Privacy Policy of CasaEnOrden

Last updated: August 29, 2026

This Privacy Policy (the "Policy") describes how Camilo Henao Navarro, an individual domiciled in the Republic of Peru ("we," "CasaEnOrden"), collects, uses, shares, and protects your personal data when you use the CasaEnOrden application (the "Service").

This Policy is incorporated into our Terms and Conditions and should be read together with them. By using the Service, you accept the practices described here.

1. Data controller

The controller responsible for processing your personal data is Camilo Henao Navarro, whom you can contact at contacto.casaenorden@gmail.com for any question related to this Policy or to exercise your rights (Section 8).

2. What data we collect

2.1. Authentication data

You may access the Service with Google, Apple (Sign in with Apple), or using an email address and password. If you choose Google, we obtain the following basic profile data:

• Name.
• Email address.
• Profile photo (if you have one set on your Google account).

If you choose email and password, we process your email address to create and administer your account. Your password is managed by our authentication provider and is not available to us in readable form.

If you choose Apple, we process Apple's identifier and the data Apple shares to authenticate you. Apple may provide a private relay address, and your full name may be available only during the first authorization.

2.2. Data you provide while using the Service

• Household data: the Household's name, currency, and configured time zone.
• Membership data: your role in each Household (Owner, Administrator, or Member), and the dates you joined or left a Household.
• Service and expense data: the name, category, estimated amount, currency, payment type or recurrence (one-time, monthly, biweekly, yearly), and due date of each service you record.
• Service visibility: whether each service is shared or personal. Personal services are visible only to you and are excluded from the Household's shared summary and metrics.
• Split data: how each service is divided among Household members (as percentages or fixed amounts).
• Payment data: the amount, date, the member who made the payment, and optional notes you record for each payment; and, where applicable, the voiding of a payment recorded by mistake, while preserving its history.
• Household invitations: we generate and store a single-use invitation code (we store only its encrypted form, not the original code) so you can invite others to your Household.

2.3. Technical, diagnostic, and usage analytics data

We use Firebase Crashlytics to receive crash and error diagnostics, such as device and operating-system data, App version, App state, and technical error information. We do not add names, email addresses, amounts, notes, invitation codes, or service names to those reports.

The analytics option is enabled by default during setup. Before event collection begins, you can turn it off; if you leave it enabled and continue, we use Google Analytics for Firebase to pseudonymously measure visited screens and general actions (for example, completing setup, creating or editing a service, recording or voiding a payment, or using invitations). You can also change this choice at any time from Settings → Privacy → Usage analytics. Firebase may process technical installation identifiers, device/operating-system information, App version, language, and approximate country or region inferred from IP address. We do not send your name, email address, photo, account or Household identifiers, amounts, notes, invitation codes, or service or payment names as analytics parameters.

The App does not use iOS advertising identifiers (IDFA), does not enable advertising storage or ad personalization, and does not use analytics for targeted advertising.

To offer and manage subscription features, we use RevenueCat to manage pricing, purchases, restores, and access status. The App sends RevenueCat a stable pseudonymous CasaEnOrden identifier (your Supabase account UUID), together with the platform, product, and technical data needed to verify the subscription. We do not send card numbers or other payment-method details.

2.4. Data we do NOT currently collect

We currently do not request or store: credit/debit card information, bank accounts, or other payment methods; receipts, invoices, or images; or your geographic location. If we add any of these features in the future, we will update this Policy before they take effect (Section 11).

3. How we use your information

We use your personal data to:

a) Create and manage your account and your Household(s); b) Let you record services, splits, and payments, and calculate balances and contributions within each Household; c) Show your name and profile photo to the other members of the Households you belong to and keep personal-service information separate (Section 4); d) Send you reminders and notifications related to your activity in the App (for example, upcoming due dates); e) Keep the Service secure, prevent fraud, and enforce our Terms and Conditions; f) Provide technical support when you request it; g) Comply with applicable legal obligations. h) While analytics is enabled, understand in aggregate which features are used and improve the App's experience, design, and reliability. i) Manage and verify Plus access, purchases, restores, renewals, and cancellations through RevenueCat and the applicable store.

