1. Who we are
MopTally is provided by Omar Alkhatib, Karl-Imhoff-Weg 24, 30165 Hannover, Germany ("we", "us"). Email: kh249918@gmail.com. Further provider details are in the Impressum.
This policy covers the MopTally mobile app for iPhone and Android and the MopTally pages at i3oma.de/apps/moptally/. It is information about how data is handled. It is not a request for consent: the app does not ask you to agree to general data processing.
2. The short version
- MopTally has no account, no sign-up and no MopTally server. Your business records stay on your phone.
- We do not receive your clients, addresses, quotes, visits, invoices, payments or photos.
- Backups you export are encrypted with a password you choose. Visit photo files are never inside a backup.
- To check a Pro subscription, the app talks to the App Store or Google Play and to RevenueCat. They do not receive your business records.
- You can delete all business data in the app at any time.
3. Data stored on your phone
You may enter and store in the app: your business name, logo, contact details, rates and time zone; your clients' names, phone numbers, email addresses and property addresses; job and property notes; quotes, scheduled and repeating visits, invoices and payments you record; and before/after photos of visits.
This data is stored in the app's private storage on your phone. We have no access to it. MopTally does not process card payments; you mark invoices as paid yourself.
The app also stores on your phone: the number of free jobs used (0 to 3), the version and date on which you accepted the Terms of Use, the date and a fingerprint of your last confirmed backup, and a random key used to encrypt the recovery copies described in section 5. None of this is sent to us.
4. Your clients' data and photos
When you record your clients' details or photograph their property, you decide what is recorded and why. For that data you, as the cleaning business, are responsible under the data-protection law that applies to you, for example for having a legal basis, informing your clients where required, and deleting data you no longer need. We do not act as your processor because we never receive or access this data. Avoid photographing people or items that are not needed for the job.
5. Backups and recovery copies
Backups you export. A backup contains your business records and is encrypted on your phone with AES-256-GCM, using a key derived from your password (PBKDF2-HMAC-SHA256, 600,000 iterations, random salt). We never see the password and cannot recover it; without it a backup cannot be restored. The file goes only where you send or save it. Visit photo files are not included, so restoring on another phone does not bring photos back. Backups made by older versions of MopTally were not encrypted; the app can still import them and asks you to export a new encrypted backup.
Recovery copies. Before a restore replaces your data, the app saves a copy of the current data inside its private storage so the restore can be undone. These copies are encrypted with a random key kept in your phone's secure key storage (Keychain on iPhone, Keystore on Android) and are deleted when you delete business data.
Phone backups. MopTally excludes its data from iCloud and Google backups and from Android device-to-device transfer. Copies that your phone's backup made before this version are not removed by this change; you can manage them in your Apple or Google account. Use an exported backup to move or recover your data.
6. Reminders, camera and photo library
Visit reminders are scheduled by your phone's own notification system and contain the client name, time and address of the visit; nothing is sent to us. The camera and photo library are used only when you add a logo or visit photos. Photos picked or taken are copied into the app's private storage; temporary copies are cleared.
8. Subscriptions
Pro subscriptions are sold and billed by Apple (App Store) or Google (Google Play). We do not receive your payment card details.
To find out whether Pro is active, MopTally uses RevenueCat, Inc. (USA). The app sends RevenueCat a random app user ID created on your phone, your store purchase receipts and subscription status, and technical information such as app version, device model, operating system, store country and language. RevenueCat receives your IP address when the app connects. RevenueCat does not receive your business records. We see purchase and subscription status in RevenueCat to provide Pro, handle restores and answer support requests.
Legal basis: performance of the contract for Pro (Art. 6(1)(b) GDPR) and our legitimate interest in preventing misuse of subscriptions and fixing faults (Art. 6(1)(f) GDPR).
RevenueCat processes this data for us under a data-processing agreement. Data may be processed in the United States; the safeguard used for this transfer is [to be confirmed]. Purchase records are kept while needed to provide Pro and for as long as tax and commercial law requires.
Apple and Google process purchases as independent controllers under their own privacy policies.
9. Free jobs
The free allowance is counted on your phone only. MopTally does not use advertising IDs, device fingerprints or a server to enforce it.
10. Support and privacy requests by email
If you email us, we receive your email address, your message and anything you choose to include. We use it to answer you and keep it while needed for your request and any follow-up, and longer only where the law requires. Legal basis: Art. 6(1)(b) GDPR for questions about the app or a subscription, otherwise Art. 6(1)(f) GDPR (answering enquiries). Please do not send client data or backup files.
To help us find your subscription in RevenueCat, the app can add your random app user ID to a privacy or support email. This is optional; the app shows you the email before you send it.
11. Website
The MopTally pages at i3oma.de have no analytics, advertising pixels, contact form or tracking cookies, and load no third-party fonts or scripts.
When you open the pages, the web server processes technical data needed to deliver them securely, such as your IP address, the page requested, date and time, and browser information. Legal basis: our legitimate interest in providing a secure website (Art. 6(1)(f) GDPR). Details of the hosting provider and how long server logs are kept: [to be confirmed].
12. How long data is kept
Business data stays on your phone until you delete it, use Delete business data, or remove the app. Delete business data keeps only the free-job count, your terms acceptance record and the random key for recovery copies. It does not cancel a subscription and cannot delete files you exported or shared, data held by Apple, Google or RevenueCat, or earlier copies in your phone's own backups. Deleted data may remain in your phone's storage until it is overwritten; we cannot promise forensic erasure.
13. Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You may complain to a data protection authority, for example the one where you live or the authority for Lower Saxony, Germany (Die Landesbeauftragte für den Datenschutz Niedersachsen).
Because we do not hold your business records, you exercise your rights over them directly in the app: edit, export or delete them. For data held by us or RevenueCat on our behalf, email kh249918@gmail.com with the subject "MopTally privacy request". We may need to confirm that a request comes from you.
14. Security
Business data is kept in the app's private storage, protected by your phone's lock and encryption. Exported backups and recovery copies are encrypted as described above. Protect your phone with a passcode and keep backup passwords safe.
15. Children
MopTally is a business tool and is not directed at children.
16. Changes
We update this policy when the app or the law changes. The version and date at the top show the current text. We will point out material changes in the app.