Privacy Policy

Effective October 15, 2026 · Xerci — Expense Tracker

Rzwan Ramazan develops Xerci. This policy explains the current guest and optional cloud-account behavior. Contact: rzwanramazan@gmail.com.

Guest mode: on-device records

In guest mode, expenses, debts, installments and settings are stored on your device. These include entered amounts, notes, person names and your manual USD/IQD exchange-rate setting. Guest records are not synced to Firestore unless you choose the optional account/cloud-sync functionality. Device or operating-system backups may retain local app data according to their settings and policies.

Optional account and cloud sync

Sign-in choices depend on the installed version. The current email-only iOS build supports optional email/password accounts and guest mode. The corrected iOS build adds optional native Google Sign-In and Sign in with Apple alongside email/password and guest mode; this does not announce its public release. These sign-in methods authenticate optional cloud accounts through Firebase Authentication. Records remain private: guest records stay on your device, while optional signed-in records sync to Firestore. Account processing includes identifiers and email, and name/avatar where provided. Password credentials are handled through Firebase Authentication, not described here as financial-record fields.

Firestore, also provided by Google Firebase, stores synced profile identifiers, email, name/avatar and user expenses, debts, installments, notes and settings, including amounts and person names. Information you enter about another person may therefore be included in cloud records. Avoid unnecessary sensitive information; enter other people's information only where you are entitled to do so.

Why information is processed

Information is used to authenticate your optional account, associate records with you, synchronize records, and provide expense/debt/installment tracking, charts and reports. Manual exchange rates are user-provided settings. Support email messages are used to respond to your requests and may include your address and any information you send.

Providers and disclosure

Google Firebase is the authentication and cloud-storage provider. Optional Google and Apple sign-in also involve their respective account services, depending on the installed version. The iOS fallback avatar is a bundled local logo; no external avatar service is used for that fallback. Provider infrastructure may process information outside your country under applicable provider policies. Information may also be disclosed when legally required or necessary to address security or protect rights. Xerci is free and uses no ads or analytics. Firebase still processes operational and security information as described below.

Authentication IP and security logging

Firebase Authentication processes account identifiers and email and logs IP addresses for authentication, security and abuse prevention. Firebase states that Authentication keeps logged IP addresses for a few weeks. Backup and other retention are governed by provider policies; account deletion does not promise immediate erasure of provider logs or backups. See Firebase privacy and security documentation.

Retention and deletion

Account deletion is available in Settings and requires password reauthentication for email/password accounts or provider reauthentication for Google/Apple accounts, depending on the installed version and sign-in method. It removes the Firestore user document containing expenses, debts, installments, notes and settings, then deletes the Firebase Authentication account. In the corrected iOS build, Apple token revocation is also part of the deletion flow for Sign in with Apple accounts. Removing the app alone does not delete cloud data. Provider backups, security logs and other retention remain governed by applicable provider policies and legal requirements.

Local guest information remains on your device until you delete the data or remove the app, subject to device backups. Cloud account information and synced records are retained until account/data deletion. Provider backups and security-related retention may continue subject to applicable Firebase/Google policies and legal requirements. Deleting the app alone does not delete a cloud account or cloud records.

To request account and associated cloud-data deletion, email rzwanramazan@gmail.com from your account email, with the subject “Xerci account and data deletion”. Specify whether you request account deletion, record deletion, or both. Identity verification may be needed. Do not send your password. This support route is also available if you need help with the iOS in-app deletion flow.

Your choices and security

You can use guest mode instead of optional cloud sign-in. Contact support to request access, correction or deletion of cloud information and exercise rights available under applicable law. Protect your device and sign-in credentials. No system is perfectly secure; this policy does not guarantee encryption or uninterrupted protection.

Children and policy updates

Xerci is not designed to solicit children's personal information. A parent or guardian concerned about information entered by a child should contact support. Material changes to this behavior will be reflected in an updated policy and effective date.

Provider policies

Firebase privacy and security information · Google Privacy Policy

Optional sign-in provider information

When you choose Google or Apple sign-in in a supported build, the provider may supply an account identifier, name, email address (including Apple's private relay email if you choose Hide My Email), and profile image, where available. Firebase uses this information to authenticate your optional cloud account; profile information may be stored with that account. Not every provider supplies every field.