SUMX Privacy Policy

This policy explains what the SUMX Android app stores, what it sends over the internet, and what it does not collect. It describes how the app is actually built, and every statement below has been checked against the app’s source code.

SUMX is published by X Made, a trading name of Cineworx Ltd, based in the United Kingdom. Cineworx Ltd is the organisation responsible for the app and for this policy. The Android package name is dev.xmade.sumx.

About SUMX

SUMX is a calculator and everyday utility toolkit for Android. It provides standard and scientific calculations, a saved calculation history with favourites, percentage, margin, markup, VAT and discount tools, unit conversion and currency conversion.

SUMX has no user accounts and no sign-in, and there is no SUMX cloud service or synchronisation. No server of ours receives your calculations, your history or your settings. X Made does operate one small service, used solely to confirm with Google Play that a SUMX Pro purchase is genuine; it is described in Purchase verification below. The app contains no advertising, no subscription, no artificial intelligence features, and no analytics or tracking software of any kind.

SUMX is free to download. An optional upgrade, SUMX Pro, unlocks the advanced tools for a single payment rather than a recurring charge. The purchase itself is handled by Google Play: X Made does not see, receive or store your payment details, and no account with us is created. The app then confirms the purchase through our verification service before unlocking Pro, and records only whether the upgrade has been verified.

Information SUMX stores on the device

SUMX saves the following to your device’s own app storage, using Android’s standard preferences system. This information is written by the app for the app’s own use:

Calculations and expressions — the expression you entered and the result produced
Calculation history — recent entries, each with its expression, result, category and the time it was created
Favourites — a marker on a history entry that you have starred
Theme and accent preferences — your light, dark or system setting and your chosen accent colour
Scientific mode and angle mode preferences — whether scientific mode is on, and whether angles are in degrees, radians or grad
Haptic and key-sound preferences — whether key vibration and key sounds are switched on
Cached currency rates — the last exchange rate retrieved for a currency pair, with the rate’s published date and the time it was retrieved
Your SUMX Pro status — whether the Pro upgrade has been verified, and when it was last checked. This is a record of the entitlement only; it contains no payment details

SUMX Free keeps the 20 most recent history entries, and SUMX Pro keeps up to 1,000. When you add a calculation beyond the limit that applies to you, the oldest entry is discarded automatically.

None of this is sent to X Made. Our verification service handles purchase tokens only and has no route to reach any of it, so we have no way to read it. Please read Android backup and device transfer below, which explains the one route by which this information can leave your device.

SUMX also reads your clipboard when — and only when — you tap the paste control, and writes to your clipboard when you tap copy. This happens in response to your action, and the app does not monitor the clipboard at any other time.

When SUMX uses the internet

SUMX makes network requests for two purposes only, both described in full below:

Currency rates — when the Currency Converter needs an exchange rate it does not already hold
Purchase verification — when you buy or restore SUMX Pro

Nothing else in the app contacts the network. The calculator, the other tools, your history, your settings and unit conversion all work entirely on your device.

Currency-rate network requests

When SUMX needs a rate it does not already have, it makes a single request to Frankfurter, a public exchange-rate service published from European Central Bank reference data, at api.frankfurter.app.

The request contains only the two three-letter currency codes being converted, for example GBP and EUR. That is the entire content of the request. Specifically:

The request is made only to retrieve reference currency rates
Your calculation history is not sent to Frankfurter
No amounts you have typed are sent — the conversion itself is calculated on your device once the rate arrives
SUMX does not add an account identifier, advertising identifier, Android device identifier or personal profile to the request

As with every internet connection, the destination service can see normal connection information such as the requesting IP address. This is inherent to how internet connections work rather than something SUMX adds, but we mention it so the position is clear.

SUMX does not contact the network every time you convert. A rate that has already been saved is reused for 24 hours without any request being made. A request happens only when no saved rate exists for that pair or the saved rate is more than 24 hours old. Converting a currency to itself makes no request at all.

Retrieved rates are cached on your device so conversion still works offline. If a refresh fails — for example when you have no connection — SUMX falls back to the last rate it saved and indicates that the rate may be out of date.

