Privacy Policy

This Privacy Policy explains how "รับทรัพย์" (RUBSUP) ("we", "our", or "the app") collects, uses, and protects your personal information.

RubSup: "Payment received sound" an ALARMS & REMINDERS application that provides instant notifications (alarms) when you receive bank transfer payments via Thai banks, and stores payment history as reminders for your business.

Please read this policy carefully before using our application.

Multi-Sensory ALARMS System

RubSup provides Multi-Sensory ALARMS to ensure you never miss a payment notification, regardless of your environment:

Why Multi-Sensory?

• ✅ Noisy Environment: Can feel vibration even if can't hear TTS
• ✅ Phone in Pocket: Tactile feedback alerts you immediately
• ✅ Visually Occupied: Audio + Vibration work when serving customers
• ✅ Accessibility: Multiple modalities ensure all users receive alerts
• ✅ Redundancy: If one method fails, others still work

Privacy Note: All three alert types are generated locally on your device. No data is transmitted to external servers.

Freemium Model & Notification Limits

How Free Version Works:

• Daily Limit: You receive up to 10 full notifications (visual + audio + vibration) per day
• After Limit: Additional payment SMS are still recorded in your transaction history, but notifications (visual/audio/vibration) are not triggered
• Reset: Limit resets daily at midnight
• Privacy: All SMS messages are still processed and stored locally on your device with AES-256 encryption

Premium Benefits:

• Unlimited daily notifications (no 10/day limit)
• Ad-free experience (no banner advertisements)
• Cross-device sync (share transaction summaries with staff devices)
• Cloud backup (transaction data backup)
• Priority support

Upgrade to Premium:

• One-time payment options: ฿99-149 (lifetime)
• Monthly subscription: ฿29-49/month
• Payment via PromptPay or credit/debit card (PaySolution gateway)

Privacy Impact: The freemium model only limits notification frequency. All SMS data is still processed, encrypted, and stored locally on your device regardless of your subscription status.

Advertising

Ad Network:

• We use Google AdMob to display banner advertisements
• AdMob may collect and use device identifiers (Advertising ID) for advertising purposes
• Ads are displayed at the bottom of the home screen (non-intrusive placement)

What Data is Collected for Advertising:

• Advertising ID: Anonymous identifier used by AdMob to show relevant ads
• Device Information: Device type, OS version (for ad compatibility)
• NOT Collected: Your SMS content, transaction data, or personal information

Why We Use Ads:

• To support free features and keep the app accessible to small businesses
• Revenue from ads helps cover server costs and app development
• Allows us to offer a freemium model instead of paid-only

Third-Party Data Collection:

• Google AdMob may collect device identifiers and usage data for advertising
• AdMob's data collection is governed by Google's Privacy Policy
• Learn more: https://policies.google.com/privacy
• Learn about Google's use of advertising data: https://policies.google.com/technologies/ads

User Control:

• You can opt out of personalized ads through your device settings (Android: Settings → Google → Ads → Opt out of Ads Personalization)
• You can upgrade to Premium to remove all advertisements
• Important: AdMob does NOT have access to your SMS content or transaction data

Privacy Note: Advertising IDs are used solely for displaying ads and measuring ad performance. We do NOT share your SMS data, transaction history, or personal information with advertising networks.

Why SMS Permission is Essential for ALARMS & REMINDERS

Why Thai Banks Require SMS Reading:

• Thai banks only send payment confirmation via SMS (no API for small businesses)
• PromptPay does not provide push notifications to merchants
• Internet Banking requires manual login to check transactions
• SMS is the only automated channel for payment confirmation

Business Necessity:

• Shop owners cannot check SMS every 30 seconds while serving customers
• Instant payment confirmation needed to fulfill orders immediately
• Without SMS permission, the app cannot provide alarms = no functionality

In-Context Permission Request (Google Play Compliant):

• App does NOT request SMS permission immediately on launch
• Shows feature explanation screen first (Empty State)
• User must press "Enable Notifications" button to grant permission (In-Context Request)
• Complies with Google Play Policy: "In-Context Permission Request"

1. Information We Collect

1.1 Information Stored Locally on Your Device (Default)

By default, most data processed by the app is stored directly on your device and is NOT sent to our servers.

