Legal Center

1. What We Store Locally (On Your Device)

The following data is stored exclusively on your device in an encrypted SQLCipher database and is never transmitted to our servers unless you explicitly enable cloud backup:

• Project data: Project names, descriptions, start/end dates, status
• Financial records: Expense entries, income entries, category labels, payment methods, transaction notes
• Reports: Generated PDF/CSV reports, templates
• App settings: Your theme preferences, notification settings, currency format

⚠️ Important: K-First does not access, view, or transmit this data to any server unless you enable cloud backup.

2. Optional Cloud Backup (Pro Feature)

When you explicitly enable cloud backup:

• Your data is encrypted on your device using AES-256 before being uploaded to Firebase Cloud Storage
• The encryption key is derived from your Firebase Authentication credentials and never leaves your device
• K-First servers cannot decrypt your backups (zero-knowledge architecture)
• Backups are stored in Firebase's secure infrastructure (Google Cloud Platform)

✅ What this means: Even if someone gains unauthorized access to Firebase storage, they cannot read your project or financial data without your device and credentials.

3. Account & Authentication Data

If you create an account (required for cloud backup or Pro features), K-First uses Firebase Authentication, which processes:

• Email address: Used for account recovery and communication
• User ID: A unique identifier (Firebase UID) to link your account to encrypted backups
• Authentication tokens: Temporary session tokens to verify your identity (Firebase manages these securely)

We do not collect passwords directly—Firebase Authentication handles credential management. Learn more: Firebase Privacy Policy

4. Advertising Data (Free Tier Only)

If you use the free tier, rewarded ads are provided by Google Mobile Ads SDK. Google may collect:

• Ad-specific identifiers: Advertising ID (Android) or IDFA (iOS)
• Device information: OS version, device model, screen size
• IP address: For approximate location-based ad targeting
• Ad interaction data: Clicks, views, impressions

ℹ️ K-First does not receive, store, or use these identifiers. Google processes ad data per their Privacy Policy.

5. When We Share Data

K-First shares data only in these limited, necessary cases:

Legal disclosures: We may disclose data if required by law (e.g., court order, government request).

6. Your Rights & Data Control

You have the right to request deletion of your K-First account and all associated data:

🚨 Important: K-First does not retain decrypted business data. After deletion, we cannot recover your projects, expenses, or logs.

7. Children's Privacy

K-First is designed for adult professionals (18+). The app is not intended for, and does not knowingly collect data from, children under 13. If you believe a child under 13 has created an account, contact us immediately at firstbridgestudios.app@gmail.com.

8. Data Location & International Transfers

If you enable cloud backup, your data may be processed in Firebase's infrastructure:

• Primary region: asia-south1 (Mumbai, India)
• Backup regions: Firebase may replicate across Google Cloud Platform regions

📍 Kerala users: Your encrypted backups may be stored in Mumbai (asia-south1). Zero-knowledge encryption ensures geographic location doesn't affect confidentiality.

9. App Permissions

K‑First requests only the permissions needed for core features like network access, taking site photos, and optional map usage.

When you add photos to logs or expenses, K‑First uses the system photo picker and only receives the images you explicitly select. The app does not scan your entire gallery or request broad storage permissions.