2. WHAT WE COLLECT

• Account information. Your name, email address and profile image, when you create an account. Sign-in is handled by Firebase Authentication.
• Content you enter. Transactions, holdings and goals you record yourself, and messages you send to the in-app AI assistant.
• Wallet credentials. If you connect a centralized exchange account (Coinbase, Binance, Kraken, OKX, KuCoin), you provide a read-only API key and secret. We store these encrypted and use them only to fetch your Bitcoin balance. We enforce read-only scope and reject any key that carries trade or withdrawal permissions — we cannot place orders or move funds. If you add an on-chain wallet, you provide an extended public key (xPub/zPub) only, never a private key or seed phrase.
• Subscription status. Whether you hold an active paid subscription. We never receive or store your payment card details — Apple and Google handle payment.
• App analytics. We use Firebase Analytics to understand how features are used — for example, which screens are visited and session duration. This data is aggregated and used only to improve the app. It is not used for advertising. Firebase Analytics collects: device model, OS version, app version, session duration, screen names, country, and language.
• Crash and stability data. Crash traces, device model, OS version and app version. No user identifiers are attached to crash reports.
• Push notification token. If you enable notifications, a device token is issued so we can deliver them.
• Website data. If you visit the Bitcoin Canvas website, we collect standard access information — IP address, browser type, pages visited and timestamps. See Section 9 for how we use cookies.
• Camera and photo library. If you set or update your profile photo, we request camera and photo library access on your device. This access is used only for that purpose.

What we don't collect

Several of these are unusual for an app in this category:

• No location data. We don't request, collect or infer your location.
• No advertising identifiers. The Android Advertising ID permission is explicitly removed from the build.
• No cross-app or cross-site tracking. We don't track you across other companies' apps or websites, and we don't participate in advertising networks or data brokerages.
• No contacts or microphone access.
• No private keys or seed phrases. We never ask for them, and the app has no facility to accept them.
• No payment card details. Apple and Google handle all billing — we receive subscription status only.

3. HOW WE USE IT

• To create and maintain your account and sign you in
• To display the portfolio, market data and metrics you’ve asked to see
• To operate the AI assistant and editorial features
• To determine which features your subscription unlocks
• To diagnose crashes and improve stability
• To send notifications you’ve enabled
• To respond to support requests
• To detect abuse, prevent fraud and enforce our Terms

We do not sell your personal information. We do not share it for cross-context behavioural advertising, and we do not use it for advertising of any kind.

4. WHO WE SHARE IT WITH

We also work with service providers who help us build, host and maintain the app. Where any such provider has access to production systems, that access is contractually limited to what’s required to deliver the service and is revoked when it’s no longer needed.

We disclose information where required by law, to protect our rights or the safety of others, and in connection with a merger, acquisition or sale of assets — in which case we’ll notify you.

5. AI FEATURES

Bitcoin Canvas includes AI-generated content and an AI assistant.

The assistant. When you send a message to the assistant, we transmit the following to our AI service: your message, persona, preferred currency and exchange, and app preferences. This context is used solely to personalise the assistant's responses.

What is not transmitted: your holdings, portfolio value, transaction history, goal amounts, wallet addresses and exchange API credentials are not included in the assistant payload.

Generated content. Articles and summaries in the news section are produced with AI assistance.

Our AI provider. Messages sent to the assistant are processed by a third-party AI provider identified in Section 4.

AI output can be wrong. It may be inaccurate, outdated or fabricated. Nothing it produces is financial advice.

6. WHERE YOUR DATA IS HELD

Your data is stored on Google Cloud Platform infrastructure in the United States. Access to production data is limited to personnel in the United States.

7. RETENTION AND DELETION

We keep your account data for as long as your account is open. That includes your profile, transactions, holdings, goals and your conversation history with the AI assistant, which is retained so the assistant can refer back to earlier messages. You can clear your assistant conversation history at any time in the app without deleting your account.

Deleting your account. You can delete your account in the app. When you do, we permanently delete your profile, transactions, goals, assistant conversation history and authentication credential.

Crash reports, which carry no user identifiers, are retained on our crash reporting provider’s own schedule. Records we must keep for tax, accounting or legal reasons are retained for the period the law requires.

8. SECURITY

We use encryption in transit and at rest, authentication controls and access restrictions on production systems.

Nothing is completely secure. If a breach affects your personal information, we’ll notify you and any required regulator without undue delay.

9. COOKIES AND WEBSITE TRACKING

The Bitcoin Canvas mobile app does not use cookies or any third-party analytics.

The Bitcoin Canvas website uses cookies and similar technologies to keep you signed in, remember your preferences, and understand how the site is used. You can control or block cookies in your browser settings; blocking essential cookies will prevent sign-in from working.

10. YOUR RIGHTS

You can update your profile in the app, delete your account, disable notifications in your device settings, and manage or cancel your subscription through your Apple or Google account.

California (CCPA/CPRA). You have the right to know what personal information we collect, to delete it, to correct it, and to opt out of sale or sharing. We don’t sell or share personal information as those terms are defined, and we won’t discriminate against you for exercising these rights. You may use an authorized agent.

Other US states. Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Texas, Oregon and Montana — have broadly equivalent rights, honoured on the same basis.

Canada (PIPEDA). You may request access to your personal information and challenge its accuracy, and may complain to the Office of the Privacy Commissioner.

How to make a request. Email help@mangosteen.studio. We’ll respond within 30 days. We may need to verify your identity before acting on a request.

If we deny your request. You may appeal by replying to our decision, or by emailing help@mangosteen.studio with “Appeal” in the subject line. We’ll respond within 45 days with our decision and the reasons for it. If we deny your appeal, you may contact your state attorney general to submit a complaint.

11. CHILDREN

Bitcoin Canvas is for adults. You must be 18 or older. We don’t knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we’ll delete it.

12. CHANGES TO THIS POLICY

We may update this Policy. We’ll post the revised version with a new “Last updated” date, and for material changes give notice in the app or by email at least 14 days before it takes effect. Continued use after that date indicates acceptance.

13. CONTACT

Mangosteen Studio, LLC — help@mangosteen.studio