Privacy Policy

Last updated: September 16, 2026

This Privacy Policy explains how Mahdi Saifullah Srizan (operating as Bitflecks) (“we”, “us”, or “our”) collects, uses, and shares information when you use the Messtro mobile app and this website (together, the “Service”). Messtro helps a shared household or hostel (a “mess”) pool its food and bills, track meals, and keep a shared ledger. By using the Service you agree to this policy.

1. Information we collect

We collect only what we need to run the Service:

Account & profile. When you sign in with Google, we receive your name, email address, profile photo, and a Google account identifier. We use these to create and secure your account.
Mess content you create. Information you and your mess add — member names, emails and phone numbers, meal records, deposits and withdrawals, bills, payments, one-off expenses, notes, and the resulting balances/ledger. This is largely financial record-keeping about your shared household.
Premium purchase details. If you buy Premium through the Google Play Store or Apple App Store, the purchase is processed by Google or Apple and by RevenueCat, our subscription-management provider — they receive a purchase/subscriber identifier linked to your account and mess (so the right mess is granted Premium), your purchase/subscription status, and price. If a manager buys Premium on this website instead, we collect the plan selected and the payment proof you enter — the mobile number you paid from and the bKash/Nagad transaction ID — solely to verify and apply your payment.
Notifications. A device push token (via Firebase Cloud Messaging) so we can send you relevant alerts, such as approval requests and reminders. You can turn off notifications in your device settings.
Technical & diagnostic data. Standard information our infrastructure provider records to operate the Service reliably and securely, such as device/app version, approximate timing of requests, and error logs — including crash reports (via Firebase Crashlytics: crash stack traces, device model, and OS version) and anti-abuse/bot-protection signals (via Firebase App Check), tied to your device rather than your identity.

2. How we use your information

Provide the Service and sync your mess's data across its members' devices.
Authenticate you and keep accounts and data secure.
Calculate meals, bills, balances, and monthly summaries.
Verify and apply Premium payments, and manage entitlements.
Send operational notifications you've enabled.
Respond to support requests and prevent abuse or fraud.
Comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

3. How your information is shared

With your mess. Data you add to a mess is visible to the other members of that mess — that is the core purpose of a shared ledger. The mess manager can manage members and records.
Service providers. We use Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, Crashlytics, and App Check) to host data, run the Service, and keep it secure and stable. Your data is processed on Google's infrastructure under their terms and security controls.
Purchases. An in-app purchase is processed by Google Play or the Apple App Store, and managed for us by RevenueCat, our subscription-management provider — see “Premium purchase details” above for what they receive. A web purchase's payment proof is reviewed (by us and via mobile-financial-service transaction records) only to confirm your payment.
Legal reasons. We may disclose information if required by law or to protect the rights, safety, and security of our users or the Service.

4. Data retention & deletion

We keep your information while your account and mess are active. Detailed month-by-month records may be retained for a limited window (which can vary by plan) and older raw detail is pruned once a month is closed, while summary balances are carried forward. You can leave a mess or, if you are the manager, delete the entire mess — deleting a mess removes its records.

You can delete your account in the app (More → Delete account), or ask us to. Either way we can only delete an account that no longer belongs to any mess, so you'll be asked to leave each one first — that is what keeps the remaining members' accounting consistent. Deleting your account removes your sign-in account, your central profile (name, email, phone, photo), your notification tokens and any undecided join request.

Two things deliberately outlive it. Each mess you belonged to keeps its own member record with your name, email and phone as they were, so the balances other members still rely on stay attributed to a person rather than a blank; those go when that mess is deleted. And we keep the email address of any account that has used a free trial, indefinitely and for no other purpose, so the same address cannot claim repeat trials. Beyond those, we may retain limited records we are required to keep for legal, security or fraud-prevention reasons — for example, a completed payment. Our deletion page sets this out in full.

5. Your rights & choices

Access and review your data within the app.
Correct information you've entered, or ask us to help.
Leave a mess, or delete a mess you manage.
Turn off push notifications in your device settings.
Request deletion of your account and personal data by emailing us.

Depending on where you live, you may have additional rights (such as access, correction, deletion, or objection). Contact us to exercise them.

6. Security

Access to data is restricted by authentication and server-side security rules, and traffic is encrypted in transit. No method of transmission or storage is 100% secure, but we work to protect your information and limit access to what each member is permitted to see.

7. Age eligibility & teens' privacy

The Service is available to users aged 13 and older. It is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13 — if you believe a child under 13 has provided us information, contact us and we will delete it.

If you are between 13 and 17, you may use the Service only with the involvement of a parent or guardian, who should agree to these Terms and this Policy on your behalf and is welcome to review your mess activity with you. We collect the same limited information described in Section 1 from a teen user as from an adult — nothing extra, and never for advertising; the Service shows no ads and none of your data is used for third-party advertising or tracking.

8. International data processing

Our infrastructure is hosted with Google in the Asia-Southeast (Singapore) region. If you use the Service from another country, your information may be processed in locations outside your own, with appropriate safeguards from our provider.

9. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and significant changes may be communicated in the app or on this site.

10. Contact us

Questions about this policy or your data? Email us at bitflecks@gmail.com.