Jabby™This policy explains what personal data the Jabby™ Android application (“Jabby”, “the app”, “we”) collects, why, who it is shared with, and how you can have it deleted. It applies to the prototype app and this website.
1. Data we collect
| Data | When | Why |
|---|---|---|
| Mobile phone number | Registration | Identifies your account and is how other users address transfers to you |
| Full name | Onboarding | Shown to a sender so they can confirm who they are paying |
| Bank name and bank account number | Onboarding | Simulates linking a payment destination. Only a masked form (last 4 digits) is shown in the app |
| Transaction records | Each transfer or request | Amount, both parties’ names, phone numbers, banks, masked account and timestamp, so both sides have a history |
| Push notification token | Sign-in | Delivers notifications when you receive money or a request |
| One-time verification codes | Sign-in | Stored only as a cryptographic hash, deleted once used or after 5 minutes |
Stored only on your device
Your app-lock PIN is never sent to us. It is stored on your phone as a salted PBKDF2 hash inside Android’s hardware-backed encrypted storage. Fingerprint and face data is handled entirely by Android and is never accessible to the app.
What we do not collect
No advertising identifiers, no location data, no contacts from your address book, no analytics or tracking SDKs. Jabby contains no advertising.
2. How the data is used
Solely to operate the prototype: to verify your phone number, to let another user resolve your number to a name and masked account before sending, to record demonstration transfers, and to notify you. Your data is not sold, rented, or used for marketing or profiling.
3. Who processes your data
| Provider | Receives | Purpose |
|---|---|---|
| Google Firebase (Google LLC) | All account, transaction and request data | Authentication, database, backend functions and push notifications |
| Notify.lk | Your phone number and the verification message | Delivering the one-time code by SMS |
4. Where your data is stored
Account and transaction records are held in Google Cloud Firestore in the
asia-south1 region (Mumbai, India). Backend functions run in
us-central1 (United States), so data is processed in the United
States in transit. SMS delivery is handled in Sri Lanka by Notify.lk. By using
the app you consent to this cross-border processing.
5. Security
- All traffic between the app and the backend uses TLS.
- Database rules restrict each record to the users party to it.
- Verification codes are stored hashed, expire after 5 minutes, are single-use, and are rate limited.
- The app-lock PIN is stored hashed in hardware-backed storage on your device only.
6. Retention
Account and transaction data is kept until you ask for deletion. Verification codes are deleted within 5 minutes. Because this is a prototype, all data may be deleted at any time without notice.
7. Your rights
You can request access to the data held about you, correction of anything inaccurate, or complete deletion of your account and its records. See Delete Account, or email a.farouk9@gmail.com. We aim to respond within 30 days.
8. Children
Jabby is not directed at children and is not intended for anyone under 18. We do not knowingly collect data from children.
9. Changes
If this policy changes, the effective date above will be updated. Material changes will be surfaced in the app.
10. Contact
Jabby™ prototype · a.farouk9@gmail.com