App privacy policy

Which app this is about, and who we are

This is the privacy policy of the Fair Assistant application for Android. The controller of the data described here is Tehnokan d.o.o. Smederevo, Karadjordjeva 40, 11300 Smederevo, Serbia. For this website there is a separate privacy policy, and the rules of the service are in the terms. It matters below where things are: your phone, where the app creates and keeps your work; our server, which knows whether you are entitled to use the app and, if sync is on, holds your records only in an encrypted form that we cannot read; and Google, which keeps the encryption key in your Drive and — only when you turn on the AI included in the package — receives the content you choose through our server (see “AI features (optional)”).

What stays on your phone, and what we keep encrypted

Scanned business cards, photos, notes, ratings and reminders are created on your phone. Text recognition runs on the device itself, so a card is never sent anywhere to be read.

You turn sync on on the screen after sign-in (the app suggests it) or later in settings, and you can turn it off at any time. While it is on, your contacts, fair notes and “My card” are encrypted on your phone (AES-256-GCM) before they are sent, so our server receives only an encrypted record. The key is created on your phone and kept in your Google Drive, in a hidden space that only this app can see. Tehnokan does not have that key and cannot read what is in the records. On the server we keep only a fingerprint of the key, by which a new phone checks that it found the right key (the key cannot be derived from it) and, if you create a recovery phrase, the key locked with that phrase, which we cannot open without the phrase. Google has the key but not the records, so neither side can open them alone. Photos of cards are not synced for now and stay on the phone only.

From you, the server sees only your account ID, your team ID if you have one, the kind of record (contact or note), how many there are and how large, and when each was last changed. It does not see names, companies, phone numbers, e-mail addresses, notes or ratings.

Anyone who signs in to your Google account in this app also gets your contacts, as if holding your unlocked phone. Protect your Google account.

The exception is AI actions you start yourself (see “AI features (optional)”): the content of that action passes through the server to Google in readable form, and we do not keep it.

Using the app without signing in

You can try the app without an account. So that the free trial is one per phone, the app sends the Android device identifier to the server; the server turns it into a one-way hash the moment it arrives and keeps only the hash, never the identifier itself. Against that hash it keeps how many trial contacts have been used — at most five — a random identifier the app generates for each of them, the version number of the app for support, and the times that phone first contacted us and last did so. Nothing from the card is sent: the random identifier exists only so that the same contact is not counted twice. If a phone does not contact us for a year, the record is deleted automatically.

Signing in with a Google account

When you sign in, the app sends the server a Google sign-in token. That token does contain your e-mail address, your name and your profile picture; the server checks it in memory, takes the account identifier out of it and keeps nothing else — the token is never written to a log. The identifier is stored as a one-way hash, so not even it is kept in readable form. Nowhere in the database is there a column for an e-mail address, a name or a picture. Next to the hash we keep an internal account number, when the account was created, when it was last used and, if you have asked for deletion, the day you asked. Each signed-in phone gets a session record: a hash of its refresh token (replaced every time the token is refreshed), the times it was created and last used, and an optional short device label. As that label the app sends only the manufacturer and the model of the phone — never the name you gave the device yourself, which we neither ask for nor keep. A session record stays until the account is deleted, including after you have signed out on that phone.

Signing in on the website

On the page “Your account” on our website you can sign in with the same Google account to see your account and delete it. The server treats that sign-in like a phone: it keeps a website session — a hash of its token, when it was created and last used — for at most 30 days, and deletes it at the latest together with the account. While a sign-in is in progress it keeps, for a few minutes, a hash of the protective value and of the one-time code, and the website address to return you to; those are deleted an hour after use. From Google it stores nothing: no identifier, e-mail address, name or picture — the Google token is read in memory only to find your existing account. The website’s own cookies are described in the website privacy policy.

The free trial

The free trial lasts 14 days and covers one fair. For a signed-in account we keep when the trial started and when it ends. So that the trial cannot simply be started again, one marker stays even after the account is deleted, and stays with no time limit: the same one-way hash of the Google identifier, the two trial dates, and the calendar day of the deletion. It holds no account number and nothing else about you. If an account is deleted before the trial was ever started, no marker is written. We also use the same one-way hash of the phone identifier so that the free trial applies once per phone; we keep it for 365 days from the last trial on that phone, with no link to your account.

