Privacy Policy for Mango

Mango ("Mango", the "App", "we", "us", or "our") is an Android and iOS application that helps you remember and celebrate the birthdays, anniversaries, professional days, and international days of the people who matter to you. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data.

The App is developed and operated by Pouya Heydari ("we" / the "Developer"). If you have any questions about this policy, you can contact us using the details in the Contact Us section at the end of this document.

By downloading, installing, or using Mango, you confirm that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the App.

2. Who this policy applies to

This policy applies to everyone who uses the Mango mobile application on Android or iOS, including:

• Users who sign in with Google;
• Users who sign in with Apple;
• Users who use the App in Guest mode (without signing in).

3. Information we collect

We only collect information that is necessary to operate the App's features. The categories below reflect exactly what the App does.

3.1. Information you provide to us

a) Account information (only if you sign in)

When you sign in with Google or Apple, we receive from the identity provider:

• A unique user identifier (Firebase / Google / Apple user ID);
• Your email address (if the identity provider shares it);
• Your display name (if available);
• Your profile photo URL (if available).

We do not receive or store your Google or Apple password.

b) People and events you add

For each person you add (manually or by importing from your device contacts), you can provide:

• Name;
• Relationship (e.g. friend, partner, mother, father, sibling, relative, etc.);
• Birthday (date);
• Anniversary (date);
• Profession (from a predefined list);
• Sex (male / female / other).

This information is stored so the App can generate event reminders, wishes, and greeting cards for those people.

c) App preferences

Your in-app settings, such as:

• Preferred theme (System / Light / Dark);
• Preferred language (English / Persian);
• Notification timing (same day, 1, 2, 3 days before, or 1 week before);
• Which event categories are enabled (birthdays, anniversaries, professional days, international days).

3.2. Information collected from your device

a) Contacts (only if you grant permission)

If you open the "Import from Contacts" screen and grant the READ_CONTACTS permission, the App reads your device contacts only to display them in a list so you can choose which ones to import. For each contact, only the name and the birthday (when present) are used. We do not read phone numbers, email addresses, postal addresses, notes, photos, or any other contact field. Contacts that you do not explicitly import are never uploaded or stored by the App.

b) Notifications

If you grant the POST_NOTIFICATIONS permission (required on Android 13+), the App schedules local reminders on your device so it can alert you about upcoming events. These notifications are generated on-device; we do not operate a push-notification server for reminders.

c) Purchase information (if you subscribe)

When you tap "Go Premium" or purchase a subscription (monthly, annual, or lifetime), the purchase is processed by Apple App Store or Google Play Billing. We never see or store your payment card details. We only receive, through our subscription provider RevenueCat, a subscription status (active / expired), product identifier, expiry date, and an anonymous app-user ID that RevenueCat associates with your account (when you are signed in) so that your Premium status can be restored on other devices.

3.3. Automatically collected information

a) Analytics events

We use Firebase Analytics to understand how the App is used and to improve it. Examples of events we log include: app starts, screen views, sign-in taps, person saves / deletes, contacts import, notification permission prompts, paywall views, and purchases / restores. These events are not associated with the content of the people you add — we do not send names, birthdays, or anniversaries to analytics. Firebase Analytics may also collect a pseudonymous Firebase installation ID, device model, OS version, locale, and app version.

b) Crash reports

We use Firebase Crashlytics to automatically collect information about crashes and serious errors so we can fix them. A crash report typically includes a stack trace, the device model, the OS version, the app version, and the state of the app when the crash occurred. It does not include the content of the people you add.

c) Basic device / connection data

Like most apps, our backends (Firebase, RevenueCat) receive standard log data such as IP address, approximate region derived from IP, and a timestamp when your device connects to them.

3.4. Information we do not collect

• We do not collect your precise location.
• We do not access your camera, microphone, photos, files, calendar, SMS, or phone call logs.
• We do not collect your advertising ID. The Android com.google.android.gms.permission.AD_ID permission is explicitly removed in our manifest.
• We do not track you across other companies' apps or websites.

4. How we use your information

We use the information described above for the following purposes:

1. To provide the App's core features — showing your list of people, calculating upcoming events, sending local reminders, generating wishes and greeting cards, and sharing them through the apps you choose (SMS, WhatsApp, Email, or any other share target your device offers).
2. To sync your data across devices, if you sign in. Your data is associated with your Firebase user ID so you can access it from any device where you sign in with the same account.
3. To manage your subscription and unlock Premium features on your devices, through RevenueCat and the platform's billing system.
4. To authenticate you when you sign in with Google or Apple.
5. To maintain and improve the App, using aggregated analytics and crash-report data.
6. To comply with legal obligations and to enforce our Terms of Use.