SMS Messages (ALARMS & REMINDERS Purpose):

• The app reads SMS messages from banks only (filtered by bank sender ID and payment keywords)
• For INSTANT ALARMS: Detect payment received and trigger immediate notification
• For AUDIO ALERTS: Extract amount to read aloud via Text-to-Speech
• For PAYMENT REMINDERS: Store transaction history (amount, time, bank name)
• For DAILY REMINDERS: Calculate daily/monthly income summaries
• What We DON'T Read: OTP codes, passwords, personal messages, or non-banking SMS
• Storage: Stored in your device's local storage only with AES-256 encryption
• NOT sent to our servers (except when you enable Cross-Device Sync)

Transaction History:

• Records of transaction alerts generated within the app
• Stored locally on your device

Data Retention:

• Data is stored in your device's internal storage only
• No automatic export to external servers

1.2 Information Sent to Our Servers (Only When You Enable Cross-Device Sync)

CROSS-DEVICE SYNC (MASTER-CLIENT FEATURE):

This optional feature allows business owners to share transaction visibility with their staff:

Master Device:

• Reads banking SMS locally
• Processes and extracts transaction data
• Creates transaction summaries (amount, time, bank name)
• Uploads summaries to secure server
• Does NOT upload full SMS content

Client Device:

• Reads payment transaction summaries only
• Displays summaries to authorized staff
• Receives real-time notifications
• Cannot access full SMS content
• Requires Access Code for connection

Data Transmitted Between Devices:

• Transaction amount (e.g., 1,500 THB)
• Transaction timestamp
• Bank/sender name
• Transaction type

NOT Transmitted:

• Full SMS message content
• Phone numbers
• Personal information
• OTP codes
• PIN codes
• Passwords

Subscription Data:

• Payment history: date, amount, status
• Subscription details: plan, start date, expiry date
• Transaction ID for reference
• Email for communication
• Note: Credit/debit card information is NOT sent to us (processed via Payment Gateway)

2. How We Use Your Information

2.1 Primary Uses - ALARMS & REMINDERS

On Your Device (Local Processing):

• INSTANT ALARMS: Detect money transfers from banking SMS and trigger immediate notifications
• AUDIO ALERTS: Read payment amounts aloud with Thai Text-to-Speech (e.g., "You received five hundred baht")
• VISUAL ALARMS: Display notifications with amount, time, bank name, and vibration
• PAYMENT REMINDERS: Store transaction history for tracking and review
• DAILY REMINDERS: Generate daily/monthly income summaries
• FILTERING: Filter transactions by bank/amount/date for easier tracking

Cross-Device Sync (When Enabled):

• Share transaction summaries with authorized Client devices
• Provide real-time transaction visibility to staff
• Enable business monitoring across multiple devices

2.2 We DO NOT Use Your Data For:

• Advertising
• Selling to third parties
• Marketing purposes
• Profiling
• Any purpose other than stated above

3. Data Security and Protection

3.1 SMS Content Filtering

Bank SMS Only:

• App only reads SMS from banks you specify
• You can filter by bank sender

Sensitive Data Detection:

• OTP codes, PIN codes, and passwords are automatically detected
• Sensitive data is blocked and NOT displayed on Client devices
• Security warnings shown when sensitive data is detected

3.2 Encryption and Security Measures

Data Encryption on Device:

• All SMS data and transactions stored on your device are encrypted using AES-256 (Advanced Encryption Standard 256-bit)
• Same standard used by banks and government agencies

Encryption Key Storage:

• Encryption keys are automatically generated and stored securely:
  • iOS: Stored in iOS Keychain (protected by Secure Enclave)
  • Android: Stored in Android Keystore (hardware-backed security)
• Keys are protected by device PIN/password/fingerprint

Data Protection:

• Even if device is lost/stolen, encrypted data cannot be read without device PIN/password/fingerprint
• When app is uninstalled, all data and encryption keys are automatically deleted

Data Transmission Encryption:

• All data transmission between app and server uses SSL/TLS encryption (HTTPS)
• Specifically TLS 1.3 for maximum security
• Prevents data interception during internet transmission

Server-Side Encryption:

• Data stored on server (when Cross-Device Sync is enabled) is encrypted with AES-256
• Servers located in Thailand only

4. Data Sharing and Third Parties

4.1 We DO NOT Share Your SMS or Transaction Data

4.2 Exception: Cross-Device Sync (With Your Consent)

When You Enable Cross-Device Sync:

• Transaction summaries (NOT full SMS) are transmitted to our server
• Summaries are then shared with your authorized Client devices only
• User consent required before enabling this feature
• You can disable this feature anytime

4.3 Third-Party Service: Google AdMob (Free Version Only)

What AdMob Collects:

• Advertising ID: Anonymous identifier for ad personalization
• Device Information: Device type, OS version, screen size
• Ad Interaction Data: Ad views, clicks, impressions
• IP Address: For approximate location (country/region level)

