Information We Collect
a) Account and Identity Information
Collected when you create an account or subscribe. You may register using email/password or via Google or Apple Sign-In (all via Supabase):
- Full name
- Email address
- Authentication credentials (hashed passwords or OAuth tokens — managed securely by Supabase; we never have access to your raw password)
- Method of sign-in (email/password, Google, or Apple)
b) Usage Data
- Currency conversion usage count (to enforce free vs. premium limits)
- Device type and operating system version (for support and diagnostics)
- Timestamps of App usage (for feature tracking and limit enforcement)
c) Camera Data
The App accesses the camera solely for real-time, on-device OCR-based text and price detection. No photos or videos are stored on our servers or transmitted to any third party. All camera processing occurs on-device only and images are immediately discarded after recognition.
d) Location Data
Approximate location (country level only) is used in real time to suggest the local currency. We do not store location history, track your movements, or share location data with third parties for profiling. Location data is discarded immediately after use.
e) Advertising Data (Free-Tier Users — Google AdMob)
The free tier uses Google AdMob to serve advertisements. AdMob operates as an independent data controller and may collect the following data directly from your device:
- Device advertising identifier (IDFA on iOS / Google Advertising ID on Android)
- IP address (used to infer approximate location for ad targeting)
- App usage and interaction data (e.g., ad impressions and clicks)
- Device type, OS version, language, and time zone
For EEA users, this data collection is subject to your explicit consent via our in-app consent prompt. If you decline, only non-personalised contextual ads will be shown. See Section 7 for full details.
For full details on how Google uses this data, see Google's Privacy Policy at policies.google.com/privacy.
Legal Basis for Processing (GDPR Article 6)
We process your personal data only where we have a lawful basis:
| Processing Activity | Data Involved | Legal Basis |
|---|---|---|
| Account creation and authentication | Name, email, credentials, sign-in method | Art. 6(1)(b) — Contract performance |
| Subscription management and billing | Name, email, payment records | Art. 6(1)(b) — Contract performance |
| Enforcing free-tier usage limits | Usage count, timestamps | Art. 6(1)(b) — Contract performance |
| App diagnostics and performance | Device type, OS version, usage data | Art. 6(1)(f) — Legitimate interests |
| Personalised advertising via AdMob | Device advertising ID, IP, usage data | Art. 6(1)(a) — Consent (explicit opt-in required) |
| Non-personalised advertising via AdMob | Contextual data only | Art. 6(1)(f) — Legitimate interests |
| Camera-based currency detection | Camera image (on-device only — not stored) | Art. 6(1)(b) — Contract performance |
| Location-based currency suggestion | Country-level location (real-time, not stored) | Art. 6(1)(b) — Contract performance |
| Responding to support requests | Name, email, query content | Art. 6(1)(f) — Legitimate interests |
| Financial record-keeping | Transaction and payment records | Art. 6(1)(c) — Legal obligation (Bokföringslagen) |
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
How We Use Your Information
- To provide core App features: OCR-based currency detection, text-based conversion, and AR overlays.
- To create and manage your account and verify your email address.
- To manage your subscription and communicate with you about billing.
- To enforce usage limits for free-tier users and unlock features for Pro subscribers.
- To present an in-app consent prompt (EEA users) and serve appropriate advertisements via Google AdMob.
- To improve App performance and diagnose technical issues.
- To respond to your support requests and enquiries.
- To comply with our legal obligations under Swedish and EU law.
Data Retention
We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy:
| Data Type | Retention Period |
|---|---|
| Account data (name, email, sign-in method) | Duration of account + 30 days after deletion |
| Usage logs and conversion counts | 12 months rolling |
| Payment and transaction records | 7 years — mandatory under Swedish Bookkeeping Act (Bokföringslagen) |
| Device and OS analytics data | 12 months rolling |
| Camera data | Not retained — on-device processing only, discarded immediately |
| Location data | Not retained — real-time use only, discarded immediately |
| Support correspondence | 24 months from last contact |
| Consent records (AdMob consent) | Duration of account or until consent withdrawn and app uninstalled |
Even if you request account deletion, we are legally required under the Swedish Bookkeeping Act (Bokföringslagen) to retain payment and transaction records for 7 years. This mandatory legal obligation cannot be overridden by a deletion request. All other personal data will be deleted within 30 days of your verified request.
Data Sharing & Third-Party Processors
We do not sell or rent your personal data. We share data only with the following service providers, and only to the extent necessary to deliver our services:
| Service Provider | Purpose | Role & Data Protection |
|---|---|---|
| Supabase (EU region) | User authentication, account storage, usage data | Data Processor — DPA in place; data stored within EEA |
| Google AdMob | Serving ads to free-tier users | Independent Controller — consent required for personalised ads |
| Apple Inc. | In-app purchases, Apple Sign-In (iOS) | Independent Controller — Apple Developer Agreement |
| Google LLC | In-app purchases, Google Sign-In (Android) | Independent Controller — Google Developer Distribution Agreement |
| Currency API Provider | Live exchange rate data only | Not applicable — no personal data shared |
We may also disclose your personal data where required by applicable law, court order, or instruction from a competent authority.