Purchases

Payment goes through Google Play. A purchase is a one-time payment, not a subscription: nothing renews on its own. This applies to the Fair Pass, the Enterprise Fair Pass and the extra team seat. We never see your card and Google never passes us your payment details. Before the Play window opens, the server writes an intent: the internal account number, the product, the fair or edition it is for, its state, and when it was created and expires. That record stays even if you close the window and nothing is paid. For a completed purchase we keep the Google order number, the product, the states and times Play reports — paid, verified, acknowledged, consumed, refunded — the price and currency when Play reports them, our own short code when something went wrong, and the Play purchase token: encrypted, next to a one-way hash of it by which we recognise the same token again. So that Play can tie the payment to the right account, two of our own identifiers go to Google: the internal account number and the identifier of that intent. Neither of them carries your name or your e-mail address. When a right is restored on another phone from a licence the app already holds, the server writes substitute records marked as a restore, so that the restored right has a record like any other.

Rights from a purchase, and the licence on the phone

Against the account we keep rights: which fair, which edition or which fair you added yourself a right covers, its kind and state, the period it is valid for, and which purchase it came from. So that we can count how many fairs a trial or a pass covers, we also keep a mark for every fair it is used for: its name from our catalogue, or the name you typed yourself for a fair outside it, and when it was added. If you replace one fair with another, the earlier one stays in this record. All of it is deleted with the account. The licence itself — the signed file the app checks — is never stored. It is made and signed at the moment it is asked for and goes straight to the phone. The database holds only the public part of the signing keys and the name of the environment variable in which the private key is kept, never the key itself. Because the app checks the licence on the device, it works without an internet connection; for the same reason a licence already on a phone cannot be withdrawn before it runs out. A refund or a deletion stops a new one from being issued.

Teams

A team is bought by one person, the manager. The others join with an invitation (a code or QR code the manager shares) and pay nothing.

The manager can turn on contact sharing in the team. The manager’s phone then creates a team key, which reaches the members in the QR invitation and is also kept in the Google Drive of the manager and of each member, in the app’s hidden space. The part of the invitation that carries the key is not sent to our server. Team records are encrypted with that key, so the server stores them but cannot read them. The app also keeps the team key as a record encrypted with each member’s personal key, so the server cannot read that either.

All members see the team’s contacts and can edit them. A member deletes only contacts they added themselves, and the manager can delete all of the team’s records. A contact from a fair the team covers goes into the team space automatically; you can move any contact back to your personal space with the “Share with team” switch.

Whoever leaves the team or is removed immediately loses access to the team’s records on the server, and the app deletes from their phone the team contacts they did not add themselves. The team key is not changed in this version, so what a member has already exported or copied outside the app is not under our control.

For a team the server knows each member’s internal account number (not name, not e-mail), who the manager is, when each person joined and left, how many seats the team has and how many are taken, how many replacements have been used, which fairs it covers and until when, the purchase the team comes from, and who added which record. We keep the invitation only as a one-way hash, with an expiry and a number of uses. Membership gives the manager no access to your phone or your personal contacts. You can leave a team whenever you want; if you had a personal Fair Pass, joining a team does not make you lose it.

Fairs you add yourself

A fair that is not in our directory you can add in the app. We keep the name and the city you type, the country as a two-letter code you pick from a list, the dates if you give them, an identifier the app generates, and the times the record was created and — if that happened — passed on. A fair you add may be passed on as a proposal for the public fair directory on this website; that copy lives outside the database of the app and deleting your account does not affect it. No contact is ever attached to such a fair. When the account is deleted, a fair you added is deleted with it; if a purchase or a right refers to it, the record stays but the name and the city are overwritten, so that nothing you typed remains.

AI features (optional)

The AI features included in the package are optional and off by default. You turn them on yourself, in the app, after the explanation you see before switching them on, and you can turn them off whenever you like — turning off takes effect at once. While they are off, nothing is sent for AI and the app works as before. They are for people aged 18 or over.

