Privacy Policy

1. Controller and scope

The developer of the app and support service is Egor Bazhukov. For privacy questions, contact sashays.sacred.5o@icloud.com. This Policy applies to the iPhone, iPad and Mac app, this static website, and the official Telegram support bot.

2. App data and purposes

The app processes only information that you enter or choose: properties and addresses, organizations, meters and readings, payments, categories, notes, your chosen display name, settings, and receipt or meter-document images and PDFs. It is used solely to provide accounting, calculations, display, backups, optional synchronization, and sharing that you request.

We do not sell data or use it for advertising, profiling, or model training. Processing is necessary to provide the features you request; optional iCloud synchronization, sharing, and support begin only through your actions.

3. Local storage, iCloud, and backups

By default, data remains in the app’s local storage on your device. If you enable iCloud Sync, records and operational cryptographic public identifiers synchronize through Apple CloudKit; coordination settings may use iCloud Key-Value Store. We do not copy the contents of your private CloudKit storage to a developer-operated server.

Backups are created in the app’s local folder and, when available, in your iCloud Drive folder. The app retains up to five recent copies. Password encryption for backups is a separate opt-in option: an unencrypted backup can contain readable app data and attachments. Turning off synchronization stops future syncing but does not itself erase copies already stored in iCloud.

4. Sharing and attachment protection

Only a property owner can create a share through Apple’s system interface. Invited participants can see the property data permitted by the sharing rules and the author name for added readings or payments. The owner can revoke access at any time.

CloudKit-synced receipt content is protected in the app so that the property owner and the author of that payment can decrypt it. Other payment metadata, such as amount, date, category, author, and the existence of an attachment, can be visible to participants in a shared property. Meter passports and meter documents are owner-only media; their bytes are not provided to participants. New protected attachments are encrypted before upload; older attachments migrate gradually, so a legacy copy can temporarily remain in CloudKit under Apple’s protections during the compatibility rollout.

5. Permissions and device data

Camera, photo library, and files are used only after an action you choose, such as scanning, importing, or attaching a document. Text and QR recognition use Apple frameworks on the device. Face ID, Touch ID, and device passcode are used by the system only to confirm unlocking; biometric templates are never provided to the app.

Reminders are local notifications. CloudKit may use Apple push notifications to refresh synchronization. The app contacts the Apple App Store to check for updates. We do not request address-book or location access, or use advertising tracking or analytics. Neighbors requests the separate system permissions described below when needed.

6. Website and Telegram support

The website code does not set cookies and contains no forms, advertising, analytics, or tracking pixels; it only reads the browser language locally to choose a language. Hosting infrastructure may process ordinary technical request logs needed to deliver and secure the site.

Opening @kommunalka_help_bot is optional and does not automatically send it app data. If you message the bot, it receives your Telegram ID, name and username, selected language, message text, and files you send. The developer uses this only to answer, maintain the support conversation and, if you separately opt in, send app-update news. You can unsubscribe from news in the bot.

7. Recipients

Apple processes iCloud, iCloud Drive, Keychain, notifications, and App Store data under its own policy. People you choose to invite receive access according to your share. Telegram processes support interactions under its own policy. We do not disclose data to advertising networks, data brokers, or other bots. Disclosure may occur only when legally required.

8. Retention, deletion, and your choices

Local data remains until you delete it in the app or remove the app. iCloud and iCloud Drive data remains in your Apple Account until you delete the relevant objects, backups, or app data in iCloud settings. Deleting an object while sync is enabled is sent to CloudKit; stopping a share revokes participant access.

Server-downloaded support files are deleted within 7 days. Support history, profile data, and subscription choice remain until you use /delete_my_data or email us. After confirmation, that command is completed after 24 hours; database backups rotate and can retain the previous record for up to 14 days. Deletion from our service does not remove copies that Telegram retains in your chat under its own rules.

You may request access, correction, restriction, objection, or deletion by email. To protect against unauthorized requests, we may ask you to verify that the request comes from the owner of the relevant account or support conversation.

9. Children, changes, and contact

The service is not intended for independent use by children below the age set in their country. We may update this Policy when features or requirements change; the new version applies from its publication date. For any data question, write to sashays.sacred.5o@icloud.com.

10. Neighbors chat

Neighbors is an isolated module: it does not receive property, payment or main-app profile data. Chat keys are created on the device and you choose a separate nickname. Other participants see your nickname, public identifiers and messages you send. No phone number or registration is required. Bluetooth enables nearby connections; the microphone records voice messages, the camera scans QR codes, and photos or files provide chosen attachments. Notifications are optional.

The nearby group chat is public to network participants. Private conversations use end-to-end encryption; intermediaries do not receive their plaintext. Devices may forward packets over Bluetooth. Photos and voice messages currently use Bluetooth. Encryption cannot prevent a recipient from saving or sharing what they receive.

Internet connectivity is optional. The relay temporarily stores encrypted private envelopes for delivery, not a permanent conversation archive. Normally retention is limited to about 48 hours 22 minutes after receipt; cleanup failures can extend physical storage. The relay sees connection IP addresses and outer event metadata (keys, tags, time), but cannot decrypt private text. Infrastructure logs may include IP addresses; immediate physical erasure and the absence of hosting-provider copies cannot be guaranteed.

Private history, including author test conversations, and attachments stay locally until manually deleted. Chat storage is separate from accounting iCloud sync and backups. The storage limit restricts new writes rather than automatically deleting old history. The public feed is ephemeral. Technical identifiers prevent redeliveries appearing as new messages. Deleting a chat or resetting your identity does not erase recipients’ copies or unexpired relay envelopes.

If you write to “Test (author)”, the developer receives the text, nickname and public identifier you send as the recipient, to test connectivity and reply. This is voluntary contact, not automatic submission of app data. To request deletion on the author’s device, use that chat or the email in this policy.

In versions with gateway support, helping others through the internet requires separate consent and uses data and battery. A gateway forwards encrypted envelopes between Bluetooth and the relay. You can turn off internet connectivity, gateway help, notifications and Bluetooth in chat settings. We do not use conversations for advertising, profiling or model training.