Privacy Policy

Effective: October 28, 2026. Applies to the Vaca Cheia app, version 1.2, and this page.

1. Who we are (controller)

App owner: MEDCALK LTDA (“we”), CNPJ 50.127.598/0001-52, address Rua Oscar Barbosa, 1635, apto 1301, Quinta da Primavera, Ribeirão Preto/SP, CEP 14022-104, Brazil. Data protection officer (DPO): Bruno Henrique Daroz, email [email protected]. Privacy and data rights contact: [email protected].

2. What data the app handles and where it stays

• On-device data: participant nicknames, amounts, pool title and description, goal, deadline, payment status (pending, reported, confirmed), organizer Pix key or link (entered by you), settings (terms acceptance, tutorial seen, local preferences), local reminder schedules (notifications at times you set).
• Where it stays: pools, Pix, and amounts use OS secure storage on your device (Keychain/Keystore). Minimal technical flags may use ordinary local storage. We do not receive or access this data.
• Sharing: only when you choose to share invite or nudge text (e.g. WhatsApp). Content goes to apps and people you choose.
• What we do not receive: the app does not send the developer CPF, email, phone, Pix keys, nicknames, or amounts. If you enter CPF, email, phone, or a random key as Pix, it stays on device only until you erase or share manually. We also do not collect location, contacts, photos, advertising IDs sent to the developer, or usage analytics. This static page does not use cookies.

3. Third-party data (participants)

If you are the organizer and enter others’ nicknames, you decide that purpose (tracking a split among people you know). Use only what you need, inform participants when appropriate, and delete when done. Because we have no access, we cannot delete for you — use “Erase all data” in the app or uninstall.

4. Purpose and legal bases (Brazil LGPD, art. 7)

Data is processed on device to provide features you request (organize the pool, totals, local reminders, sharing), generally under contract/performance at your request and, where applicable, consent (acceptance on first use).

5. Sharing with third parties

We do not sell or share data with us because we do not receive it. Apple and/or Google may process technical distribution data (store/TestFlight) under their own policies.

6. Pix and payments

The app does not process payments, move money, or see your bank transactions. It only displays and shares the key or link the organizer entered. Payments are between people, outside the app, in each person’s banking app.

7. Retention and deletion

Data remains on device until you erase it (in-app) or uninstall. We keep no copy on our servers. Android: Google auto-backup is off for this app. iPhone: pools and Pix use on-device Keychain (the app does not sync that data to iCloud); full iPhone backups you make yourself may still include other system data — see Apple Settings. Changing phones without an export backup from the app may mean loss — we cannot recover.

8. Your rights (LGPD, art. 18)

You may request confirmation, access, correction, deletion, etc. Because we usually do not hold your data, practical deletion is erase in the app or uninstall; still write to [email protected] (response within 15 days). ANPD complaints: gov.br/anpd.

9. Children and teens

The app is for adults 18+ with a self-declaration of age. Not directed at minors.

10. Security

Security also depends on your device (passcode, updates). Do not store unnecessary information in the app.

11. International transfer

We do not send your pool data off the device; we therefore do not perform international transfer of that data.

12. Changes

If a future version uses servers, accounts, ads, in-app purchases, or analytics, we will update this policy before release and notify in the app.

This document is informational and does not replace legal advice.