We do not use your data to build advertising profiles, and we do not sell it.

5. Legal bases for processing (EEA / UK users)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, our legal bases under the GDPR / UK GDPR are:

• Performance of a contract (Article 6(1)(b)) — to provide the App, sync your data if you sign in, and deliver Premium features you purchase.
• Legitimate interests (Article 6(1)(f)) — to keep the App secure and reliable, to diagnose crashes, and to understand usage through aggregated analytics. You can object to processing based on legitimate interests (see Section 10).
• Consent (Article 6(1)(a)) — for optional permissions such as access to contacts or the ability to post notifications. You can withdraw consent at any time from your device settings.
• Compliance with a legal obligation (Article 6(1)(c)) — when we must keep records to meet tax, accounting, or other legal requirements related to purchases.

6. Third-party services we use

Mango relies on a small number of trusted third-party services to operate. Each of them processes limited information on our behalf and is bound by its own privacy policy.

We do not share your data with any advertising network, data broker, social network, or marketing partner.

7. Where your data is stored and international transfers

Your data is stored on servers operated by Google Cloud / Firebase and RevenueCat. These providers operate globally and may process data in the United States, the European Union, and other countries. When data is transferred out of the EEA / UK, the provider relies on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework.

8. How long we keep your data

• Signed-in users: We keep your account information and the people you've added for as long as your account remains active. If you delete your account from Settings → Delete Account, we immediately delete all people and events associated with your Firebase user ID and request deletion of your Firebase Auth account. Crashlytics and Analytics data is retained according to Google's default retention (typically up to 14 months for user-level analytics data, then deleted or aggregated).
• Guest users: Your data lives only on your device. If you uninstall the App or clear its data, your information is erased.
• Purchase records: RevenueCat and the platform store (Apple or Google) retain billing records for as long as required to comply with tax and accounting laws, typically several years, even after you delete your Mango account.

9. Security

We take reasonable technical and organizational measures to protect your data:

• All communication with Firebase and RevenueCat happens over encrypted HTTPS / TLS.
• Cloud Firestore data is scoped to your Firebase user ID, so only your signed-in session can read or write your people and events.
• The App does not store your Google or Apple password. Authentication is delegated to Google / Apple and Firebase.
• Local data on your device is protected by your device's own security controls (screen lock, device encryption, sandboxing).

No system is ever completely secure, and we cannot guarantee absolute security. Please use a strong passcode / biometrics on your device and keep your operating system up to date.

10. Your rights

Depending on where you live (EEA, UK, California, Brazil, and several other regions), you may have some or all of the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data. You can edit most of your data directly in the App.
• Erasure ("right to be forgotten") — delete your data. You can do this yourself at any time from Settings → Delete Account, or by removing individual people from the App.
• Restriction / objection — ask us to restrict or stop certain processing (such as analytics).
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — revoke permissions like Contacts or Notifications at any time in your device's system settings.
• Complain to a regulator — lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at the address in Section 14. We may need to verify your identity (for example, by asking you to sign in) before acting on a request.

10.1. California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect about you, to request that we delete it, and to not be discriminated against for exercising these rights. We do not sell or "share" (for cross-context behavioural advertising) personal information as those terms are defined under California law.

10.2. Nevada residents

We do not sell your personal information as defined by Chapter 603A of the Nevada Revised Statutes.

11. Children's privacy

Mango is not directed to children under 13 (or under 16 in the EEA / UK, where applicable). We do not knowingly collect personal data from children below these ages. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Notifications and permissions — how to control them

You are always in control of the optional permissions Mango asks for:

• Notifications (Android 13+ and iOS): You can enable or disable notifications in your device's system settings at any time. Disabling notifications will stop reminders but will not delete your data.
• Contacts (Android): Required only for the "Import from Contacts" screen. You can revoke it at any time in Settings → Apps → Mango → Permissions → Contacts. Revoking it does not remove people you have already imported.
• Network access: The App needs network access to sign you in, sync your data (if signed in), and verify your subscription. In Guest mode and offline, most features still work locally.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the App, or the law. When we do, we will update the "Last updated" date at the top of this page and, for material changes, we will notify you in-app or by another reasonable means before the changes take effect. Your continued use of Mango after the effective date of the updated policy means you accept the changes.

14. Contact us

If you have any questions, concerns, or requests about this Privacy Policy or about how Mango handles your data, please contact:

We aim to respond to every privacy request within 30 days.