Privacy Policy for Taksal Studio

1. Overview & Scope

This Privacy Policy governs the manner in which Taksal Studio (referred to herein as "Taksal", "the Application", "we", "our", or "us", identified under Android package identifier com.card.mint.cardbuilder) collects, uses, maintains, and discloses information gathered from users of our Android application.

We adhere to a foundational engineering principle: True Offline-First Data Sovereignty. Unlike conventional cloud-based design or invoicing software, Taksal operates primarily on your physical device. We do not operate proprietary backend servers that ingest, store, process, or sell your commercial records, customer details, invoices, or graphic creations.

2. Data Architecture & Local Storage

All functional application data is stored locally on your device within Android application-private SQLite database tables managed by the Room persistence library. This includes:

• Design Artifacts: Canvas elements, text coordinates, font selections, layer hierarchies, and background colors for business cards, logos, posters, banners, and flyers (stored in the designs table).
• Business Profile: Your trading name, business address, contact telephone, email address, GSTIN (Tax Identification Number), and UPI Virtual Payment Address (VPA) for invoice letterheads (stored in the brand_kits table).
• Commercial Invoices & Estimates: Client names, billing emails, itemized line goods/services, tax rates, total sums, and payment statuses (stored in the invoices and quotations tables).
• Point of Sale Receipts: Transaction slip numbers, cashier notes, payment methods, and timestamps (stored in the receipts table).
• Inventory & SKU Records: Product labels, SKU identifiers, stock quantities, cost prices, suppliers, and safety stock thresholds (stored in the products table).
• Expense Ledgers: Categorized expenditure entries, amounts, and dates (stored in the expenses table).

Zero Cloud Transmission: None of the aforementioned information is ever transmitted to Taksal Studio servers. All database records remain sandboxed within your device's internal storage (/data/data/com.card.mint.cardbuilder/).

3. Android KeyStore Cryptographic Security Vault

To prevent extraction of sensitive business data or credentials from rooted devices, modified APKs, or physical device inspection, Taksal Studio incorporates the Android KeyStore Hardware Vault architecture (SecureDatabaseHelper).

• Encryption Algorithm: 256-bit Advanced Encryption Standard (AES) in Galois/Counter Mode (GCM) with 128-bit authentication tags and cryptographically secure random 12-byte initialization vectors (IVs).
• Key Storage: The cryptographic master key is generated and permanently housed within your device's hardware Secure Enclave or Trusted Execution Environment (TEE). The key material never enters general device RAM in plaintext.
• Backup Prohibition: The application explicitly declares android:allowBackup="false" in its manifest, preventing unauthorized extraction of application databases via Android Debug Bridge (ADB) or cloud backup archives.
• Cleartext Network Guard: The application declares android:usesCleartextTraffic="false", strictly mandating encrypted HTTPS/TLS 1.3 for all outgoing network communication.

4. Android Device Permissions Disclosures

Taksal requests only the minimum necessary Android system permissions required to deliver core functionality. Below is an exhaustive accounting of permissions declared in AndroidManifest.xml:

5. Third-Party Advertising & Consent Management (Google UMP)

Taksal Studio is provided 100% free of monetary charge. To support continuous maintenance and new feature development, the application displays advertisements served by Google AdMob (Google Mobile Ads SDK).

A. Google User Messaging Platform (UMP) & Consent Choices

In compliance with the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act, and the California Consumer Privacy Act / CPRA, Taksal integrates Google's certified User Messaging Platform (UMP) SDK.

• Upon first application launch in relevant jurisdictions, a certified consent form is presented allowing you to consent to or reject personalized advertising and third-party vendor tracking cookies/identifiers.
• You may re-surface and alter your privacy choices at any time inside the app by opening Settings > Consent & Privacy Choices (or tapping "Privacy Policy & Choices").
• When consent is declined, Google AdMob serves non-personalized, contextual advertisements only.

B. Ad Placement Policy & Cooldown Guarantees

We believe ads should never degrade the creator experience. Our AdManager enforces:

• Task Breakpoint Interstitials: Interstitial ads are shown only at natural completion breakpoints (e.g. after a design is successfully exported to storage).
• Strict 60-Second Cooldown: Interstitials are governed by a mandatory minimum 60,000 ms cooldown timer. If an export is triggered within the cooldown window, the ad is automatically suppressed.
• Never During Active Editing: Ads are never displayed while you are actively dragging elements, typing invoices, or interacting with the vector canvas.

6. Gemini 3.5 AI Studio & Generative Intelligence

Taksal Studio offers optional artificial intelligence features powered by Google's Gemini models (Gemini 1.5 Flash, Gemini 1.5 Pro, and Gemini 2.0).

• Ephemeral Memory Architecture: AI conversation history is kept in transient device memory during your active editing session only. We deliberately do NOT persist chat history to disk (GeminiChatRepository). Once you exit the AI Studio screen, the conversation is wiped.
• Sovereign API Key Encryption: If you supply your own Google AI Studio API key, it is encrypted using Android KeyStore AES-256-GCM. Plaintext keys are never logged in Android system logs (Timber ProductionTree) and are never sent anywhere except directly to Google's official endpoint (https://generativelanguage.googleapis.com/) over TLS.
• Google Generative AI Policies: Data transmitted to the Gemini API is processed subject to the Google Privacy Policy and Google AI Studio Terms of Service.

7. Telemetry & Analytics Disclosures

Taksal Studio does NOT integrate invasive third-party tracking suites such as Facebook App Events, adjust, AppsFlyer, or data brokers.

The internal ProductAnalytics interface routes events strictly to local developer logs (TimberProductAnalytics with log level WARN in release builds) for diagnosing application crashes, verifying ad callback integrity, and counting local export successes. No personally identifiable information (PII), client names, or invoice figures are ever logged.

8. User Rights (GDPR, UK DPA, CCPA / CPRA)

Depending on your jurisdiction, you possess specific statutory rights regarding personal data:

• Right to Access & Portability: Because your data resides in SQLite on your device, you have immediate access to your records at all times. You can export designs in PNG, PDF, and SVG, and business reports in CSV or PDF.
• Right to Rectification: You can edit, update, or correct any business profile detail, invoice item, or product catalog record directly inside the application interface.
• Right to Object & Restrict Processing: You can withdraw advertising consent at any time via the in-app Consent & Privacy Choices dialog.
• Do Not Sell My Personal Information: Taksal Studio does not sell, rent, or lease personal information to any third party.

9. Data Deletion & Complete Account Erasure

Because Taksal does not create remote accounts or maintain centralized servers, you hold total autonomous control over data erasure:

1. Reset Within App: Navigate to Settings > Reset All Settings to restore all studio preferences, canvas defaults, and tax configurations to initial factory defaults.
2. Trash Vault Purge: Navigate to Settings > Trash & Version Vault and select Empty Vault to permanently eradicate all soft-deleted designs.
3. Complete Local Wipe: To erase 100% of databases, invoices, and brand profiles, open Android Settings > Apps > Taksal > Storage > Clear Storage (or Clear Data).
4. App Uninstallation: Uninstalling the Taksal Studio application immediately removes all app-private databases, encrypted DataStore preference files, and hardware cryptographic key aliases from your device.

10. Children's Privacy (COPPA & Age Verification)

Taksal Studio is intended for commercial business use, freelance creators, and general graphic design. The application is not directed at children under the age of 13 (or 16 in the European Union). We do not knowingly collect personal information from children. If you become aware that a child has provided personal information through our support channels, please contact us immediately for removal.

11. Legal Inquiries & Contact Details

For any questions, compliance requests, or inquiries regarding this Privacy Policy, please contact our designated privacy lead: