper tap on your screen and browse files on your device. Each of these needs a separate Android permission that you grant, and you can choose not to allow them.
You start a session and share a short pairing code, which expires after 2 minutes.
Android shows its screen-sharing prompt, and a banner or notification stays visible for the whole session.
Either you or the helper can end the session at any time.
Screen content travels directly between the two devices over an encrypted WebRTC connection. When a direct connection is not possible, it is relayed in encrypted form through Cloudflare's relay service. We do not record or store screen content.
The Worker keeps only the session state needed to connect the two devices, and removes it shortly after the session ends.

Kill switch. We can switch remote support off for all users through the signed configuration. When it is off, the App hides remote support, the Worker refuses new sessions, and any live session ends.

8. Permissions

The App asks for permissions only for the features that need them: internet access, notifications (reminders and session notices), screen capture and a foreground service for screen sharing, the Accessibility service (remote taps) and all-files access (remote file browsing) in the website version, and the advertising ID (used only as described in section 5).

9. Sharing

We do not sell your personal information. We share data only with the service providers named in this policy (Google, Cloudflare, Unity, Razorpay), when the law requires it, or to protect the App and its users against fraud or abuse.

10. Retention

Data on your device stays until you delete it. Worker records about rewards, entitlements and purchases are kept while they are needed to provide what you received and to meet legal, tax and accounting obligations. Duplicate-check events are deleted after 30 days, and remote-support session records shortly after the session ends.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete or object to processing of your personal information, and to complain to a data protection authority. Because we hold very little information and none of it is linked to your name, we may not be able to find records about you. For purchases, include your Google Play order number, or for website purchases your Razorpay payment ID or licence key, when you contact us.

12. Children

The App is not directed at children under 13, and we do not knowingly collect personal information from them. Ads, when switched on, are not configured for child-directed treatment. If you believe a child has given us personal information, contact us and we will delete it.

13. Security

Configuration, entitlements and licence keys are digitally signed, connections use HTTPS, and we store hashes instead of raw purchase tokens and emails. No method of transmission or storage is completely secure.

14. Changes

We may update this policy. We will change the effective date above and, for significant changes, tell you in the App. The current version is always at https://fluffballs.pages.dev/privacy.

15. Contact

Spig
Email: udoanime8@gmail.com