Privacy Policy
Last updated September 24, 2026
This Privacy Notice for Cloud Continuum ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
- Download and use our mobile application (Fenvo), or any other application of ours that links to this Privacy Notice
- Use Fenvo
- Engage with us in other related ways, including any marketing or events
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.
Core Features & Technical Functionality
A. Account Creation & Dual-Verification Authentication
Functionality: Users register using a phone number and an email address to ensure account security.
Mechanism: Phone number verification via Firebase Phone Authentication (SMS OTP). Email address verification via a 6-digit confirmation code.
Data Involved: Phone number, email address, unique user ID (UUID), and device installation identifier (device_id).
B. Local-First Financial Data Storage
Functionality: Users can manually log transactions, create categories, establish envelope budgets, and set savings goals.
Mechanism: All financial records are immediately saved to a local SQLite database (Drift) on the user's physical device.
Data Involved: Transaction titles, amounts, currencies, timestamps, payment methods, transaction types (income/expense), category names, envelope target amounts, and goal progress.
C. Automated Financial SMS Processing (Android only)
Functionality: Optional. Detects banking and digital wallet SMS messages from sender names you add yourself, and drafts transaction entries for you to confirm.
Mechanism: A background listener (RECEIVE_SMS / READ_SMS) checks each message on the device first. Messages that pass that check are sent as text to our transaction-extraction service, which returns a title, a category and a merchant name. The amount, currency and account details are read on the device.
Privacy Safeguard: Messages that do not pass the on-device check never leave the phone. One-time passcodes and verification messages are always rejected. No transaction is added to your records without your confirmation. See Android SMS Transaction Detection below for the full description of what is sent and what is not.
D. Cloud Synchronization Engine
Functionality: Keeps user data backed up and synchronized across multiple logged-in devices.
Mechanism: Uses an offline-first SyncOutbox queue pattern. Local mutations (create, update, delete) are logged locally and pushed to the cloud server via HTTPS when an internet connection is available. Implements Soft Delete (deleted_at tombstones) to synchronize deletions across devices before local database cleanup.
Data Involved: Encrypted financial records, operation timestamps, sequence IDs (sync_cursor), and operation status logs.
E. Analytics & Insights
Functionality: Generates visual reports (charts, monthly spending trends, category breakdowns).
Mechanism: Queries data directly from the local SQLite database. Optional AI models (e.g., Gemini API) may process anonymized transaction titles locally/cloud-side to suggest automatic categories.
Android SMS Transaction Detection
In Short: On Android only, and only if you switch it on, the app reads messages from bank senders you name yourself. Messages that look like transactions are sent to our servers as text so a draft transaction can be read out of them. Nothing is added to your records without your confirmation.
Where this applies
This is an Android feature. The app does not read SMS messages on iOS, and nothing in this section applies there.
The feature is entirely optional and is switched off until you switch it on. If you never switch it on, or you decline the SMS permission, the rest of the app works exactly the same and you add transactions by hand.
Permissions we ask for
Two Android permissions, and no others for this feature:
- RECEIVE_SMS — to see messages as they arrive.
- READ_SMS — to read messages already stored in your inbox.
The app cannot send SMS messages. It does not ask for permission to send them, and it never sends one.
Which messages we read
When you set the feature up, you type in the sender names your banks use — the short name that appears at the top of their messages. You also add the words that mark a message as a transaction. Both lists start empty. The feature cannot be switched on until you have added at least one sender and at least one word. We do not apply a built-in list of banks on your behalf.
The app looks at messages in two ways:
- New messages, as they arrive on the phone.
- Messages already on your phone. Once, when you switch the feature on, over a date range the app shows you before it begins. After that, only to catch up on messages that arrived while the app was not running.
Every incoming message passes through the app for a moment, because checking who sent it is the only way to know whether it is one of yours. A message from a sender that is not on your list is discarded on the phone straight away. It is not looked at any further, it is not saved, and it is not sent anywhere.
Checks that run on your phone
Before any message can leave your phone, it has to pass a series of checks that run entirely on the device:
- One-time passcodes, verification codes and security messages are always rejected. This is the first check, before every other one. It cannot be switched off or overridden, including by words you add yourself.
- Advertising and promotional messages are rejected.
- Messages from senders that are not on your list are rejected.
- A message must contain an amount, and either a currency or a word that describes a transaction.
- Messages that only report a balance are rejected.
A rejected message goes no further. We record only a short code saying which check it failed — never the message, and never any part of it.
Many accepted messages never need to go any further either. When the app recognises a bank's message format on its own, it reads the transaction on the phone and sends nothing.
What we send to our servers
Please read this part. When a message passes the checks above and the app cannot read it on the phone, the full text of that message is sent to our servers so that a transaction can be read out of it. It is sent together with the names of the categories you use, so the transaction can be filed under the right one.
The text is sent as your bank wrote it. We do not remove or shorten anything in it beforehand. Anything your bank put in the message is sent along with the rest of it — the amount, any card or account digits the bank included, a reference number, the merchant's name, a balance.
The only changes we make are cosmetic ones that help the text be read: Arabic-Indic digits (٠١٢) are converted to Western digits (012), invisible formatting characters are removed, and repeated spaces are collapsed.
This travels over an encrypted (HTTPS) connection. No more than 120 messages per phone per day are sent this way.
Once a message reaches our servers it is used to produce the transaction and for nothing else. It is kept in line with "How long do we keep your information?" below.
