Pomaii Privacy Policy

Last updated: October 2, 2026

Pomaii ("the app") is developed and operated by TL Dynamics Ltd. ("we", "us", "our"). This policy explains what data Pomaii collects, how it is used, and how your information is protected when you use our mobile application and related services.

1. Data Stored on Your Device

All core business records created within Pomaii — including client contact information, itemized products/services, invoices, estimates, quotes, payment records, and business preferences — are stored locally on your device in an encrypted local database. This data remains strictly on your device and is not uploaded to or stored on our servers.

2. Google User Data: How It Is Used

If you choose to connect your Google account, Pomaii requests specific Google OAuth permissions solely to provide user-initiated functionality:

• Gmail Sending (https://www.googleapis.com/auth/gmail.send): Used solely to allow you to email PDF invoices, price estimates, and payment reminders directly to your clients from your own business email address when you tap "Send Invoice", "Send Quote", or "Send Reminder". Pomaii never reads your email messages, never accesses your inbox, never deletes messages, and never modifies mailbox labels.
• Google Drive Backup (https://www.googleapis.com/auth/drive.file): Used solely to create, update, and restore your encrypted database backup archive (pomaii-backup.json) and generated invoice PDFs in a dedicated, app-specific "Pomaii Backups" folder in your personal Google Drive. Pomaii uses narrow per-file permissions and cannot access, browse, or modify any other files in your Google Drive.
• User Profile & Identity (openid, profile, email): Used solely to identify and display the connected account's email address within the app's settings.

3. Sharing, Transfer, and Disclosure of Google User Data

TL Dynamics Ltd. explicitly outlines our policies regarding the sharing, transfer, and disclosure of Google user data:

• With Whom Data Is Shared, Transferred, or Disclosed: TL Dynamics Ltd. DOES NOT share, transfer, sell, rent, lease, or disclose Google user data to any third parties, external organizations, advertising platforms, data brokers, or commercial entities under any circumstances.
• Service Providers & External Processors: We do not transfer Google user data to any third-party service providers, cloud storage vendors, or data processors. All data remains exclusively on your device and inside your own Google Account.
• User-Initiated Transmissions Only: Data is transmitted exclusively to Google's own official API endpoints (such as sending an email via the Gmail API) strictly upon your explicit, manual action (e.g., tapping "Send Invoice" to email a client).
• No AI/ML Model Processing or Training: Pomaii DOES NOT use, transfer, or process Google user data with any artificial intelligence (AI) models, machine learning (ML) models, or third-party AI services. No Google Workspace or Drive user data is used to develop, train, fine-tune, or improve any AI or machine learning models.

4. Payment Processing (Stripe Connect)

If you choose to accept credit card payments via Stripe Connect, invoice metadata (invoice ID, number, amount, currency, and connected Stripe account ID) is processed by our secure backend to create Stripe Payment Links and verify payment completion. Payment status metadata is stored securely in Google Cloud Firestore. All payment card and banking information is entered exclusively on Stripe-hosted checkout pages and is never handled, processed, or stored by TL Dynamics Ltd.

5. Data Protection & Security

All authentication tokens (including Google OAuth tokens) are securely stored in your device's hardware-backed keystore (Android Keystore on Android, iOS Keychain on Apple devices) via secure encrypted storage. All network communications with Google APIs and payment services are strictly encrypted in transit using industry-standard HTTPS/TLS protocols.

6. Data Retention, Deletion & User Control

You have full control over your data at all times:

• In-App Data: You can delete all local data at any time by using the in-app reset option or by uninstalling the application.
• Google Permissions: You can disconnect your Google account in Settings at any time, which purges all local OAuth tokens. You can also revoke Pomaii's access at any time through your Google Account Security Settings.

7. Contact Us

If you have any questions or requests regarding this Privacy Policy, please contact us at:

TL Dynamics Ltd.
Email: info@tldynamics.ca
Website: https://www.tldynamics.ca