Rules and privacy

This policy covers the Sroky app for Android and iOS, this website and the Sroky visa service. It says what data exists, where it is kept, who can see it and what you can do about it.

We wrote it to match how the app really works. When the app changes the way it handles data, we change this page first.

These are stored only on your phone and are encrypted with keys kept in the phone's secure hardware (Android Keystore or Apple Keychain):

• names of the people you add, document types, countries, dates and notes
• document numbers, if you choose to enter them
• photos of your documents, front and back, and the card photo of each person
• your profile photo, if you add one
• trip dates for the day counters
• your settings: language, theme, country and reminder choices

Nobody at Sroky can open this data. We do not have a copy and we do not have the keys.

When you scan a card or passport, the text is read on the phone by Google ML Kit, which is built into the app. The photo and the text are never uploaded for this.

The machine readable zone of a passport is read the same way, on the phone.

You sign in with your mobile number. Google Firebase Authentication keeps your number, your email if you add one, an account id and the times you signed in. This is needed to prove it is you.

Your documents are not stored in the account.

The app connects to these services. None of them receives your documents, names or numbers:

• Google Firebase Cloud Messaging, for notifications: a notification token and the topics for your language.
• Expo (EAS Update), for app updates: the platform, the app version, the update channel and a random install id.
• GitHub, for the list of verified lawyers, our contact details and app updates: a plain file download.
• Google Play, for purchases: Google handles the payment and knows what you bought, as with any Play purchase. The app only reads which plans your Play account owns.

Like any download, these servers see your IP address. Analytics, advertising ids and crash reporting are switched off.

This is the only moment your data reaches Sroky, and only when you tap Send my application. The app makes a PDF with your application, the passport page and your photo, and opens your own mail app addressed to our support email. You can see the email before it is sent.

We use this data only to check your application, send you the payment link, file it with the government of Azerbaijan on evisa.gov.az and send you the visa. We delete the application email and its files 30 days after we send you the visa, or 30 days after the application ends without one.

After sending, the app removes the draft and the passport photo from your phone. For an embassy visa, the app opens WhatsApp or email with your passport country, purpose and speed, never a passport number.

• Your account and notifications: to provide the app you asked for (contract).
• A visa application: to provide the service you ordered (contract), and to keep payment records as the law requires (legal obligation).
• Security of the app and the service: our legitimate interest in keeping it safe.

We never sell data and we never use it for advertising.

For a visa application we share your details only with the government portal evisa.gov.az, because that is how a visa is applied for, and with our payment provider for the payment. Services that keep data for us (email and hosting) only act on our instructions.

We give data to authorities only when the law requires it.

Google, Expo, GitHub and our email provider may keep data in other countries, including the United States. They use the protections the law asks for, such as standard contractual clauses.

A backup is a file encrypted with your password. You choose where to keep it: in a folder on your phone, a memory card or your own cloud drive. Without the password nobody can open it, including us. If you lose the password, we cannot restore the backup.

• On your phone: until you delete it, delete your account or uninstall the app.
• Account: until you delete it in the app.
• Visa applications: 30 days after the visa is sent, as above.
• Payment records: as long as tax law requires, usually 6 years.

Depending on where you live, the law (for example the GDPR in the EU and the UK, or the Law on Personal Data of Azerbaijan) gives you the right to:

• ask what data we have about you and get a copy
• correct it
• delete it
• limit or object to how we use it
• take it with you in a common format
• complain to the data protection authority in your country

Most data is only on your phone, so you control it there directly. For anything we hold, write to Help and support in the app. We answer within one month.

In the app, open More, Account, Delete my account. This deletes your account and everything on this phone. Uninstalling the app also deletes everything on the phone. Backup files you saved elsewhere stay where you put them until you delete them.

Data on the phone is encrypted, the app can be locked with your fingerprint, face or PIN, and photos are encrypted with their own key. No system is perfect: keep your phone locked and your backup password safe. If we learn of a breach that affects you, we tell you and the authority as the law requires.

The app is for adults. Parents can keep their children's documents in it. We do not knowingly collect data from children.

When this policy changes, the date at the top changes too. If a change gives us new uses for your data, the app tells you before it applies.