Privacy Policy

1. Information we collect

Information you give us:

• Account details: your name, mobile number, email address, password (stored only as a secure hash) and an optional profile photo.
• Savings and payments: your savings goals, deposits, withdrawals, transfers between goals, collection requests and their amounts and dates.
• Bank details you add for withdrawals: bank name, branch, account holder name and account number.
• Photos you upload: bank deposit slips and payment proofs.
• Collector and merchant applications: your NIC number, address and a photo of your identity document.
• Messages you send us when you contact support.

Information collected automatically:

• Device information: an app-generated device ID and your device's model name, used to recognise your trusted devices and approve new sign-ins.
• A push notification token, so we can send you notifications about your account.
• Security and activity records: sign-ins, security changes and money events, with the device name or IP address they came from.
• On the website, a sign-in cookie that keeps you signed in. We do not use advertising or analytics cookies.

What we do not collect:

• Fingerprint or face data. If you unlock the app with biometrics, your phone checks it and only tells the app whether it matched. Your app lock PIN stays on your phone.
• Camera images. The camera is used only to scan QR codes; nothing is recorded or uploaded.
• Your location, contacts, or microphone.
• Card details. TimeBook does not take card payments.

2. How we use your information

• To create and run your account, and to record and process your savings, collections, deposits and withdrawals.
• To verify your identity: one-time codes by SMS and email, device approval, and reviewing collector and merchant applications.
• To keep your account and TimeBook secure, and to prevent and investigate fraud.
• To send you service messages and notifications about your requests and transactions.
• To answer your support requests.
• To meet our legal, accounting and audit obligations.

We do not sell your personal information, and we do not use it for advertising.

3. Who we share it with

• Collectors and merchants you deal with: your name (or, if you haven't set one, your email address or mobile number), profile photo and the amounts of the requests they handle for you.
• Hostinger, which hosts our servers, database, uploaded files and email.
• Text.lk, which delivers our SMS messages (such as verification codes).
• Google Firebase Cloud Messaging, which delivers push notifications to your phone.
• Banks, auditors, regulators, courts or the police when the law requires it, or to protect TimeBook users from fraud.

These providers only use your information to provide their service to us.

4. How we protect it

All data between the app or website and our servers is encrypted in transit (HTTPS). Passwords are stored as secure hashes, sign-ins on new devices need approval from a trusted device or an SMS code, and the app can be locked with a PIN or biometrics. No system is completely secure, but we work to protect your information and limit who can access it.

5. How long we keep it

We keep your information while your account is open. Transaction records, including deposit slips, and collector or merchant application records are kept after your account is closed, for as long as we need them for accounting, audits, dispute resolution and the law.

6. Deleting your account

You can delete your account in the app (Settings → Account → Delete Account) or on the web at timebook.lk/auth/delete-account. Your account needs a zero balance and no open requests first. It is locked straight away and deleted after 30 days; signing in during those 30 days cancels the deletion. On deletion we remove your name, mobile number, email address, password, profile photo, bank details, trusted devices and notification tokens. Transaction records are kept as described in section 5, without your contact details.

7. Your rights

Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you can ask us for a copy of your information, ask us to correct it, ask us to delete it, or withdraw your consent where we rely on it. You can update most of your details in the app yourself. For anything else, email us at support@timebook.lk.

8. Children

TimeBook is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it.

9. Changes to this policy

We may update this policy. We will change the date at the top, and tell you in the app or by SMS or email when the changes are important.

10. Contact us

Questions or requests about your privacy: support@timebook.lk