Privacy Policy
This is the English version of the Arabic policy. Both say the same thing; if they ever differ, the Arabic version applies.
In short
What you record in Shirkati — products, customers, invoices, installments, cash boxes, suppliers, employees and attached photos — is stored in your company's account on our servers at Supabase in Frankfurt, Germany, with a copy on your device. We keep it to provide the service: so the app works offline and then syncs, so you find your company as it was on any new phone, and to manage your license. We do not sell your data, do not share it with third parties, show no ads, and use no analytics or tracking tools.
1. Who we are
This policy explains how the Shirkati Android app handles your data. It covers the app and this website.
| App | Shirkati (شركتي) — for Android (formerly “Moamalat”) |
|---|---|
| Developer and data controller | Rivora |
| hypercare.rivora@gmail.com | |
| Phone / WhatsApp | +20 100 089 7459 |
| Service location | Arab Republic of Egypt |
| Data storage | Supabase servers in Frankfurt, Germany (EU) |
2. Where to find this policy and deletion inside the app
In the app: Settings → “Privacy & account”, which contains:
- “Privacy policy” — opens this page;
- “Delete account and data” — opens the deletion page, with a “Request deletion by email” button below it that opens an email to us containing your company name and number.
The account and data deletion page also works in any browser, without installing the app or signing in.
3. How the app works
You sign in with Google and create a company with its name, phone, country and currency; a company code is generated automatically. After that:
- everything you record is saved on your device immediately, so you can work offline;
- when the device is online, what you recorded is uploaded to your company account on the server;
- the server holds the master copy: your company data is downloaded from it when you sign in on a new phone, and it tells the app your license status.
“This phone only” company (from version 2.1.0, when support enables it for your account): its business data stays on your device only and is not uploaded; the server keeps only the company name, its owner and its license. Its backups are on your device and, if you link Google Drive, in your own Drive. Converting it to a synced company is done through support; you can switch a synced company to this mode yourself in the app.
4. Data we store, and why
| Data | What it includes | Purpose | Required? |
|---|---|---|---|
| Account | Name, email and profile photo as sent by Google at sign-in, and an internal user ID. | App functionality · Account management | Required |
| Phone and address | Your company's phone and address, and your customers' phones and addresses. | App functionality | Optional |
| Precise location | A customer's location on the map, read only when you tap “My location” or set it yourself. | App functionality | Optional |
| Other financial info | Invoices, installments, collections; cash boxes and expenses; suppliers and their payments; employees' salaries, attendance and advances. | App functionality | Required |
| Photos | Photos of invoices, receipts, products and customers, and the company logo and stamp — only what you choose to attach, up to 5 MB per file. | App functionality | Optional |
| Device ID | An 8-character code derived by one-way hashing from the app-specific Android ID (the ID cannot be recovered from it), together with device model, app version and last-seen time. | Security and fraud prevention · App functionality | Required |
Your business records also include product names, prices and stock, your notes and ratings for customers, and a log of each operation (who recorded it, when, and from which device) — so you know who did what, and amounts are protected from duplication and error.
Who can see your company's data
Server rules restrict reading and writing each company's data to its members. Data is encrypted in transit (HTTPS), but it is not encrypted on the server with a key only you hold, so we — as the service operator — can technically access it. We do so only to provide support you request, to fix a fault, or when required by law.
5. What we do not collect or do
- We do not share your data with third parties and do not sell it. Supabase is a service provider that stores it on our behalf only.
- No analytics, no advertising, no crash reports sent to anyone.
- We do not upload or store your contacts. When you add a customer “from contacts”, the app asks for permission to read them so you can search them on your phone; the list stays in memory during the search only, and only the name and number you pick are saved for the customer. You may refuse and use Android's picker or type the number.
- No audio recordings, and no background location tracking.
6. Notifications
All notifications are generated on your device: reminders for due installments, a reminder for a customer visit you schedule, alerts when an operation is rejected during sync or attachment storage is nearly full, and a prompt to confirm a new suggested US dollar rate. We use no external push service. To turn them all off, disable the app's notification permission in your phone settings.
7. Device permissions
| Permission | Why |
|---|---|
| Internet | Sync, sign-in, license check and map display. |
| Location | On request only: when you tap “My location” to set a customer's location. Never read in the background. |
| Biometrics / device lock | To lock the app if you turn this on yourself — it is off by default. Android performs the check; your fingerprint never reaches the app or us. |
| Notifications | For the alerts in section 6. |
| Contacts | On request only: when you add a customer “from contacts”, to search them on your phone (section 5). Never uploaded or stored. |
| Camera | The app does not request camera permission; photos are taken or chosen through the system picker. |
| Microphone | Not requested in this version. |
8. External services
- Supabase — the server provider that stores your company data and files, in Frankfurt, Germany.
- Google Sign-In — we receive only your name, email and profile photo; the app requests no access to Gmail.
- Google Drive — only if you turn on backup to it: the
drive.filescope alone, so the app sees only the files it created, not the rest of your Drive. - Google Play — to check for a newer version, directly between your device and the store.
- OpenStreetMap and Esri maps — they receive your IP address and the area shown only, nothing about your customers.
- WhatsApp and share targets — only when you choose to share an invoice, statement or reminder; that app's policy then applies.
- Exchange rate — fetched by our server from
open.er-api.com; your device never contacts it and nothing about you is sent.
9. Data security
- All traffic between the app and the server is encrypted with HTTPS.
- Your session key is kept in Android's secure keystore.
- Server rules restrict each company's data to its members.
- Android's automatic backup to Google is disabled on purpose, so an old copy is never restored without your knowledge.
- No system is flawless; if we learn of an incident affecting your data, we will notify you.
10. Retention
- Company data and files: on the server while the company account exists.
- Records you delete in the app: move to “Deleted” so they can be restored, and are erased permanently with the company account or on your request.
- The copy on your device: removed when you uninstall the app — this does not delete your company account on the server.
- “This phone only” company: its data lives only on your device and your backups; uninstalling without a backup loses it, and we cannot restore it from the server.
- After a deletion request: our support team deletes all of the above within 30 days, as described on the deletion page.
- Backups: Backup copies of deleted data may remain for up to 30 days, then are deleted automatically.
11. Your rights
- Access and export: your data is visible in the app; reports and statements export to CSV and PDF.
- Correction: in the app, or by contacting us.
- Deletion: all or part — see Account and data deletion.
If you are a customer or employee of a business using the app
The business enters your data and is responsible for it; we store it on its behalf. Please ask the business first to access, correct or delete it; if that fails, contact us and we will reach out to them.
12. Children
The app is intended for business owners, not children. We do not knowingly collect data from anyone under 13, and we delete such data when we learn of it.
13. Changes
We update this policy whenever what the app does with data changes; the date at the top shows the latest update. Material changes are announced inside the app.
14. Contact
For any privacy question: hypercare.rivora@gmail.com. See also the Terms of Use.