Privacy Policy

HubyCard ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use the HubyCard mobile application ("App"). By using the App, you agree to the collection and use of information in accordance with this policy. We encourage you to read this policy carefully to understand our practices.

Account Information: • Email address (for account creation and recovery) • Name (optional, for personalization) • Password (encrypted, never stored in plain text) Financial Data You Enter: • Credit card names and issuers • Credit limits and balances • APR rates and due dates • Last 4 digits (optional) • Expense transactions and categories Device Information: • Device type and operating system • App version • Crash reports and performance data We do NOT collect: • Full credit card numbers • Bank account information • Social security numbers • Location data

Local Storage Priority: Your sensitive financial data (cards, balances, expenses) is stored locally on your device using encrypted storage. This data never leaves your device and is not transmitted to our servers. Account Data: Basic account information (email, encrypted password) may be stored on secure servers to enable features like account recovery and cross-device sync in future updates. Data Encryption: All locally stored data is encrypted using industry-standard encryption protocols. Your data is protected even if your device is lost or stolen.

We use your information to: • Provide and maintain the App's functionality • Process your account registration and authentication • Send important account notifications • Provide customer support when you contact us • Analyze usage patterns to improve the App • Detect and prevent fraud or security issues We do NOT: • Sell your personal information to third parties • Use your financial data for advertising purposes • Share individual financial data with anyone • Access your data without your explicit request

We may share limited information with: Service Providers: Third-party companies that help us operate the App (hosting, analytics, crash reporting). These providers are bound by confidentiality agreements and can only use data to perform services for us. Legal Requirements: When required by law, court order, or government regulation. Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to users. With Your Consent: Any other sharing will only occur with your explicit permission. We never share your detailed financial data (card balances, expenses, etc.) with any third party.

We implement multiple security measures: • End-to-end encryption for data transmission • Local encryption for stored financial data • Secure password hashing (bcrypt) • Regular security audits and updates • Automatic session timeouts • Optional biometric authentication While we strive to protect your information, no method of electronic storage is 100% secure. We cannot guarantee absolute security but take all reasonable precautions.

You have the right to: Access: View all data we have about you Correction: Update inaccurate information Deletion: Delete your account and all associated data Export: Download your expense data as CSV Opt-out: Disable optional analytics sharing To exercise these rights: • Access/Edit: Use in-app Profile settings • Delete: Go to Profile > Delete Account • Export: Use Import/Export feature • Contact us: privacy@hubycard.app

HubyCard is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@hubycard.app.

The App may use third-party services that collect information: Analytics: We use anonymized analytics to understand how users interact with the App. This data is aggregated and cannot identify individual users. Crash Reporting: If the App crashes, diagnostic information may be sent to help us fix issues. This does not include your financial data. App Stores: Apple App Store and Google Play Store have their own privacy policies that govern your relationship with them.

Active Accounts: We retain your data as long as your account is active and needed to provide services. Deleted Accounts: When you delete your account, all associated data is permanently removed within 30 days. Local Data: Financial data stored locally remains on your device until you delete the App or clear the data manually. Backup Data: If you use device backups (iCloud, Google), your encrypted App data may be included. This is governed by your device backup settings.

HubyCard is operated from the United States. If you access the App from outside the US, please note that your information may be transferred to, stored, and processed in the US or other countries where we or our service providers operate. By using the App, you consent to this transfer. We take measures to ensure your data receives adequate protection regardless of where it is processed.

We may update this Privacy Policy from time to time. We will notify you of any material changes by: • Posting the new policy in the App • Sending an email notification to your registered address • Displaying a prominent notice in the App The "Last Updated" date at the bottom indicates when the policy was last revised. Continued use after changes indicates acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: Email: privacy@hubycard.app Support: support@hubycard.app We will respond to your inquiry within 30 days. Last Updated: January 2026