Data safety
Google Play asks every app to say what it collects, what it shares, and how it is kept safe. This page is that answer for the Vastra Android app, and it matches the Data safety form in our Play Console entry.
Data the app collects
| What | Collected | Shared | Why | Required |
|---|---|---|---|---|
| Email address | Yes | No | It is your sign-in. Account management. | Yes |
| Name | Yes | No | Shown in the app so you know whose session it is. | Yes |
| Password | Yes, at sign-in only | No | Checked against a one-way hash on our server. Never stored on the phone. | Yes |
| Your business records items, bills, purchases, payments, and the customers and suppliers you enter |
Held on our server for you | No | App functionality - this is the service. | Yes |
| Messages you send us | Only if you write to us | No | To answer you. | No |
Data the app does NOT collect
- No location, of any precision.
- No contacts, calendar, photos, files, SMS or call history.
- No camera or microphone.
- No device identifier, no advertising ID, no analytics of any kind.
- No health, fitness or payment-card information.
The app asks the phone for one permission: internet access. That is the whole list.
No third-party kits
The app contains no advertising network, no analytics kit and no crash-reporting kit. It is built without a single third-party library, so there is nobody else in it to send anything to. It talks to our server and to nothing else.
Security practices
- Encrypted in transit. Every call travels over HTTPS.
- Passwords are hashed, salted and one-way. We cannot read yours.
- The sign-in token expires by itself, is kept in the app's private storage which no other app can read, and is erased when you sign out.
- One database per shop. A request that does not carry your shop is refused, not sent somewhere by default.
Deletion
You can ask for your account and your data to be deleted: the account deletion page. It sets out what is removed, what the tax law obliges us to keep, and for how long.