Safehoster Intranet ("the app") is published by Safehoster ("we"). It is the mobile client of an intranet that an organization runs on its own server. This policy says what the app does with information. Your organization's own privacy notice covers what its server does with your information.
Who is responsible
Your organization decides what its intranet holds and who may see it; it is responsible for that data. We are responsible for the app itself. When we host an organization's intranet, we process its data only on its instructions.
What the app sends, and to whom
The app talks to the server address you enter, and to nothing else of ours. It sends:
- what you sign in with, through your organization's sign-in page, which the app opens in your browser. The app never sees your password;
- the documents, tasks, calendar entries, comments and tags you open, create or change;
- pages you photograph with the camera and PDFs you pick, only when you register or deliver a document;
- if you allow notifications, your phone's push token, platform and model.
On servers that send a "new sign-in" e-mail, the app also sends your phone's maker, model and system version and the app version; the server adds your IP address and the approximate place it comes from. All of it travels encrypted (HTTPS).
What stays on your phone
Your sign-in tokens, kept in the phone's secure storage. Copies of documents you open, in the app's temporary folder, which the system may empty at any time. Face ID, Touch ID and your passcode are checked by the phone itself; the app only receives yes or no.
What the app does not do
No advertising, no analytics, no tracking, no selling or sharing of your data. It does not read your contacts, location, photo library or other apps.
Service providers
Notifications go from the server through Expo's push service to Apple or Google, which deliver them to your phone; they carry a short notice, and documents marked confidential show only their code. App updates are downloaded from Expo. Servers we connect through our gateway pass through Cloudflare. If your organization signs you in with Microsoft accounts, that sign-in is Microsoft's. Each of these handles the data only to provide its service.
How long
Your organization keeps its intranet data for as long as its own rules say. A phone's push token is deleted when you sign out, or when Apple or Google report it is no longer valid. Copies on your phone go when the system clears the temporary folder or when you delete the app.
Accounts
Accounts are created by your organization, not in the app. To close an account or delete its data, ask your organization.
Your rights
You may ask for access to, correction or deletion of your data, or object to its use. Ask your organization first: it holds your account and its data. You can also write to us at intranet at safehoster dot com, and you may complain to your data protection authority (in Austria, the Datenschutzbehörde).
Children
The app is a work tool for organizations and is not meant for children.
Changes
We publish any change to this policy at this address, with a new date.
Contact
Safehoster, intranet at safehoster dot com