FibonacciReview
VI
Menu

FIBONACCI REVIEW

App privacy policy

Read the separate Fibonacci Review policy before using features involving accounts, data, or online services.

Last updated: October 8, 2026

Fibonacci Review ("the App") is an Android learning application operated under the Fibonacci Review name. This policy explains the App's local-first design, optional online services, and the choices available to users.

1. Local-first study data

Core study features work without registration or sign-in. User-created content is stored primarily on the user's device, including decks, cards, notes, tasks and reminders, goals, roadmaps, study progress, statistics, and app settings.

Paid Premium users may manually import/export CSV and create or restore local backups. Core local study remains available without an account or Premium. Users choose a file or file location to start data-portability operations. They start only after a user action. Exported or locally saved files remain under the user's control and are not deleted automatically by signing out, deleting an account, clearing App data, or uninstalling the App.

If the user enables Android system backup, Android may back up non-sensitive App preferences according to the user's Android/Google backup settings. The App excludes its study database, account identifiers, and other sensitive local data from that system-backup path.

2. Optional account and manual Google Drive backup

Google Sign-In and Firebase Authentication are optional for core local study. They are used only when a user chooses an account-bound feature, such as restoring a Premium purchase or using Google Drive backup. When a user signs in, Google and Firebase may process information supplied by Google Sign-In, including email address, display name, profile-photo URL, Google identity data, Firebase user ID, and authentication metadata.

Optional Google Drive backup and restore require Paid Premium. Eligible users may explicitly create or restore an App backup in the hidden Google Drive appDataFolder associated with the authorized Google account. A backup can contain the local study content and settings described above. The App requests only the limited-purpose https://www.googleapis.com/auth/drive.appdata scope. It does not request general access to the user's Drive files.

Google Drive backup is manual and optional. The App does not automatically or in the background upload, download, merge, or synchronize study data. Google processes Drive authorization and backup data under the user's Google account, Google policies, and Google service infrastructure; processing or storage may occur outside Vietnam. The App supports a user-controlled passphrase for encrypting a Drive backup.

3. Analytics, crash reporting, advertising, and purchases

The App includes or may use these Google services:

Depending on the service and device, these services may process technical data, app events, crash logs, diagnostics, advertising identifiers or ad-request metadata, and purchase or entitlement status. The App does not receive or store payment-card details; Google Play handles payment processing.

When a signed-in user purchases or restores Premium, the App sends a fresh Firebase ID token, the Google Play purchase token, product identifier and type, and the required Play Integrity proof to a Cloudflare Worker. The Worker uses these values to authenticate the account, verify and acknowledge the transaction with Firebase and Google Play, and update the server-side Premium entitlement. Cloudflare does not receive payment-card details.

The backend retains the server-side purchase record needed to prevent the same purchase token from being claimed by another account and to restore or refresh entitlement after cancellation, expiry, refund, or revocation. Raw authentication, purchase, and Integrity tokens are not included in the public entitlement projection or application logs.

On a fresh installation, Analytics and Crashlytics collection is off until you enable it in the App's privacy settings. Previously saved choices are retained. Advertising is subject to the consent flow and controls provided by Google/Android where applicable. Premium is intended to remove ads where the App applies the Premium entitlement check.

4. How information is used

Information is used to provide local learning, reminders, free local data portability, optional accounts, paid manual Drive backup and restore, advertising, purchase-restoration, analytics, and stability functions requested or enabled by the user. The App does not request the user's phone number, precise location, or contacts. It accesses local files only when the user selects an import, export, backup, or restore location, and uses the camera only for QR-related features.

5. Storage, sign-out, and deletion

Signing out can retain local study data on the device for continued guest use or remove it, according to the user's choice. Clearing App data or uninstalling the App removes local App data from that device, but does not delete exported files or other copies saved outside the App.

Users can request account deletion in the App, through the public account deletion page, or by emailing founder@duytrichdan.com from the Google sign-in address associated with the account. During in-App deletion, the App attempts to obtain any required Drive authorization and delete its snapshot from the authorized Drive appDataFolder. If deletion cannot be verified, the App warns that the Drive backup may remain and asks the user to confirm before continuing with account deletion.

A completed account deletion removes the Firebase Authentication account and account-associated Firestore data that the App is able to identify. Requests handled outside the App may not have authorization to access the user's hidden Drive app-data folder, so a Drive backup may remain in the user's Google account. Local study data on other devices and files exported or saved by the user are not deleted automatically.

Google Play may retain purchase records under its own policies and legal obligations. Aggregated or de-identified analytics and crash data may remain in Google systems for their configured retention periods.

6. Permissions

The App may request these permissions for the following purposes:

Permissions and Google account access can be managed in Android or Google account settings.

7. Age audience

The App is intended for people aged 16 and older and is not directed to children under 16. Its store listing, advertising configuration, and account experience are intended to remain consistent with that audience. A parent or legal representative may contact us if they believe personal data from a person under 16 has been processed contrary to this policy.

8. Your choices and rights

Users may use core local study features without an account or Premium, decide whether to buy Premium for manual local or Google Drive data portability, decline or revoke Google Drive authorization, delete a Drive backup from the App, review or delete local content, manage Analytics and Crashlytics collection where available, manage advertising preferences through Google/Android controls where available, request applicable data rights, request account deletion, and uninstall the App.

9. Third-party policies

10. Contact and changes

For privacy questions or data-rights requests, contact founder@duytrichdan.com. We may update this policy as the App changes. The public policy and the copy bundled in the App should be kept aligned with the App's actual behavior.

View support information