Exchange rates in SUMX are indicative reference rates. They are not live trading prices, and they should not be relied upon for trading, settlement or any decision requiring a real-time market rate.

Purchase verification

Buying or restoring SUMX Pro is the only other thing in SUMX that uses the internet. It happens only when you tap to buy or to restore a purchase; ordinary use of the app never triggers it.

The flow has four steps:

Google Play processes the payment and issues a purchase token.
SUMX sends that token, with limited transaction information, to an X Made verification service hosted on Google Cloud.
The service asks the Google Play Developer API whether the purchase is valid.
Only on a positive response does SUMX unlock Pro and acknowledge the purchase.

This step exists to confirm that a Pro entitlement is genuine. Verifying against Google rather than trusting the device is what stops the upgrade being unlocked by a forged or replayed receipt.

The request to our service contains:

The Google Play purchase token
The product identifier and the Android package identifier
The purchase or order identifier, where Google Play provides one
The transaction date, where Google Play provides one
Whether the request is a purchase or a restoration
Ordinary network and operational request metadata, such as the requesting IP address, processed by Google Cloud as the host

X Made does not receive your payment card details, your Google password, or your full Google account information. Google Play handles the payment itself; we only ask Google whether the resulting token is valid.

The verification service is stateless. It keeps no user accounts and no database of purchases, and it stores nothing that would let us build a record of who bought SUMX Pro. Raw purchase tokens are not written to application logs. Operational logs hold a shortened one-way hash of the token, request identifiers, the category of the result and timing information — enough to diagnose a failed purchase, and not enough to identify you.

Your calculations, history, favourites and settings are never part of this request. As with the currency-rate request, it is made over an encrypted HTTPS connection.

Because verification runs against Google Play, buying or restoring SUMX Pro needs a working internet connection. Once Pro is verified, the app records only that the entitlement is active and when it was last checked.

Information SUMX does not collect

SUMX does not collect, request or transmit any of the following:

Names, email addresses, phone numbers or postal addresses
User accounts, passwords or sign-in details of any kind
Contacts, calendar, photos, files, microphone or camera data
Device identifiers, advertising identifiers or a device fingerprint
Analytics, usage statistics, crash telemetry or behavioural data
Payment card numbers, bank details or other financial account details

The one thing that does leave your device besides a currency code is a Google Play purchase token, and only when you buy or restore SUMX Pro. A purchase token identifies a transaction so Google can confirm it is genuine; it is not a payment instrument and cannot be used to charge you. See Purchase verification above.

SUMX does not request or access GPS, precise location or Android location permissions. When the Currency Converter contacts Frankfurter, or the app contacts our verification service, the requesting IP address is necessarily visible to that service and its network provider and may give an approximate indication of location.

SUMX requests a single Android permission, INTERNET, which it uses for the currency-rate and purchase-verification requests described above. It asks for no runtime permissions and no sensitive permissions.

We do not sell personal information, and we do not share it with third parties for advertising or marketing. There is no personal information collected through the app for us to sell or share.

Android backup and device transfer

SUMX stores calculations, history, favourites, settings and cached currency rates locally in the app’s private storage. This information is explicitly excluded from Android cloud backup.

On Android 12 and later, if you use Android’s device-to-device transfer while setting up a new device, Android may transfer SUMX’s locally stored information directly to that device. This transfer is initiated and controlled by you through Android. X Made does not receive, process or have access to the transferred information.

Older Android backup rules exclude SUMX preferences from both cloud backup and backup-based restoration. Device-transfer behaviour may additionally depend on the Android version and device manufacturer.

Third-party services

SUMX relies on the following services outside the app itself:

Frankfurter (api.frankfurter.app), which publishes reference exchange rates. It is contacted only as described in the currency-rate section above, and receives only the currency codes for the conversion. Frankfurter is operated independently of X Made and handles requests under its own terms and privacy practices.
Google Play, which processes the purchase of SUMX Pro and holds the payment relationship with you under Google’s own terms and privacy policy.
The Google Play Developer API, which our verification service queries to confirm that a purchase token is genuine.
Google Cloud, which hosts the X Made verification service. As the host, Google Cloud processes the ordinary network and operational metadata that any hosted request involves.

