Privacy Policy

Effective 14 August 2026 · Applies to the Bunyad Android app (com.bunyad.expense) and to bunyadapp.com

Bunyad is a construction expense book. You record what your building costs, stage by stage, with the bill photographed and attached. This page explains exactly what that records about you, who else can see it, and how to get rid of it.

Bunyad is operated by Bunyad. For anything on this page, write to bunyadservice@gmail.com.

What Bunyad records

Your account

• Your name and email address, which you supply when you register or when an administrator issues you an account.
• Your password, stored only as a bcrypt hash. The password itself is never written down and cannot be read back, by us or by anyone else.
• Whether the account is an administrator, whether it is active, and the times it was created, last changed, and last signed in.

What you enter about your build

• Projects — the name, the location as you type it (for example "Lahore" or "DHA Phase 6"), the plot size, the start date and the currency.
• Stages and expenses — what was bought, the quantity and weight, the amount, the date, any notes, and which stage and heading it falls under.
• Vendor details you choose to type — a supplier's name and contact number, where you record one. Please note this may be another person's information; only enter what you are entitled to record.
• Who logged what — each entry carries the name of the account that created it and the account that last changed it, so a shared project's book can be read.

Photographs

When you photograph a bill or a delivery slip, or pick an existing picture, that image is uploaded and stored against the expense, along with its filename, format, dimensions, and which account uploaded it and when. A smaller thumbnail is generated for the timeline. Images are downscaled on the server before storage.

The app asks for the camera and photo picker only at the moment you attach a picture. It does not read your photo library in the background and does not scan or index it.

What Bunyad does not record

• No GPS or device location. The "location" on a project is a line of text you type — the app never asks the device where it is.
• No contacts, no calendar, no microphone, no SMS, no call logs.
• No advertising identifier, no device fingerprint, no analytics or crash-reporting SDK.
• No payment details. Bunyad records what you say you spent; it does not process money.

Why it is recorded

Every item above exists to run the feature you are using — keeping your books, showing your totals, letting the people you invited read the same project, and signing you in. None of it is used for advertising, profiling, or any purpose beyond operating the app for you.

Who else can see it

• People you invite. When you share a project, the person you name can see that project's stages, expenses, vendor details and photographs, as a viewer or an editor. You choose who, and you can remove them at any time.
• The administrator of this installation. An administrator can see the list of accounts and can read projects for oversight. They cannot read your password, which does not exist in readable form.
• Nobody else. Your data is not sold, rented, shared with advertisers or data brokers, or passed to any third party. There are no third-party SDKs in the app.

Bunyad may disclose data where a law that applies to it genuinely requires disclosure.

Where it is kept, and how it is protected

• Your data is held in the MongoDB database of the Bunyad server this app connects to, run by the operator named above. It is not copied to any other service.
• Traffic between the app and the server is encrypted with HTTPS. The released Android app is built to refuse plain unencrypted connections.
• Passwords are stored as bcrypt hashes with a work factor of 12.
• The sign-in token on your phone is kept in Android's EncryptedSharedPreferences (or the Keychain on iOS), never in ordinary app storage.

No system is perfectly secure, and we do not claim otherwise.

How long it is kept

• Your account and its records are kept for as long as the account exists.
• A photograph you upload but never attach to an expense is swept away automatically after 24 hours.
• When you delete your account, deletion happens immediately — see below.

A phone stays signed in for up to two years unless you sign out; a browser session lasts about twelve hours.

Deleting your account and your data

You can do this yourself, from inside the app: Account → Delete account, then type delete to confirm. It takes effect at once and cannot be undone.

What is removed:

• Your account record, including your name, email and password hash.
• Every project you own, with all of its stages, expense headings, expenses and every photograph attached to them.
• Your seat on any project somebody else shared with you.

What is kept, and why: if you added an expense or a photograph to somebody else's project, that entry stays, because it is part of that owner's accounts and removing it would tear a hole in a book that is not yours to change. Your name is unstamped from it — it shows as "Deleted user" afterwards.

If you cannot reach the app, write to bunyadservice@gmail.com from the address on the account and ask for it to be deleted. See Deleting your account for the full detail.

Your rights

You may ask what is held about you, ask for it to be corrected, or ask for it to be erased. Most of this you can do in the app directly — your name and password under Account, your projects and expenses wherever they appear. For anything else, write to bunyadservice@gmail.com and we will respond within 30 days.

Children

Bunyad is a tool for people managing building work. It is not directed at children, and we do not knowingly collect anything from a child under 13. If you believe a child has an account here, write to us and it will be removed.

Changes to this policy

If this policy changes, the effective date at the top changes with it, and the current version always lives at this address. A change that materially affects what is collected or who can see it will be announced in the app.

Contact

Bunyad — bunyadservice@gmail.com