We do not use your personal data for targeted advertising, and we do not sell it to third parties.

4. Who we share your information with

4.1. With the other members of your Household

For shared services in a Household, your name, profile photo, the services assigned to you, and your payment history within that Household are visible to the other members of that Household. Personal services are visible only to you and do not affect the Household's shared summary or metrics. This visibility separation is a feature of the Service (see also Section 4.4 of the Terms and Conditions).

4.2. With providers that help us operate the Service (data processors)

We use external providers that process data on our behalf, solely to operate the Service:

• Google (Google Sign-In): to authenticate your identity and obtain the basic profile data described in Section 2.1 when you choose that method.
• Apple (Sign in with Apple): to authenticate your identity through Apple's native integration and receive the data Apple shares according to your authorization.
• Google Firebase (Analytics and Crashlytics): for the usage measurement described in Section 2.3 and crash diagnostics. The analytics option is enabled by default during setup and you can turn it off during setup or from Settings. Firebase processes the technical and event data required for those purposes according to your choice.
• Supabase (our authentication, database, and cloud infrastructure provider): manages email-and-password access and stores and processes the information described in Section 2 on servers that may be located outside Peru.
• RevenueCat: to manage purchases and restores, associate Plus status with your pseudonymous CasaEnOrden account identifier (your Supabase UUID), display localized prices and offers, and maintain a minimal technical subscription record. RevenueCat may process account, product, platform, status, date, and technical transaction identifiers; it does not receive card numbers or other payment-method details.

These providers may only use your data to provide us with their contracted service and are subject to their own privacy policies and to contractual confidentiality and security obligations with us.

4.3. Legal obligations

We may disclose your information if required by law, a court order, or a competent authority, or to protect our rights or the safety of you or others.

4.4. In the event of a business reorganization

If the Service comes to be operated by a legal entity or other organization (for example, following incorporation of a company), your data may be transferred to that entity to continue providing you the Service, following notice under this Policy.

5. International data transfers

Because we use external providers listed in Section 4.2 that may store and process information outside Peru, your personal data may be transferred internationally. We make these transfers with your consent where required or under another applicable legal exception, and take reasonable contractual and technical measures to maintain a level of protection consistent with Law No. 29733 and Supreme Decree No. 016-2024-JUS, its current implementing regulation.

6. Local storage on your device

So you can keep seeing recent information without an internet connection, the App temporarily stores on your device (for up to 24 hours) the latest results for screens such as Home, Upcoming Payments, Services, and Contributions. This local copy:

• Is always keyed to your user and the active Household, to prevent mixing information between accounts.
• Does not allow you to create services, record payments, or perform any other action that modifies information while you are offline.
• Is deleted from your device when you sign out or switch accounts.

If you add a CasaEnOrden widget to your home screen, the App also stores on your device a snapshot of the active Household to display there. This snapshot may include a service name, its outstanding amount, payment date or status, and a monthly summary; it does not include contributions, profiles, or notes. It is not sent to providers to render the widget. Your operating system may show this information on the home screen even while the App is closed; remove the widget if you do not want that exposure. The snapshot is replaced when you change Household and deleted when you sign out or switch accounts.

7. How long we keep your data

7.1. We retain your personal data for as long as you maintain an active account on the Service and as necessary for the purposes described in Section 3.

7.2. Even if you leave a Household or delete your account, we retain the history of services, splits, and payments already recorded in the Households you belonged to, to the extent necessary to maintain financial traceability for the other members of those Households (see Sections 4.5 and 13 of the Terms and Conditions). This means that even after you lose access to a Household, the historical information you generated within it will remain visible to its active members and will be identified as belonging to someone who is no longer a member.

7.3. We may retain certain information for an additional period when required by law or to defend our rights before a competent authority.

7.4. While analytics is enabled, events are retained according to the retention configuration of the Google Analytics property and its aggregation capabilities. If you turn it off during setup or from Settings, we stop future collection from your device; this does not automatically delete aggregate or previously sent data. You may request information or deletion where applicable through the contact in Section 13.

