Mobile app privacy

This is an English translation for convenience. The Russian version is the legally binding one.

This policy describes the Buff mobile app for iOS and Android (the “app”) and supplements the Buff Development Personal Data Processing Policy. Terms, the rights of the personal data subject (section 5) and the procedure for requests follow the main policy.

The operator is the person whose details are given on the Contacts page. The email address for requests is there too.

1. How the app works

The app connects to installations: an organisation on buff.systems, your company’s Buff Community or Enterprise installation, Buff Code on your computer. The phone and the installation exchange data through the buff.systems gateway, but every connection is encrypted with keys that only the phone and the installation have (end-to-end encryption). The gateway passes encrypted messages on and cannot read them.

The content of your work — tasks, code, questions and answers, decisions, attachments — is processed by the installation the phone is connected to: for an organisation on buff.systems — under the main policy, for your company’s installation and Buff Code — by the company itself or by you. The operator does not receive this content through the app.

2. What is stored on the phone

• The phone key — created on the phone at first launch, kept in the system’s secure storage (Keychain on iOS, Keystore on Android) and never leaves the phone.
• Connected installations — their names, addresses and public keys.
• What you have read in the app — so that screens open without a network. Stored encrypted with a key from the secure storage.
• Notification history and read marks, settings — theme, language.
• A log of connection events (without content and without keys) — for exporting diagnostics, if you yourself decide to send it to support.

This data is not passed to the operator. When an installation is disconnected, its data is erased from the phone; deleting the app erases everything.

3. What the buff.systems gateway processes

• Data: the identifier of the phone key and its public key; the phone name shown in the list of devices (the phone model or a name you gave it); which installations are connected and on whose behalf, when they were connected and when the phone was last online; the Apple or Google notification delivery address for this phone; the time and size of the messages transmitted; technical logs — under clause 1.6 of the main policy.
• Why: to deliver encrypted messages between the phone and the installation, to show the owner and their administrators the list of connected phones, to break a connection on request, to deliver notifications, to prevent abuse (rate limiting).
• Legal basis: performance of a contract to which the user is a party (Article 6(1)(5) of Federal Law No. 152-FZ); for security — the operator’s legitimate interests (Article 6(1)(7) of Federal Law No. 152-FZ).
• Retention: while the phone is connected; the record of disconnection — for the periods the main policy sets for account data. The notification delivery address is deleted when the last installation is removed from the phone or when Apple or Google report that it is no longer valid; after the phone is disconnected from all installations, no notifications are sent to it.

4. Notifications, Apple and Google

Notifications to a closed app are delivered by Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging). The notification text is encrypted for your phone while still on the installation; the gateway, Apple and Google receive only an encrypted packet and the delivery address. The app itself decrypts the notification. Notifications can be turned off in the phone’s settings, or you can choose their types in the app.

5. Permissions

• Camera — to scan the connection QR code and to take a photo that you yourself attach to a question, task, review or message to an agent. The QR code frame is not saved and is not sent anywhere. A photo taken for an attachment goes only to the installation or the Buff Code machine you sent it to, with end-to-end encryption.
• Photos and files — only those you yourself chose to attach; they go only to the installation or the Buff Code machine you sent them to.
• Notifications — to tell you about events when the app is closed.

6. What the app does not do

The app shows no advertising, uses no third-party analytics or tracking systems, collects no information about your location, contacts or other apps, and does not sell or pass data to third parties, except for delivering notifications under section 4.

7. How to delete data

• Disconnect an installation on the phone: “Settings → Installations → installation → Remove from phone”.
• Disconnect the phone from a computer: in the web app under “Settings → Phone” or in Buff Code.
• Delete the app — this erases everything that was stored on the phone.
• Delete the gateway’s records about your phones — by a request to the operator (section 5 of the main policy).

8. Children

The app is intended for work in organisations and is not intended for children.

9. Changes to the policy

The operator may change the policy; a new edition takes effect from the date shown on this page. Material changes are announced in the app or by email.