Privacy Policy

Last updated: 19 August 2026

CashPilot is a business management application developed and operated by Tobiz Network Sdn. Bhd. (Registration No. 201701036845 / 1251016-T) (“Company”, “we”, “us” or “our”). CashPilot is designed to help small and medium enterprises (SMEs) in Malaysia manage and organise their business operations. Your privacy is important to us. This policy explains what data CashPilot accesses, how it is used, and how it is protected.

1. What Data CashPilot Accesses

Google Account (via Firebase Authentication):

• Your name and email address — used to identify your account and enable sync across sessions.
• CashPilot does not access your Google password.

Google Drive (via drive.file scope):

• CashPilot creates and manages files only in its own folders: CashPilot Backups and Digital Order Book.
• CashPilot does not access, read, or modify any other files in your Google Drive.
• Product images are uploaded to your Google Drive and shared via public link so buyers can view them in your Digital Order Book.
• Backup files are stored in your Google Drive for your own use.

Business Data (stored locally on your device):

• Transactions, invoices, payables, receivables, and company settings are stored in your browser's local storage (IndexedDB).
• This data stays on your device unless you choose to sync.

2. How Data Is Stored

• On your device: All business data is stored locally in IndexedDB. CashPilot works offline.
• In your Google Drive: Backups and product images — files you create through CashPilot.
• In Firebase (Google Cloud): Sync data (transactions, invoices) stored under your authenticated account for cross-session access. Hosted on Google Cloud infrastructure in compliance with Google's security standards.

3. What We Do NOT Do

• We do not sell your data to third parties.
• We do not share your data with advertisers or marketing services.
• We do not use your data for AI training, analytics profiling, or any purpose beyond providing CashPilot's features to you.
• We do not store your Google Drive files on our servers — they remain in your Google Drive.
• We do not access files in your Google Drive beyond the CashPilot folders.

4. Data Sharing

CashPilot only shares data in the following situations:

• Digital Order Books: When you create a Digital Order Book, product names, prices, and images are shared with buyers via a URL link. This is initiated by you.
• CashPilot Connect: When you connect with a buyer or supplier, order and invoice data is shared between the connected parties via Firebase. Both parties must opt in.
• No other sharing: Your financial data, transactions, and company information are never shared with anyone unless you explicitly initiate it.

5. Data Retention & Deletion

• Local data can be cleared at any time by clearing your browser data.
• Firebase sync data is retained under your account and can be deleted by contacting us.
• Google Drive files can be deleted directly from your Google Drive at any time.
• You can revoke CashPilot's access to your Google Drive at any time via Google Account Permissions.

6. Security

• CashPilot uses Firebase Authentication (Google's identity platform) for secure sign-in.
• All data in transit is encrypted via HTTPS.
• CashPilot uses the narrowest Google Drive scope available (drive.file), limiting access to only files created by the app.
• No sensitive credentials (passwords, refresh tokens) are stored by CashPilot.

7. Children's Privacy

CashPilot is a business management tool and is not intended for use by children under 18. We do not knowingly collect data from minors.

8. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. Continued use of CashPilot after changes constitutes acceptance of the updated policy.

9. Contact

If you have any questions regarding privacy while using the app, or have questions about our practices, please contact us via email at support@tobiz.network.