8. Your rights

Under Law No. 29733, Peru's Personal Data Protection Law, and its regulations, you have the right to:

• Access: request information about what personal data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Cancellation: request deletion of your data, subject to the limitations described in Section 7.2 while you have history shared with other Household members.
• Objection: object to the processing of your data in certain circumstances.
• Portability: request your data in a commonly used, structured format.

To exercise these rights, write to us at contacto.casaenorden@gmail.com stating your request. We may ask for reasonable information to verify your identity. These requests are free of charge. Under the maximum timeframes in Supreme Decree No. 016-2024-JUS, we will respond to information requests within up to eight (8) days, access requests within up to twenty (20) days, and rectification, cancellation, or objection requests within up to ten (10) days, unless an applicable rule provides otherwise. If you are between 13 and 17 years old, the responsible adult who authorized your use of the Service (Section 3.1 of the Terms) may exercise these rights on your behalf.

During setup, analytics is enabled by default and you can turn it off before continuing. You can also change your choice at any time from Settings → Privacy → Usage analytics. Disabling it does not limit the App's core functions.

You can also start deleting your account from Settings → Account → Delete account in the App. If you cannot access the App, request deletion by writing to contacto.casaenorden@gmail.com. Before confirming, you must meet the conditions described in Section 14.3 and the Terms and Conditions.

9. Security of your information

We apply reasonable technical and organizational measures to protect your data, including role-based access control within each Household and database-level security policies that isolate each Household's information. No system is completely secure; if we become aware of a security incident affecting your personal data, we will notify you as required by applicable law.

10. Children

The Service is directed at people who are at least 13 years old. If you are between 13 and 17 years old, you may only use it with the authorization and under the supervision of a responsible adult in your Household, under Section 3.1 of the Terms and Conditions. We do not knowingly collect data from children under 13 without such authorization. If you believe we have improperly collected data from a child under 13, contact us to have it deleted (Section 8).

11. Changes to this Policy

We may update this Policy from time to time. If changes are material, we will notify you within the App or through another reasonable means before they take effect. The "Last updated" date at the top of this document indicates the version in effect.

12. Geographic scope of this Policy

12.1. This Policy applies to the Service as offered in Peru and in the other countries where we progressively offer it, including the United States.

12.2. This Policy is not designed to comply with the General Data Protection Regulation (GDPR) of the European Union or equivalent regulations of the United Kingdom or Switzerland, since the Service is not directed at individuals located in those territories (Section 17 of the Terms and Conditions).

12.3. If the Service is offered in a new country whose data protection legislation requires additional terms, we will incorporate a country-specific annex to this Policy.

13. Contact

For any question about this Policy or the processing of your personal data:

Camilo Henao Navarro

Email: contacto.casaenorden@gmail.com

14. Plus-related data

14.1. If you use Plus, we process the product identifier, technical transaction identifiers, status, validity or revocation dates, and a non-sensitive support code. To associate subscription status with your account, the App sends RevenueCat a stable pseudonymous CasaEnOrden identifier (your Supabase account UUID), together with the platform, product, subscription status, and subscription dates. We do not store card numbers, bank accounts, or the payment method. RevenueCat validates purchases with Apple or Google; the App does not expose receipts or purchase tokens to other users.

14.2. Apple and Google independently process purchases under their policies. RevenueCat and our server mirror use the above data to verify access, prevent a purchase from being improperly linked to another account, handle restores, and retain a minimal billing, fraud-prevention, and compliance audit record.

14.3. We retain the minimal access and audit record as long as necessary to resolve disputes, refunds, legal obligations, or fraud. If you request account deletion while an auto-renewing subscription remains active, you must first cancel it in the store and wait for cancellation to be verified; you may then request deletion under this Policy.

This Policy is originally drafted in Spanish ("Política de Privacidad de CasaEnOrden") and, together with the Terms and Conditions, forms a single agreement. If this translation differs from the Spanish original, the Spanish version governs, as stated in Section 22 ("Language") of the Terms and Conditions.