Privacy Policy

Last updated: May 2026

codes. is an offline-first app. We don't collect, store, or share personal information on our servers. This page describes what data the app handles, where it lives, and the limited cases where data leaves your device.

1. What data the app stores

All data is stored locally on your device in the app's private storage:

• Promo codes and vouchers you've added (text strings; you control the source)
• Categories you've created (names, descriptions, types)
• Customer or recipient information you've manually entered (names, optional contact details)
• Partner business records (Pro feature)
• Team configuration if you've paired with another phone (team name, member names, shared encryption key)
• App settings (language, preferred sharing app, etc.)

None of this is transmitted to us. We have no servers that store your business data.

2. What data leaves your device

2a. Team transfers (file-share mode)

When you send codes to a teammate using the file-share workflow (WhatsApp, AirDrop, email, etc.), the app generates an encrypted .pcm file containing the codes and metadata. You choose which app delivers the file. The contents are encrypted with a shared key that only the paired phones know — even if intercepted, the file can't be read without the key.

2b. Cloud sync (Pro Online tier — opt-in)

If you purchase Pro Online and enable cloud sync, paired phones exchange encrypted packages via a relay server (currently hosted on Cloudflare Workers).

• What the relay sees: the sender's and recipient's random identifiers (userIds), the size of each message, the time it was received, and an opaque block of encrypted bytes.
• What the relay does NOT see: the codes themselves, voucher contents, customer names, your real identity, or anything else inside the package — encryption happens on-device before transmission using AES-GCM with a key that never leaves your phone.
• How long messages are kept: messages are deleted from the relay shortly after the recipient retrieves them. Undelivered messages expire automatically.
• How to opt out: cloud sync is disabled by default. You can disable it anytime in Settings; the app falls back to file-share mode.

2c. In-app purchases (Pro upgrades)

Purchases are processed by Apple App Store or Google Play. We use RevenueCat to validate receipts and track entitlements across devices. RevenueCat receives an anonymous device identifier and the purchase receipt — no personal info from you.

See RevenueCat's privacy policy for their handling.

2d. Crash reports (if enabled)

Crash reporting is off by default. You can turn it on in Settings → "Send crash reports". When enabled, the app sends an anonymized report to our own relay server (not a third party) only when an error occurs.

Each report contains: the error message and technical stack trace, the app version, your platform (iOS/Android), which screen was open, a random anonymous identifier (not linked to your identity), and a timestamp. Before sending, the app redacts code-like strings (e.g. promo codes, voucher IDs) and email addresses from the error text.

Crash reports never contain your codes, vouchers, customer or partner names, or any identifying personal information. Reports are rate-limited (at most a handful per session). You can disable crash reporting anytime in Settings; no further reports are sent once it's off.

3. What we never collect

• Your name, email, phone number (you never give them to us)
• Your location (the app doesn't request location permissions)
• Your contacts (the app doesn't request contacts permissions)
• Advertising identifiers
• Usage analytics or telemetry
• The actual content of your codes, vouchers, customers, or partner records

4. Permissions the app requests

• Camera — only when you scan a team-invite QR code or scan a voucher for redemption. Camera access is requested per-use and not retained.
• Storage / file access — to read CSV imports you select and to save backup files you create. The app reads only files you explicitly choose.
• Notifications — to remind you when an inbound team transfer arrives or when a daily status report is due. Notifications are local-only (generated by the app on your device, not pushed from a server).
• Internet — required only if you enable cloud sync (Pro Online) or restore in-app purchases. Otherwise the app makes no network requests.

5. Children

This app is intended for use by businesses and adults distributing promotional content. It is not directed at children under 13 and we do not knowingly collect data from children.

6. Data retention & deletion

Because we don't store your data on our servers, there's nothing to "delete" on our side. To remove all data from your device:

• Open Settings → Clear all data, OR
• Uninstall the app (removes all stored data with it)

If you've used cloud sync, undelivered relay messages addressed to your phone will expire automatically.

7. Security

Team-mode communication (both file-share and cloud sync) uses AES-GCM with 256-bit keys. The shared team key is generated on the Owner's phone and transferred to Distributors via QR code during pairing — it never travels through any server.

Random initialization vectors are generated per-message. Replay protection is enforced via package-ID deduplication.

8. Third parties

• Apple App Store / Google Play — handle app distribution and in-app purchases. Subject to their own privacy policies.
• RevenueCat — validates IAP receipts. Receives anonymous device IDs and purchase metadata.
• Cloudflare Workers — hosts our own relay for the optional cloud sync (encrypted bytes + routing identifiers) and, if you opt in, anonymized crash reports. This is our infrastructure, not a third-party analytics processor.

9. Changes to this policy

If we change how the app handles data, we will update this policy and post the new "Last updated" date. Material changes will be announced in-app.

10. Contact

Questions about this privacy policy: support@evdiag.net