Android’s device-to-device transfer facility is provided as part of the operating system and is used only when you choose to transfer information to a new device.

Beyond these, SUMX includes no third-party analytics, advertising, attribution, crash-reporting or marketing software. The app is built with Flutter, and the external code libraries it uses are limited to the standard Android preferences plugin, which stores data on your device and sends nothing anywhere, and Google’s Play Billing integration, which is what makes the purchase of SUMX Pro possible.

Data retention and deletion

Because SUMX stores information on your device rather than on a server, you control how long it is kept. What SUMX has saved remains on the device until you remove it. You can do so in these ways:

Delete an individual history entry — removes that single calculation from the history screen
Clear your history — removes every history entry at once. Because a favourite is a marker on a history entry, clearing your history also removes your favourites
Clear SUMX app data — in Android Settings, under Apps, removes everything SUMX has saved, including history, favourites, your preferences and any cached currency rates
Uninstall SUMX — removes the app and the data it has stored on that device

Two points worth noting. Clearing your history removes history and favourites, but does not reset your theme, accent, scientific-mode, angle, haptic or key-sound preferences, and does not remove cached currency rates; clearing the app’s data or uninstalling removes those as well. If SUMX information has previously been transferred to another device, deleting it from the original device does not delete the separate copy on the other device. It must be removed from each device independently.

We hold no copy of any of this, so there is nothing for you to request deletion of from us. If you contact us with a question, we keep that correspondence only as long as we need it to deal with your enquiry.

The one thing we hold at all is the operational logging described under Purchase verification: a shortened one-way hash of a purchase token, request identifiers, result categories and timing. There is no purchase database and no user record behind it, and a hashed token cannot be turned back into the original. These logs are retained on Google Cloud for a limited operational period and then deleted automatically.

Security

Information SUMX saves is held in the app’s private storage area, which Android isolates from other apps as part of the operating system’s standard app sandbox. Its protection therefore depends on your device’s own security, such as your screen lock and whether the device is encrypted, both of which are managed by Android rather than by SUMX.

Both the currency-rate request and the purchase-verification request are made over encrypted HTTPS connections.

SUMX holds no accounts and no passwords, so there are no credentials in the app to be lost or stolen. We make no claim to any security certification, and no method of storage or transmission can be guaranteed completely secure.

Children’s privacy

SUMX is a general-purpose calculator intended for a general audience. It is not directed at children, and it contains no advertising, no social features and no content aimed at children.

SUMX does not knowingly collect personal information from anyone, children included, because it does not collect personal information at all. If you believe a child has provided us with personal information through correspondence, please contact us and we will delete it.

International users

X Made is based in the United Kingdom, and SUMX is available to users in other countries. The app stores its information on your own device, so ordinary use does not involve us transferring your personal information internationally.

There are two exceptions, both described above:

The currency-rate request, which goes to Frankfurter and travels to wherever that service is hosted. It contains only currency codes, together with the technical information such as an IP address that any internet request necessarily involves.
The purchase-verification request, which goes to our service on Google Cloud and on to the Google Play Developer API. Google may process it in a country other than your own, under its own terms for that infrastructure.

Changes to this policy

We will update this page when SUMX changes in a way that affects what it stores or sends. When we do, we will revise the effective date at the end of this page. Significant changes will also be noted on the SUMX product page.

This policy describes the current released version of SUMX. Earlier or later versions of the app may behave differently, and this page always describes the current one.

Contact

If you have a question about privacy in SUMX, or a request about your information, email us at hello@xmade.dev. You can also use the contact form and choose “Privacy / data request”.

Postal enquiries can be addressed to Cineworx Ltd in the United Kingdom; please email first so we can reply promptly.

Effective date

This policy is effective from 27 August 2026. It was updated on that date to describe purchase verification, which was not set out in the previous version.

This policy covers the SUMX Android app. For how the xmade.dev website itself handles data, see the website privacy page.