When they are on, AI is used only for actions you start: (1) reading a business card — the text the phone has already read from the card, the QR codes read and our draft fields are sent; if that is not enough, also the photo of that one card; (2) drafting a follow-up e-mail — the person’s name, company, position, country and language, from “My card” only your name, company and position (not your phone number or e-mail address), and the fair’s name are sent; (3) summarising notes — the notes, the rating (for example “4/5”) and the follow-up status of the contact or fair you choose are sent. Notes go only with your explicit confirmation at the moment of sending.

Not sent: other contacts, the whole database, ratings outside a notes summary, reminders, photos other than that one card, your account number, your e-mail address or Google account name, or the phone’s identifier. The request to Google is made by our server, not by your phone.

We do not keep the content: the server holds it in memory while it is processed, returns the result to you and forgets it. It is not written to the database, to the work log, to backups or to the 24-hour record of repeated requests. We keep only a counter — how many AI actions you used in a day, of which kind and how much was consumed — linked to your account, for at most 90 days, to apply daily limits and follow the cost. If there is no network or AI does not answer, the app uses its own on-phone reading or the e-mail template; nothing is queued to be sent later.

The content is processed by Google (Gemini API, paid service) under Google’s terms for that service: according to them, Google does not use it to improve its products or to train models, and it logs requests and answers for a limited time only to detect abuse and meet legal duties. More in “Who else is involved”.

You always see the result and can edit it before anything is saved or sent: a card opens as a draft, an e-mail as text in an editor, and it is sent only when you send it yourself through your own mail program. Nothing is done automatically. AI can make mistakes, so check names, numbers and addresses.

A business card contains another person’s data. You send it for the purpose for which you scanned the card; use AI only for cards you have the right to process.

Technical records

So that the service can run and a problem can be looked into, the server keeps a technical log of events: identifiers, fixed status values, numbers and times only. It holds no free text — the name of a fair you added, for example, is deliberately not written into it. We keep these events for as long as we need them for support and security; when you delete your account they lose the link to it. For each write the app makes, a short record is kept for 24 hours so that the same request is not carried out twice: the internal account number, the key the app sent, which operation it was, a one-way hash of the request, and the answer that was given. It disappears after a day, and at once when an account is deleted. The server’s own log notes the request — method, path, response and time — together with the network address (IP address) it came from; the contents of a request are never logged, and sign-in tokens, refresh tokens, licences and purchase tokens are blanked out wherever they could appear. That log is kept for at most 14 days, for security and against abuse, and we do not use the address to work out where you are. Network addresses are also held briefly in memory to limit how often one address may call us. Not a single network address is kept in the database, and it holds no advertising or analytics records of any kind.

Who else is involved

Three companies take part in running this, and no others. Google appears in three roles: sign-in and payment, keeping the key and, only if you turn on the AI included in the package, processing AI requests.

Google (sign-in and payment): verifies your sign-in token and, through the billing system of Google Play, takes the payment, confirms the purchase and tells us its state — for which it receives the two internal identifiers described above.

Google (Drive, keeping the key): while sync is on, one small file with the encryption key is written to the app’s hidden space in your Google Drive. Contacts and notes do not go to Drive. The app asks only for permission to its own hidden space (drive.appdata) and cannot see your other files; you approve this on a Google screen and can withdraw it in your Google account settings. Google gets the key file for this, not the records.

Google (AI, Gemini API) — only if you turn on the AI included in the package. Purpose: to read a business card into fields, draft an e-mail or summarise notes, when you start it. Data: the text or photo of the card, the QR codes read, the draft fields we have already extracted; for an e-mail also the person’s name, company, position and language, from “My card” only your name, company and position, and the fair’s name; for a summary the notes, the rating and the follow-up status, only with your explicit confirmation. We do not send your account number, e-mail address, Google account name or phone identifier. We use the paid version of the service; under Google’s terms for it, Google does not use your content to improve its products or to train models, and it logs requests and answers for a limited time only to detect abuse and meet legal duties. Location: Google processes the data in its own facilities, which may be outside the European Union and Serbia. You can stop this at any time by turning the AI included in the package off.

