Privacy Policy
The short version
- Your card details stay on your phone. We never ask for your full card number, CVV, PIN or bank login.
- Signing in with Google is optional. You only need it to import statements, buy Premium or join testing.
- When you import a statement, card numbers are hidden on your phone first. The rest of the statement, including your name and transactions, is read by Google's AI in the United States. We don't keep it.
- We keep only a little account information on our servers. You can delete it at any time.
- We don't sell your data, show ads or track you.
Who we are
ClimbOut is made by SRG Digital in Sri Lanka ("we", "us"). We are responsible for the personal data described in this policy.
For privacy questions or requests, email info@srgdigital.lk. This is our data protection contact.
What stays on your phone
Everything you enter about your cards is saved only on your phone:
- Your cards: a name you choose, the bank or company that issued the card, the card type (such as Visa or Mastercard), and at most the last 4 digits of the card number.
- Balances, credit limits, interest rates, due dates, payments, instalment plans and balance history.
- The figures from statements you import, such as dates, balances and the minimum due. The list of transactions is not kept.
- Your available credit, including amounts you confirm from a bank SMS.
- Your settings, such as language, reminders and app lock.
None of this is sent to us, linked to your Google account, or used for analytics or ads.
Keeping your statements (optional)
If you turn on Keep my statements in ClimbOut in Settings, you can keep a statement PDF on your phone to read again. ClimbOut asks each time you close one. Nothing is kept unless you agree.
- The PDF is exactly what your bank sent, so it may show your full card number. ClimbOut locks it with extra encryption on your phone.
- Other apps can't see it. It is never sent to us or anyone else, and it is not part of your phone's Google backup.
- You can delete kept statements at any time on the Statements screen, or have them deleted after one or two years. They are also deleted when you use Delete all data, delete your account or uninstall ClimbOut.
- On Free, ClimbOut keeps the latest statement for each card. Premium keeps them all. If Premium ends, nothing is deleted.
Your phone's Google backup
If your phone's Google backup is turned on, it includes ClimbOut, so you don't lose your cards when you change phones. Google keeps this backup in your Google account, and we can't open it. On Android 9 and later, Google also locks it with your screen lock, so only you can open it. On Android 8, ClimbOut's data is not locked this way. You can manage or delete it in your phone's settings.
Saved statement passwords, kept statements and your sign-in are not included. After a restore, you sign in again.
Backup file
ClimbOut doesn't back up to Google Drive or to us. Instead, you can save a backup file from Settings, with your cards, payments, history, saved plans and settings. You choose a password, and the file is locked with it before it is saved. You choose where it goes, such as your phone, a memory card or a cloud folder.
We never receive the file. We can't open it, and we can't recover a forgotten password. Restoring a backup file replaces the cards on the phone, after you confirm.
Kept statements go into a backup file only if you tick Include statements in backup. Saved statement passwords are never in any backup.
Signing in with Google (optional)
You can use ClimbOut without an account. ClimbOut asks you to sign in only when you need it: to import a statement, buy Premium or use tester access.
When you sign in, Google keeps your account details for us: an account ID, your name, email address and profile photo, that you signed in with Google, and when you created the account and last signed in. Your card details are never linked to your account.
What we keep on our servers
Our servers are run by Google in the United States. If you sign in, they keep only this:
| Information | Why | How long |
|---|---|---|
| Your account details: name, email address, profile photo, account ID and sign-in dates | To sign you in | Until you delete your account |
| Your access level: Free, tester or Premium | To give you the features you're entitled to | Until you delete your account |
| Premium status: your plan, when it ends, and a link to your Google Play purchase | To give you Premium and keep it up to date | Until you delete your account |
| Import counts: how many statements you imported each month, and how many tries and import reports each day | To apply the free monthly limit and prevent misuse | 13 months, or less if you delete your account sooner |
| Whether you've used your free first import | So the free first import is given only once | Until you delete your account |
| Tester details, if you are a tester: your email address on the tester list, when you were first and last active, and how many statements you imported | To give testers access | Until testing ends, you ask us to remove it, or you delete your account |
We also keep anonymous import statistics: for each bank and month, how many imports worked and which fields people corrected. They contain nothing about you and can't be linked to you.
Our server logs record what happened and when. Google's logs also record each request's time, IP address and device type. Logs never contain your statements, amounts, card details or account ID. They are deleted after 30 days.
Importing a statement
Importing is always your choice, one statement at a time. This is what happens:
- You choose a statement PDF or take a photo of it. If the PDF has a password, it is opened on your phone, and the password never leaves your phone. If you don't import it, ClimbOut deletes its copy when you close it.
