Privacy policy

1. In short — two completely different modes

TOFA has two modes, and the difference between them is not a detail: in the first, nothing reaches us at all; in the second, your business data reaches us because you asked to sync it. Everything that follows in this policy branches from this difference.

	Without an account — the free mode	With a cloud account
Where your data is stored	On your device only	On your device and on the TOFA server
What reaches us	Nothing	Your email, your identifiers and your synced business data
Does it need the internet	No — it works fully without a connection	Only for sync; it works without a connection, then syncs when the connection is back
How to delete everything	Delete the app from your device	From inside the app or from the account deletion page

The app sends none of your data until you sign in yourself. As long as you have not created a cloud account, nothing from you reaches us, apart from the check for a newer version (§3.1), a request that carries no data, and your data does not exist with us.

2. Who we are

TOFA is a sales and inventory management app, developed and operated by The Iraqi Pro. We are the party responsible for the data described in this policy.

To contact us about your privacy: tofa.smart.app@gmail.com · WhatsApp · contact page

3. What we collect — and what we do not

3.1 In the free mode without an account: nothing

We collect no data. Your data stays in your device’s storage, and the app does not send it to any server — not to us and not to anyone else. You can use the app fully in airplane mode.

The app checks for a newer version at most once a day, with a request that carries no data about you or your business.

3.2 When you create a cloud account

Sign-in is with a Google account or an Apple account. We then receive:

Your email address and your display name as they appear in your Google or Apple account.
Your Firebase account identifier — an internal string we use to link your account with us.
The link to your profile picture, if your account has a picture. We store the link to show your picture inside the app — this is an item many people do not expect, so we state it explicitly.
Your device information: the operating system type (Android/iOS), the device model, the system version, and the app version.
A device identifier generated by the app itself — a random number created on first launch and stored locally. It is not the manufacturer’s device number and not an advertising identifier, it cannot be linked to you outside TOFA, and it disappears when the app is deleted.
The date last seen and the date of the last sync for each device linked to your account.

3.3 Your synced business data

When sync is turned on, seven types of records are uploaded and nothing else:

Sales invoices · items and stock · customers
Receipt and payment vouchers · stock movements · purchase invoices · sales returns

Each record is uploaded with its full text as you entered it. Stored with each record is which device and which user created or edited it, and when — so that sync works across your devices and each business owner knows who issued each invoice.

3.4 Activity log

We keep the history of changes to your records, not only their latest state. When an invoice or any record is edited, we store its version before the edit and its version after it, along with who edited it, on which device and when. The purpose: so that the business owner can know what happened to their data, and so that we can restore a record that was edited by mistake. We state this explicitly because it goes further than a reader usually expects. The retention period is in §7.

3.5 When you request a subscription

We receive the WhatsApp number you write, your business name if you write it, the payment method you chose, and your message if you attach one — so we can contact you and activate your subscription. We do not ask for or receive any bank card data, and payment does not go through the app.

3.6 When you send a request from the account deletion page

We receive what you write in the form (email, phone and note), and the IP address the request was sent from is recorded only to prevent abuse and misuse of the form. Nothing else.

3.7 What we never collect

Your geographic location — the app does not request location permission and does not read it.
Your contacts — we do not read your phone book.
Your files outside the app — except a file you choose yourself to import or export.
No ads, no tracking tools, and no behavior analytics. There is no ads, analytics or crash-tracking package in the app.
No card or bank account data.

4. Your own customers’ data

This section concerns the business owners who use TOFA. When you add a customer to the app, you enter their name, phone number and address, and you may enter their data within invoices and vouchers. If sync is turned on, this data is uploaded to our servers along with the rest of your records.

These are third parties who have not dealt with us and have not agreed to anything with us. You are the one who collected their data in the course of your business, and you control it and are responsible for it.

This is why we commit to the following, and ask the following of you:

We store it on your behalf and by your instruction alone. We access it only as much as needed to run the service or for a support request you make.
We do not use it for any other purpose — we do not message your customers, we do not analyze their data, and we do not sell or rent it to anyone.
It is your responsibility to comply with what the law in your country requires toward your customers: to enter only the data your business truly needs, and to inform them when required that you keep their data.
Deleting your cloud account deletes it from our servers as part of what is deleted — see §8.