Hostinger: the server on which all of this runs is a virtual machine in the European Union, at Hostinger. The encrypted sync records are kept there as well.

Cloudflare: with it, in the European Union, we keep encrypted backups of the database. Backups also contain the encrypted sync records, which we cannot read; the content of AI actions is never in them, because it is not written to the database.

We do not sell data and do not pass it to advertisers, and the app carries no advertising and no analytics software.

Deleting the account, and what outlives it

You can ask for deletion in the app, or by e-mail as described on the page how to delete your account. It does not happen at once: the account is permanently deleted 7 days after the request, until then you can change your mind in the app by choosing “Keep my account”, and the app shows you the exact date on which it becomes final. On that day the account, the sessions on all your phones, the marks of the fairs your trial or passes cover (with any name you typed), your team membership, the counters of AI use, and the link between you and your purchases are deleted, and so are the 24-hour records. Your personal synced records and the key data are deleted on that day as well.

We keep synced contacts, notes and “My card” permanently, until you delete them yourself. Losing or replacing a phone, deleting the app and reinstalling it delete nothing: after you sign in with the same Google account, everything comes back. Personal sync keeps working after the trial or the Fair Pass ends. You delete the records in two ways. With the “Delete from server” button in the app they go at once, and the contacts on your phone stay. By deleting the account they go 7 days after the request and can no longer be restored. When you ask for deletion from the app, it also deletes the key file from your Google Drive. You can also delete the key file in Google Drive yourself (Google Drive, settings, manage apps, delete hidden app data). Without the records on the server, that file opens nothing.

In a team, a member deletes the records they added themselves, and the manager deletes all of the team’s records. Records added by a member who deletes their account stay with the team, without any link to that account. When a team ceases to exist (it expires without renewal, the purchase is refunded or the manager’s account is deleted), its records are kept for another 90 days and are then deleted.

After deletion, encrypted records can remain in database backups for at most 8 weeks, and then disappear.

Four things stay on purpose. The purchase records — Google order number, product, amount, currency, dates and the encrypted purchase token — stay with no link to you on our side, for as long as accounting regulations require; we are still establishing the exact period with an accountant, and until then these records are not deleted automatically. The one-way hash of your Google identifier with the trial dates stays without a time limit, only so that the free trial does not start again. The one-way hash of the identifier of the phone on which the trial started stays for 365 days from the last trial on that phone, because it is not linked to the account. And backups of the database are kept encrypted at Cloudflare (EU) for at most 8 weeks, so a deleted account disappears from them at the latest 8 weeks after the deletion. Technical events remain, but no longer linked to you. A licence already on the phone keeps working until it runs out, because it cannot be withdrawn.

The content of AI actions is not on this list, because we never kept it; Google holds it only as long as described in “Who else is involved”.

Your rights

You can ask what we hold about you, ask for it to be corrected or deleted, ask for a copy, object to how it is used and withdraw consent. Write to hello@fairassistant.com from the Google address you use to sign in to the app, or send the request from the app while you are signed in. The controller is Tehnokan d.o.o. Smederevo, Karadjordjeva 40, 11300 Smederevo, Serbia. If you are not satisfied with our answer, you can turn to the data protection authority in your country.

Questions and answers

Where are my contacts stored?

On your phone. If you turn sync on (on the screen after sign-in, where the app suggests it, or later in settings; you can turn it off at any time), an encrypted copy is also on our server in the European Union. The key to open it is in the app’s hidden space in your Google Drive. Photos of cards stay on the phone only.

What if I lose my phone?

Install the app on a new phone and sign in with the same Google account. The app takes the key from Drive, downloads the records and brings back your contacts and notes. If you have no access to that Google account, you can restore only with the recovery phrase, if you made one, or from a manual backup (ZIP). Photos of cards are not restored for now.

Can Tehnokan see my contacts?

No. Our server stores only encrypted records without the key (it keeps only a fingerprint of the key and, if you create one, the key locked with your recovery phrase) and sees only your account ID, the number and size of records and when they changed. The exception is AI actions you start yourself: then the content passes through the server to Google and we do not keep it. You can delete the records from the server whenever you want.