Privacy Policy — Tibuok

In plain language: Tibuok is an invite-only family medicine-list workspace. Your account, shared claims, and evidence are used only to provide the circle you choose to join.

1. Who we are

Tibuok is provided by Saifullah Ahad, Dhaka, Bangladesh. Contact [email protected] or visit saifullah.ai.

2. Information Tibuok handles

• Account: email address, display name, Firebase user ID, authentication records, and generic push-notification token.
• Family circle: the cared-for person's chosen name, invite code, membership, role, consent acknowledgement, blocks, and reports.
• Health-related user content: medicine-package words, medicine state (prescribed, taking, or stopped), contributor and date, identification candidates, source citations, and derived factual findings.
• Evidence: a medicine-box or prescription photo only when you choose the camera option. Photos are resized before upload.
• Local security: preferences, cached circle data, queued offline commands, and—if you create one—a random salt and an iterated PBKDF2-HMAC-SHA-256 derivation of your dedicated Tibuok App PIN. The PIN itself is not stored or transmitted.

Tibuok does not collect contacts, precise location, advertising ID, payment data, audio, browsing history, or health data from sensors.

3. Permissions

• Camera: capture medicine evidence after you choose that action. Manual entry remains available.
• Notifications: receive generic circle-change notices. Notification text does not name a medicine or person.
• Biometric: Android performs optional fingerprint or face checks locally. Tibuok never receives biometric data, and device PIN/pattern fallback is not accepted by the app lock.
• Internet/network state: account access, member-restricted synchronization, source lookup, uploads, and push delivery.

4. How information is used

We use the information to authenticate you, restrict each circle to its members, synchronize immutable contributor claims, identify a medicine only when the evidence supports it, preserve uncertainty and disagreement, show cited duplicate-ingredient or published-label findings, create a user-requested PDF, deliver generic notifications, investigate reports, prevent abuse, and delete data on request.

Tibuok is not a diagnosis, dose checker, or medical-advice service. Unknown evidence produces no finding. Any surfaced concern tells the family to take the list to a pharmacist or doctor.

5. Service providers and data disclosures

• Google Firebase: Authentication, Firestore member-restricted synchronization/cache, Cloud Messaging, and Play Integrity App Check.
• Cloudflare: the authenticated command service, rate limiting, access-controlled R2 photo storage, and Worker AI OCR fallback. The R2 bucket is not public.
• U.S. National Library of Medicine: RxNorm and DailyMed receive medicine terms or ingredient queries needed for cited identification and label evidence; they do not receive your account name, email, circle name, or photo.
• On-device ML Kit: Latin and Devanagari text recognition runs on the device.

We do not sell personal data, use it for advertising, disclose it to pharmacies, doctors, insurers, or employers, or make it public. A PDF leaves Tibuok only when you deliberately share it through Android.

6. Retention and deletion

Account and circle data remain while the account or circle exists. Removing a contributor deletes that contributor's claims, affected reports, stored photos, membership, and access, then recomputes the remaining circle. Closing a circle permanently deletes its claims, findings, reports, memberships, invite, and photos. Deleting an account removes its profile, tokens, blocks, offline receipts, memberships, contributed claims, and stored photos and also deletes the Firebase Authentication account.

Local cache and preferences can be removed by clearing app storage or uninstalling. A generated PDF is held in temporary app storage; copies you share are controlled by the destination you choose.

7. Your controls

• Review source and contributor details for every visible claim.
• Report any claim; block a contributor; owners can remove members or close the circle.
• Open Settings & privacy → Delete my account for in-app deletion.
• Use our account-deletion page if you cannot open the app.
• Revoke camera or notification access in Android Settings.

8. Security and international processing

Traffic uses HTTPS; Firebase reads require authentication, circle membership, and enforced App Check; all shared writes pass through an App-Check-attested, ID-token-verified, rate-limited Worker; direct client writes are denied; photo access requires current circle membership; and logs avoid health content. Google, Cloudflare, and source providers may process data in countries outside yours under their safeguards.

9. Children and user-generated content

Tibuok is for adults coordinating family care and is not directed to children under 13. Every medicine claim is user-generated content even though there is no public feed or chat. Child sexual abuse and exploitation (CSAE), grooming, and exploitative material are prohibited. See our separate Child Safety Standards.

10. Changes and contact

Material changes will be posted here with a new effective date. Privacy or deletion questions: [email protected].