What AdMob Does NOT Have Access To:

• Your SMS messages or content
• Your transaction history or payment data
• Your personal information (name, email, phone number)
• Your bank account information
• Any data stored in the app

Purpose of AdMob Data Collection:

• To display relevant advertisements
• To measure ad performance and effectiveness
• To prevent fraud and abuse in advertising

AdMob's Privacy Policy:

• AdMob's data practices are governed by Google's Privacy Policy
• View Google's Privacy Policy: https://policies.google.com/privacy
• Learn about Google's advertising practices: https://policies.google.com/technologies/ads

User Control:

• You can opt out of personalized ads in your device settings
• You can upgrade to Premium to completely remove ads and AdMob integration
• Premium users: AdMob SDK is not loaded, no data shared with Google

Data Separation:

• ✅ AdMob operates in a separate sandbox from our app's core functionality
• ✅ AdMob cannot access app's local storage, SMS data, or transaction database
• ✅ Only non-sensitive device identifiers are accessible to AdMob SDK

4.5 Application Features Overview

Master Device Features

1. MainPage - Real-time SMS Monitoring:

• Automatically reads SMS from banks when payment received
• Filters only transaction-related messages (containing "deposit", "receive", "payment")
• Displays payment amount, sender bank, date/time, and payment type
• Sends instant notifications when new payment detected
• Privacy: Only reads SMS from known bank sender IDs (SCB, Kbank, Bangkok Bank, etc.)
• Data Storage: Filtered SMS stored locally on your device with AES-256 encryption

2. ReceiveMoney - QR Code Generation for Payment Collection:

• Purpose: Generate PromptPay QR Code for customers to scan and pay
• How it works:
  • Enter payment amount and optional note/reference
  • Generate QR Code instantly
  • Customer scans QR Code with their banking app
  • Payment transferred via PromptPay system
• Privacy:
  • QR Code generated locally on your device (no server involved)
  • No payment data uploaded to our servers
  • QR Code contains only: PromptPay ID, amount, and optional reference
  • QR Code data is NOT stored after generation
• Security:
  • Uses official PromptPay QR Code standard (Bank of Thailand)
  • Payment processed through Thailand's national payment system
  • We do NOT handle or store payment card information
  • We do NOT process payments (handled by banks)
• Data Collection: NONE - This feature does not collect or transmit any data

3. ReportPage - Financial Reports:

• View daily, weekly, and monthly transaction summaries
• Filter transactions by date range
• View charts and graphs of payment trends
• Export reports (optional)
• Privacy: Reports generated locally from filtered SMS data
• Data Storage: Report data cached locally, you can delete anytime

4. Cross-device Sync (Optional Feature):

• Sync transaction SUMMARIES (not full SMS) to Client devices
• Requires explicit enablement in Settings
• Only summaries synced (amount, date, time, bank name, payment type)
• You control which devices can access summaries via Access Code
• Privacy: AES-256 encrypted transmission, you control access completely
• Data Storage: Summaries stored on server only while feature enabled, deleted when disabled

Client Device Features

1. MainPage - View Synced Transaction Summaries:

• View transaction summaries synced from Master device
• Real-time updates when Master device syncs new transactions
• Display amount, date, time, bank name, and payment type
• Cannot access full SMS content from Master device
• Privacy: Only sees summaries explicitly authorized by Master device owner
• Data Storage: Summaries cached locally on Client device, encrypted

2. ReceiveMoney - QR Code Generation for Payment Collection:

• Same features as Master device
• Generate PromptPay QR Code independently
• No connection to Master device for this feature
• Privacy:
  • QR Code generation is completely independent
  • No data shared with Master device
  • Generated locally on Client device only
• Use Case: Allows staff/employees to generate QR Codes for customer payments independently

3. ReportPage - Financial Reports:

• View reports based on synced transaction summaries
• Same filtering and charting features as Master device
• Export reports based on authorized summaries
• Privacy: Reports based on authorized summaries only, not full Master device data
• Data Storage: Report data cached locally on Client device

5. User Consent and Control

5.1 Permissions Required

SMS Permission (READ_SMS, RECEIVE_SMS) - CORE REQUIREMENT:

• Absolutely Required: Without SMS permission, the app cannot function as an ALARMS & REMINDERS tool
• Purpose: Read banking SMS to create instant payment alarms and transaction reminders
• What We Read:
  • ✅ Banking SMS only (filtered by bank sender ID: SCB, Kbank, Bangkok Bank, Krungsri, TTB, etc.)
  • ✅ Payment keywords only: "รับเงิน", "โอนเข้า", "deposit", "credit", etc.
  • ✅ Transaction details: amount, time, bank name, reference number
• What We DON'T Read:
  • ❌ OTP codes (one-time passwords)
  • ❌ PIN codes or passwords
  • ❌ Personal messages from contacts
  • ❌ SMS from non-banking sources
  • ❌ Marketing or promotional SMS
• In-Context Request (Google Play Compliant):
  • Permission NOT requested immediately on app open
  • App shows Empty State screen explaining why permission is needed
  • User must tap "Enable Notifications" button to grant permission
  • Follows Google Play Policy: "Permissions should be requested in context"
• User Control: You can revoke permission anytime in Android settings, but alarms and reminders will stop working

Alarms & Reminders Permission (SCHEDULE_EXACT_ALARM, USE_EXACT_ALARM) - Android 12+:

• Core Requirement: Essential for ALARMS & REMINDERS functionality on Android 12+
• Purpose: Schedule background tasks for real-time SMS monitoring and instant payment alarms
• Required for Android 12+ devices due to stricter background task restrictions
• What it does:
  • Real-time SMS Monitoring: Keeps background service active to detect banking SMS instantly
  • Instant Alarms: Triggers immediate notifications when payment SMS received
  • Daily Reminders: Schedules daily income summary notifications at specific times
  • Data Synchronization: Ensures timely sync between Master and Client devices
  • Background Processing: Maintains background processes for continuous monitoring
• What it does NOT do:
  • ❌ Does NOT access your personal alarms in Clock app
  • ❌ Does NOT modify your personal reminders or calendar
  • ❌ Does NOT track your schedule, location, or activities
  • ❌ Does NOT set any visible alarms or reminders on your device
  • ❌ Does NOT interfere with your other apps' notifications
• Privacy Impact: ZERO - This permission has no impact on your personal alarms and reminders
• User Control: You can revoke this permission anytime in Android settings, but the app will not be able to provide real-time alarms

Notification Permission (Android 13+):

• Required to show transaction alerts
• Optional but recommended

Vibration Permission (VIBRATE) - Normal Permission:

• Type: Normal Permission (automatically granted on app installation - no user dialog required)
• Purpose: Provide haptic feedback (vibration) for payment ALARMS to create distinctive multi-sensory alerts
• What it does:
  • Haptic Alerts: Triggers device vibration when payment SMS arrives (part of ALARMS functionality)
  • Vibration Pattern: Short-Long-Short pattern (100ms-500ms-100ms) - distinctive for payment notifications
  • Multi-Sensory ALARM: Works alongside visual notification and TTS audio to ensure payment is never missed
  • Background Service: Maintains vibration capability for real-time SMS monitoring
• What it does NOT do:
  • ❌ Does NOT access or control vibration settings of other apps
  • ❌ Does NOT vibrate for non-payment SMS (personal messages, OTP codes filtered out)
  • ❌ Does NOT track or store any vibration data
  • ❌ Does NOT affect system vibration settings
  • ❌ Does NOT vibrate continuously or excessively (only brief pattern when payment arrives)
• Why Multi-Sensory ALARMS?
  • 👁️ Visual: Push notification banner (for when user is looking at phone)
  • 🔊 Audio: Text-to-Speech reads amount aloud (for when user is nearby)
  • 📳 Tactile: Vibration pattern (for when phone is in pocket or noisy environment)
  • → Ensures business owner receives instant ALARM regardless of environment (busy, noisy, dark)
• Privacy Impact: ZERO - This permission only triggers device vibration motor, no data access involved
• User Control: You can disable vibration notifications in System Settings → Apps → RubSup → Notifications, though this may reduce alarm effectiveness
• Automatically Granted: Normal permissions are granted at install time without showing a dialog to the user (per Android policy)

Microphone Permission (RECORD_AUDIO) - Voice Input for QR Payment:

• Purpose: Enable voice commands to set QR payment amounts (e.g., say "400 baht" → QR code for 400 baht is instantly created)
• When Requested: Only when you tap the 🎤 Voice Input button on the QR Receive Money screen
• What We Do:
  • ✅ Recognize spoken Thai amount (e.g., "รับทรัพย์ 400 บาท", "400 บาท")
  • ✅ Set QR code amount from recognized speech
  • ✅ Announce via TTS: "รับทรัพย์ 400 บาท ... สแกนเพื่อชำระเงิน"
  • ✅ Also supports App Shortcuts: Long-press app icon → select amount (20, 50, 100, 400, 500 baht)
• What We DON'T Do:
  • ❌ Does NOT record or store audio
  • ❌ Does NOT send audio to any server
  • ❌ Does NOT listen continuously (only when button is pressed)
  • ❌ Does NOT access microphone in background
• Processing: Speech recognition is processed entirely on-device via Android Speech API — no audio leaves your device
• User Control: This feature is completely optional. You can set amounts manually by tapping the amount button instead. Revoking microphone permission disables voice input only; all other features remain unaffected.