International Data Transfers
Supabase is configured to store data within the European Economic Area (EEA). No international transfer of your account or usage data occurs via Supabase.
Google AdMob, as an independent data controller, may process advertising-related data outside the EEA, subject to Google's own compliance mechanisms including Standard Contractual Clauses approved by the European Commission. See policies.google.com/privacy.
Apple and Google may process certain authentication and purchase data outside the EEA subject to their own privacy policies and applicable transfer safeguards.
Advertising Consent & Your Choices (EEA Users)
For users in the EEA, we are required by GDPR and Google's EU User Consent Policy to obtain explicit consent before AdMob serves personalised advertisements.
How We Obtain Consent
- When you first launch SnapMyCurrency as a free-tier user, you will see a clearly visible in-app consent prompt.
- The prompt explains what data AdMob collects and how it is used for personalised advertising.
- You may accept personalised ads or decline — declining results in contextual, non-personalised ads only.
- Your consent choice is recorded and stored on your device.
How to Change or Withdraw Consent
- Through your device settings: "Limit Ad Tracking" on iOS or "Opt out of Ads Personalisation" on Android.
- By contacting us at merveintech@gmail.com to reset your consent preference.
- By upgrading to SnapMyCurrency Pro, which removes all advertising.
Withdrawing consent does not reduce the number of ads shown — only their relevance.
Data Security
- Encryption of data in transit using TLS (Transport Layer Security).
- Secure credential storage via Supabase — passwords are hashed and never stored in plain text.
- OAuth tokens for Google and Apple Sign-In are managed by Supabase and never exposed to us directly.
- Rate limiting on authentication endpoints to protect against brute-force attacks.
- Access controls limiting who on our development team can access personal data.
- All API communications (Supabase, currency API) are conducted over HTTPS only — no fallback to unencrypted HTTP.
We will notify you and relevant authorities in the event of a data breach as required by GDPR Articles 33 and 34.
Children's Privacy
SnapMyCurrency is not intended for children under the age of 13 and we do not knowingly collect personal data from such children.
In the European Union, users under 16 years of age may not create an account or provide personal data without verifiable parental or guardian consent, in accordance with GDPR Article 8. At registration, all users must confirm via a checkbox that they meet the applicable age requirement.
If we become aware that we have inadvertently collected personal data from a child under 13 (or under 16 in the EU without parental consent), we will promptly delete that data. Parents or guardians should contact us at merveintech@gmail.com.
Your Rights Under GDPR
As a data subject under GDPR, you have the following rights. Submit requests to merveintech@gmail.com. We will respond within 30 days (extendable by two further months for complex cases, with notice given within the initial 30-day period).
| Your Right | What It Means in Practice |
|---|---|
| Right of Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Right to Rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Right to Erasure (Art. 17) | Request deletion of your data. Note: payment records must be retained 7 years under Bokföringslagen. |
| Right to Restriction (Art. 18) | Request that we limit how we process your data in certain circumstances. |
| Right to Data Portability (Art. 20) | Receive your data in a structured, machine-readable format (e.g., JSON or CSV). |
| Right to Object (Art. 21) | Object to processing based on legitimate interests, including profiling. |
| Right to Withdraw Consent (Art. 7(3)) | Withdraw consent for personalised advertising at any time. |
| Right to Lodge a Complaint | Contact: Integritetsskyddsmyndigheten (IMY) — imy.se — +46 8 657 61 00 |
Third-Party Services
The App integrates with third-party services, each operating under its own privacy policy:
- Supabase: supabase.com/privacy
- Google AdMob / Google LLC: policies.google.com/privacy
- Apple Inc.: apple.com/legal/privacy
- Currency API Provider: see provider website for privacy policy
Changes to This Privacy Policy
- We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.
- When we make material changes, we will update the Last Updated date at the top of this document.
- Where feasible, we will notify you of material changes through the App or via email.
- Your continued use of the App after the updated Privacy Policy takes effect constitutes your acknowledgement of the revised terms.
- The current version is always available at: snapmycurrency.com/privacy-policy.html
Contact & Data Controller Details
For questions about this Privacy Policy, to exercise your rights, or to make a complaint:
Merve Kucukzoroglu — Sweden
Email: merveintech@gmail.com
Website: snapmycurrency.com
Account deletion: snapmycurrency.com/delete-account.html
Response time: within 5 business days (rights requests: within 30 days)
Swedish Data Protection Authority
Integritetsskyddsmyndigheten (IMY)
imy.se | +46 8 657 61 00