What we do not send
- Your bank list and your keyword list. Both are stored on your phone only. They are not part of your account, they are not backed up, they are not synchronised to your other devices, and they are never sent to us.
- Messages that failed the checks. They never leave the phone, in any form.
- Any record of who sends you messages. Where the app keeps a breakdown of senders to help us improve recognition, it stays on the phone.
- Message text in usage statistics. When we record that the feature was used, we record counts, the currency, and a rounded amount range. No message text and no merchant name is ever included.
What is kept on your phone
The text of a message is stored in the app's own storage on your phone while the transaction it produced is waiting for you to review it. This is so you can check the draft against the message it came from.
When you confirm the transaction, or when you discard it, the message text is deleted. A small record stays behind without the text, so the same bank message cannot turn into a second transaction later.
A draft you never review stays in the review list, with its message text, until you review it or until the data is deleted as described below. It does not expire on its own.
Your controls
- Switch it off at any time in Settings. It stops immediately, including for messages already waiting to be handled. Switching it off does not withdraw the Android permission itself — that stays yours to manage in your phone's system settings.
- Edit your lists at any time. You can add or remove banks and keywords whenever you like.
- Every transaction waits for you. Nothing detected in a message is added to your records automatically. You confirm each one, and you can change any detail before you do.
Deleting this data
When you log out, or when you delete your account, the app wipes its entire local database from the phone. The SMS review list, including any message text still sitting in it, is deleted first, before anything else. The app's stored settings are cleared at the same time, so your bank list, your keyword list and the on/off setting go with them.
Deleting your account also sends a deletion request to our servers, which removes the records held against your account. Logging out does not do this — it clears the phone only.
Data Collection Summary
| Data Category | Data Type Collected | Purpose of Collection | Storage Location | Shared with 3rd Parties? |
|---|---|---|---|---|
| Personal Identifiers | Email address, Phone number, User UUID | Account creation, authentication, fraud prevention, multi-device account matching. | Local DB & Cloud Server | Shared with Firebase Auth (SMS OTP) |
| Financial Information | Transactions, incomes, budgets, envelope balances, savings goals | Core app functionality: tracking money, computing balances, generating spending analytics. | Local DB & Encrypted Cloud Server | No (Strictly confidential) |
| SMS Data | Text of banking transaction messages, from sender names you add yourself (Android only, optional) | Reading the amount, merchant and category of a transaction for you to confirm. | On the device while awaiting your review; messages that pass the on-device check are also sent to our servers as text | No. See Android SMS Transaction Detection |
| Device & Tech Info | Device ID, OS version, sync sequence numbers, network status | Managing multi-device database sync, background queueing, error logging. | Local DB & Cloud Server | No |
Sensitive System Permissions Required
To operate its core features, PayZabt requests the following system permissions:
- RECEIVE_SMS / READ_SMS (Android): Optional, and switched off until you switch it on. Used to detect banking transaction alerts from sender names you add yourself. Messages from other senders, one-time passcodes, and messages that are not transactions are rejected on the device and are never saved or sent. Messages that pass that check are sent to our servers as text so the transaction can be read out of them — see Android SMS Transaction Detection. The app never sends SMS messages.
- INTERNET & ACCESS_NETWORK_STATE: Required for Firebase authentication checks, background database sync, and connectivity status monitoring.
- POST_NOTIFICATIONS: To send local budget alert reminders (e.g., overspending warnings) and goal achievement notifications.
Security & Data Retention Policies
- Data Encryption: All network communication between the app and backend services uses TLS/HTTPS encryption. Local SQLite databases are stored in secure application-private sandboxes.
- Data Retention: Personal and financial data is retained as long as the user maintains an active account.
- Account & Data Deletion: Users can request full account and data deletion through the app settings or via a web contact form. Upon deletion, all cloud database records associated with the User ID are permanently purged, and local database files are wiped from the device upon logout.
Summary of Key Points
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.
Do we collect any information from third parties? We do not collect any information from third parties.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.
How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? The easiest way to exercise your rights is by contacting us at mohamed.magdy@cloudcontinuum.com. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.
Table of Contents
1. What information do we collect?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
- names
- phone numbers
- mailing addresses
- email addresses
- passwords
- contact preferences
Sensitive Information. We do not process sensitive information.
Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "How do we handle your social logins?" below.
Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:
- Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's microphone, and other features. If you wish to change our access or permissions, you may do so in your device's settings.
- Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.
This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
The information we collect includes:
- Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
Google API
Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2. How do we process your information?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
- To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
3. When and with whom do we share your personal information?
In Short: We may share information in specific situations described in this section and/or with the following third parties.
We may need to share your personal information in the following situations:
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
4. How do we handle your social logins?
In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.
Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.
We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.
5. How long do we keep your information?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which users have an account with us.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
6. How do we keep your information safe?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
7. Do we collect information from minors?
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at mohamed.magdy@cloudcontinuum.com.
8. What are your privacy rights?
In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "How can you contact us about this notice?" below.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Account Information
If you would at any time like to review or change the information in your account or terminate your account, you can:
- Log in to your account settings and update your user account.
- Contact us using the contact information provided.
Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.
9. Controls for do-not-track features
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
10. Do we make updates to this notice?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
11. How can you contact us about this notice?
If you have questions or comments about this notice, you may contact us by email at:
Cloud Continuum
12. How can you review, update, or delete the data we collect from you?
Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please email us at mohamed.magdy@cloudcontinuum.com.