5. Why we collect each item

Item	Its purpose
Email, name and Firebase identifier	Recognizing your account when you sign in, linking your data to you, and contacting you about your subscription
Profile picture link	Showing your picture inside the app, nothing else
Device identifier, model and system	Linking the session to a specific device, applying the device limit, and letting you disconnect a device you lost
App version	More accurate technical support, and knowing data compatibility between versions
Your synced business data	Showing it on all your devices, and restoring it if you lose your device
Activity log	Letting you know who changed what, and restoring a record that was edited by mistake
WhatsApp number and subscription request data	Contacting you to activate and follow up on the subscription
IP address in the account deletion form	Preventing abuse and misuse of the form — nothing else

6. Who we share it with

Google — the Firebase Authentication service. We use it to verify your identity when you sign in. It receives your email and your account identifier, and it is what confirms to us that you are you. We use no other Firebase product.
Apple — for those who choose “Sign in with Apple” on iPhone or iPad, and only to the extent that service alone requires.
The TOFA server — where your synced data is stored.

And no one else. No ad networks, no analytics companies, and no data brokers. We do not sell, rent or share your data for marketing purposes — neither your data nor your customers’ data. And we do not disclose it to any other party unless the law obliges us to.

7. How long data is kept

Item	Retention period
Your synced business data	As long as your account exists — and it is deleted when the account is deleted
Daily snapshots (automatic copies for restore by date)	The last 7 snapshots for each account
Pre-restore snapshots (a safety copy before a restore)	The last 5 for each account
Activity log	90 days, with a maximum of 5000 operations for each account
A deletion request sent from the website	Deleted 180 days after the request is closed, with a maximum of 365 days if it stays pending — and deleted immediately if the account is deleted where one of its users’ email matches the email written in it
After your account deletion is carried out	Nothing in our database: all the account’s data is deleted, and we keep no record of it — nor of the deletion request itself
Full backups of the server database (for emergencies)	Deleted after 7 days, except the latest backup if the daily backup stops working: it remains until a newer backup is taken, and your data may remain in it until then
Your sign-in record at Firebase (the Google or Apple account you signed in with)	Not deleted today when your account with us is deleted — we do not promise to delete it. And it returns none of your deleted data to us
Grace period to cancel an account deletion request	7 days during which the account stays disabled with all its data intact, then the request becomes eligible to be carried out. Deletion only happens when our team carries it out: the account is permanently deleted after a grace period of 7 days — or before it if you asked for immediate deletion. And signing in cancels the request as long as it has not been carried out — even after the 7 days

The data on your device is not subject to any of these periods: it is with you, and it stays as long as the app stays on your device.

8. Your rights and how to delete your data

Access: your data is always with you in the app, and you can export it to a file at any time.
Correction: you edit any record directly from inside the app.
Objection and restriction: you stop sync whenever you like, and the app goes back to working locally alone.
Deletion: through the two paths below.

First path — from inside the app (for the account owner)

On the subscription status screen inside the app you will find the Delete account option. After you send the request, your cloud account is disabled immediately and a grace period of 7 days begins, with all your data intact during it. And deletion does not happen automatically when it ends: our team carries it out, and your account is permanently deleted after it — or before it if you asked for immediate deletion, and signing in before it is carried out cancels the request — even after the 7 days. (Your account’s sellers are deleted as soon as the request is made and do not come back if it is cancelled.)

After it is carried out, all your account’s data is deleted from our database and we keep no record of it, except what remains in the server backups until they are deleted (§7). And you can come back with the same email whenever you like with a new, empty account that carries nothing from the previous one.

Second path — from the website (for those who cannot sign in)

Use the account and data deletion page. A request sent from it is reviewed by our team, who verify that you own the account before anything is carried out — because an email and a phone number alone are not proof of identity.

And neither path touches the data on your device. It is on your phone only, and the app keeps working with it offline. To delete it, delete the app from your device.

The full details of what is deleted and what remains are on the account deletion page.

9. Data security

The connection is encrypted between the app and our servers (HTTPS) on every request.
Your session is tied to a specific device: each device has its own sign-in token, and disconnecting the device revokes its token immediately so it can no longer reach your data.
Strict isolation for each account: every query is limited to your account, so no account sees another’s data.
A limit on the number of devices linked to the account, which you control by disconnecting any device you do not recognize.

To be frank: we do not claim end-to-end encryption. Your data on our server is technically readable by us, and we look at it only as much as needed to run the service or for support you request. And no system is absolutely secure — so we recommend keeping a copy of your data on your device or in a file you export yourself.

10. Children

TOFA is a business tool aimed at adult shop and business owners. The app is not directed at children, and we do not knowingly collect data from anyone under 13 years of age. If you learn that a child has created an account, message us so we can delete it.

11. Changes to this policy

We may update this policy whenever what the app actually does changes. We publish the updated version on this page and put its date at the top, so review it from time to time. Your continued use of the app after publication means you accept the published version.

12. Contact us

For any question about your privacy or a request concerning your data:

WhatsApp tofa.smart.app@gmail.com Contact page