iOS Mode (Client Mode Only):

• iOS supports Client Mode only — Master Mode (SMS reading) is not available on iOS
• Reason: Apple does not allow third-party apps to read SMS messages on iOS
• No READ_SMS or RECEIVE_SMS permissions are requested on iOS devices
• How iOS works:
  • Receives transaction summaries from Master device (Android) via server
  • Displays synced payment amounts from Master device
  • Supports TTS (Text-to-Speech) to announce payment amounts
  • Supports Voice Input for QR payment amount entry
  • Supports App Shortcuts (long-press icon → select amount)
  • Uses Background Fetch API for background data updates
• Permissions requested on iOS:
  • 🎤 Microphone — for voice commands to set QR amount only
  • 🗣️ Speech Recognition — to convert speech to payment amount
  • 🔔 Push Notifications — for payment arrival alerts
• Privacy on iOS: No SMS data is collected — iOS only receives summaries from server (if Cross-Device Sync enabled by Master device owner)

5.2 User Consent for Cross-Device Sync

Feature Overview:

Cross-device Sync allows Master device owner (business owner) to share transaction SUMMARIES (not full SMS content) with Client devices (employees). This feature is designed for small businesses where multiple staff members need to see payment information without accessing the owner's personal phone or SMS.

How It Works:

1. Feature is disabled by default
2. Master device owner must explicitly enable it in Settings
3. Master device owner must create Access Code for Client devices
4. Master device owner controls which devices can access summaries
5. Master device owner can disable anytime and delete all data from server

What is Synced (Transaction Summaries Only):

• ✅ Payment amount (e.g., ฿250.00)
• ✅ Transaction date and time
• ✅ Bank name (e.g., "SCB", "Kbank")
• ✅ Transaction reference number (if available)
• ❌ NOT full SMS content or message body
• ❌ NOT sender phone numbers
• ❌ NOT personal messages or conversations
• ❌ NOT recipient account numbers

User Control (Master Device Owner):

• You decide when to enable or disable the feature
• You control which devices can access summaries via Access Code
• You can revoke Access Code anytime to disconnect Client devices
• You can delete all synced data from server anytime
• You can see which devices are currently connected
• You can monitor sync status in real-time

Client Device Privacy Protection:

• Cannot access full SMS content from Master device
• Can only see transaction summaries authorized by Master device owner
• Cannot modify or delete Master device data
• Cannot see Master device settings or configuration
• Cannot access other Client devices' data
• Access automatically revoked when Master device owner disables sync

Encryption and Security:

• All synced data encrypted with AES-256 during transmission
• Data encrypted at rest on server
• Access Code required for all Client device connections
• TLS/SSL used for all server communications

6. Data Retention and Deletion

6.1 Data on Your Device

Retention:

• Data is stored on your device until you delete it manually
• You can delete individual transactions or all data

Deletion:

• Delete app → All data and encryption keys deleted automatically
• Clear app data → All local data deleted

6.2 Data on Server (Cross-Device Sync)

Retention:

• Transaction summaries stored for as long as you use the feature
• When subscription expires, data is deleted after 30 days

Deletion:

• You can delete all server data anytime from Settings
• When you disable Cross-Device Sync, all data is deleted from server
• When you uninstall app, server data is deleted automatically

7. Your Rights (PDPA Compliance)

Under Thailand's Personal Data Protection Act (PDPA), you have the right to:

• Access: Request access to your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Restriction: Limit how we use your data
• Portability: Request data in machine-readable format
• Objection: Object to certain uses of your data
• Withdrawal: Withdraw consent anytime

How to Exercise Your Rights:

• Contact us at: support@orderanywhere.in.th
• Or delete data directly from app Settings

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by:

• Posting new policy in the app
• Sending notification through the app
• Updating "Last Updated" date

9. Contact Us

If you have questions about this Privacy Policy:

• Email: support@orderanywhere.in.th
• Phone: +66 88 255 2277
• Website: https://orderanywhere.in.th

10. Summary (TL;DR)