- Before anything is sent, ClimbOut hides the card number on your phone, leaving only the last 4 digits. It also hides other long numbers, such as NIC and account numbers. Your name, address and the transactions on the statement are not hidden. Amounts and dates stay visible, so the figures can be read. For photos, you see exactly what will be sent. If ClimbOut can't check a page, nothing is sent.
- When you tap Import, the statement, with those numbers hidden, is sent securely to our server in the United States. Google's AI (Gemini) then reads the figures from it.
- Google doesn't use it to improve its products. Google may keep it for a short time, only to detect abuse.
- This means your statement, with numbers hidden, leaves Sri Lanka and is processed by Google in the United States, only to read its figures. By importing a statement, you agree to this. If you don't want this, don't import statements. Everything else in ClimbOut works without sending your card details anywhere.
- We don't keep your statement. It is read and then thrown away. It is never saved on our servers or in our logs.
- You check the figures and save them on your phone. The statement file and any photos are then deleted from your phone.
Reading statements automatically (optional, Premium)
If you turn on Read statements automatically, ClimbOut sends a PDF statement, with numbers hidden, while you are still reading it, so the figures are ready sooner. ClimbOut asks for your agreement first. The same rules apply, and each statement read this way counts as an import.
If you save a statement's password for next month, it is locked on your phone. It is never backed up or sent anywhere. You can remove it at any time.
Google's text recognition on your phone
To take a photo of a statement, find card numbers on it, or read a card you scan, ClimbOut uses Google's document scanner and Google's text recognition on your phone. Your photos and the text read from them stay on your phone.
Google does receive some information about how these tools are used, to find problems and measure use: your phone's make, model and Android version, the app's name and version, how long things took, basic settings such as image size, error codes, and IDs for your device and this installation. It never includes your photos, the text read from them or your card details. Google says this is encrypted and not shared with others.
Scanning a card
When you add a card, you can tap Scan card instead of typing. ClimbOut asks to use the camera only then.
- You take one photo of the side with the card number. It is read on your phone and never saved. It is deleted straight away, even if you cancel.
- ClimbOut keeps only the last 4 digits, the card type and the bank's name, if it is printed on the card. You check them before they are used.
- The full card number is only in your phone's memory for a moment. It is never saved, backed up or sent. The CVV and expiry date are never read.
- Nothing from the photo is sent to us, to Google's AI or to any server.
- Reading the bank's name only helps fill in the form. It doesn't check whether a card is genuine.
Sharing a bank SMS
If you share a bank SMS with ClimbOut to update your available credit, it is read on your phone only. It is never saved or sent anywhere. Only the amount you confirm is saved. ClimbOut never asks to read your messages.
Checking the app is genuine
To protect our servers, Google checks that requests come from the genuine ClimbOut app on a genuine phone. For this, Google receives information about the app and a check result for your phone. It isn't used for ads or tracking.
Analytics and crash reports
ClimbOut doesn't use its own analytics or crash-report tools. Google's text recognition sends the usage information described above. If we add such tools, we'll update this policy first, and they will never include amounts, card details or which banks you use.
Permissions
- Camera: only for Scan card.
- Notifications: for payment reminders, if you allow them.
- Fingerprint or screen lock: for the optional app lock, and to protect saved statement passwords.
- Internet: to sign in, buy Premium and send statements you choose to import.
- Running at startup and briefly in the background: so payment reminders still arrive after your phone restarts.
- Google Play billing: to buy Premium.
- Added by Google's sign-in tools: receiving messages from Google Play services and reading Google settings, to protect sign-in. ClimbOut doesn't send you push messages.
Taking a photo of a statement doesn't need ClimbOut's camera permission. Google's document scanner uses the camera itself.
Who we share data with
We don't sell your data or share it for ads. We use Google to run sign-in, our servers, the AI that reads statements, and Google Play purchases. This is Google LLC, through Firebase, Google Cloud, Gemini and Google Play, which processes the data for us in the United States. We may share data if the law requires it.
Your rights
Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you can ask us to:
- show you the personal data we keep about you, and give you a copy;
- correct it;
- delete it;
- stop using it if you withdraw your consent, for example to importing statements;
- stop using it if you object to how we use it.
Email info@srgdigital.lk, ideally from the email address of the Google account you use in ClimbOut, so we can find your data. We reply within 21 working days. Your card details are on your phone, where you can see, change and delete them yourself.
ClimbOut is offered in Sri Lanka only.
Deleting your account and data
You can delete your account in the app at any time, or ask us to do it. See how to delete your account and data.
Age
You must be 18 or older to use ClimbOut. It is for adults with credit cards, not for children.
Security
Everything ClimbOut sends is sent securely. You can lock the app with your fingerprint or screen lock, and saved statement passwords are locked on your phone. No system is perfectly safe, but we keep as little on our servers as we can.
Changes to this policy
If we change this policy, we'll update the date at the top. For important changes, we'll also tell you in the app.