Privacy Policy
Last updated: 2026-07-02 (draft — set the final date on publish)
This policy describes what data Warekenn ("the App", "we", "us") collects, why, how it is shared, how long it is kept, and how you can delete it. It reflects exactly what the app does today — no more, no less — and covers what Google Play's Data Safety form and Apple's App Privacy labels ask for.
- [COMPANY / LEGAL ENTITY NAME] — the legal entity operating Warekenn
- Confirm
support@kennapps.comexists and is monitored (used below as the contact address) - [PHYSICAL/MAILING ADDRESS] — only if your counsel says your jurisdiction needs one
- Set the final "Last updated" date above
1. Who we are
Warekenn is an inventory management app for companies to track products, departments, and stock across locations. This policy applies to the Warekenn web app, Android app, and iOS app.
Data controller: [COMPANY / LEGAL ENTITY NAME]
Contact: support@kennapps.com
2. Data we collect
We only collect data needed to operate accounts, company/department access control, and inventory records. We do not use any analytics, advertising, or crash-reporting SDKs — there is no Firebase, Google Analytics, Sentry, Mixpanel, or similar third-party tracker integrated in the app.
| Data category | Specific data | Collected when | Why |
|---|---|---|---|
| Account identifiers | Email address, display name | Sign-up / sign-in | Create and identify your account, send account-related email |
| Authentication credentials | Password (salted hash only, never plain text) | Email/password sign-up | Authenticate you |
| Third-party sign-in identifiers | Google / Microsoft / Apple account ID, plus the name/email the provider shares | "Sign in with Google/Microsoft/Apple" | Authenticate you without a separate password |
| Company & role data | Company name/code, role, department assignments, approval status | Registration, invites, admin actions | Enforce who can see/edit which departments and inventory |
| Invite data | Invitee email, assigned role/departments, invite status | An admin sends/you receive an invite | Let new members join with the right access |
| Inventory / business data | Product names, barcodes, quantities, shelf/location names, notes, comments | You or a teammate edits inventory | Core product functionality |
| Audit/activity log | Who did what and when, within your company | Every account, invite, and inventory change | Accountability and troubleshooting |
| Password reset tokens | Short-lived, hashed reset token | You request a password reset | Securely reset a forgotten password |
| Camera access (device permission) | Live camera feed, decoded on-device | You open the barcode/QR scanner | Look up a product by scanning it. The camera image is never uploaded, stored, or transmitted — only the decoded barcode text is used |
| Locally cached data | A copy of your company's departments and inventory | Automatically, for offline use | Let the app work offline and sync queued changes later |
| IP address | Request IP address | Every server request | Abuse/rate-limiting only; held briefly in memory, not stored in the database or linked to your profile |
We do not collect: precise location, contacts, photos/media beyond the transient camera frame above, browsing history outside the app, advertising identifiers, biometric data, financial/payment information, or health data.
3. How we share data
- We do not sell your data and do not share it with advertisers or data brokers.
- Within your company: other approved members can see data appropriate to their role/department.
-
Service providers who process data on our behalf:
- Database hosting — Supabase (managed Postgres) stores account, company, inventory, invite, and audit-log records.
- Transactional email — Resend (or the operator-configured SMTP provider) sends invite and password-reset emails.
- Sign-in providers — Google/Microsoft/Apple verify your identity if you use social sign-in, per their own privacy policies.
- We may disclose data if required by law, or to protect the rights, safety, or property of Warekenn, our users, or others.
4. Data retention
- Account and inventory data is retained while your account and company remain active.
- Invites expire automatically after 14 days if not accepted.
- Password reset tokens expire after 30 minutes and are single-use.
- Audit log entries are retained for accountability while the company account remains active.
- Locally cached data is removed when you sign out or uninstall the app.
- IP addresses for rate-limiting live only in short-lived server memory.
5. Your choices and rights
- Access/export: export your company's inventory to a JSON file anytime from within the app.
- Account deletion: delete your account in-app (Management → Account → Delete account and device data), or see the step-by-step instructions. This marks your account deleted, cancels pending invites tied to your email, and removes your access. Shared business records your company retains (e.g. inventory you edited) remain part of the company's data.
- Correction: update your display name and account details anytime in-app.
- Depending on where you live, you may have additional rights (GDPR, CCPA, etc.) to access, correct, delete, or port your data. Contact support@kennapps.com to exercise these.
6. Data security
- Passwords are never stored in plain text — only a salted hash.
- Session tokens are signed with a server-side secret and required on every authenticated request.
- All traffic to our servers is expected to run over HTTPS.
- Access to company data is enforced server-side by role and department, not just hidden in the UI.
7. Children's privacy
Warekenn is a business tool intended for company personnel and is not directed at children. We do not knowingly collect data from children under 13 (or the minimum age required by your local law).
8. Changes to this policy
We may update this policy as the app changes. We'll update the "Last updated" date above; material changes will be communicated to account holders.
9. Contact us
Questions about this policy or your data: support@kennapps.com
[PLACEHOLDER: mailing address, if required by your counsel]
Appendix: Quick reference for Google Play Data Safety / Apple App Privacy
| Data type | Collected? | Shared with 3rd parties? | Purpose | Optional? | Linked to identity? |
|---|---|---|---|---|---|
| Name | Yes | No (except OAuth providers, to authenticate) | Account management, app functionality | No | Yes |
| Email address | Yes | No (except email/OAuth providers) | Account management, app functionality | No | Yes |
| User IDs (OAuth subject) | Only with social sign-in | No | Authentication | Yes | Yes |
| Passwords | Yes (hashed) | No | Account management | No, unless using social sign-in | Yes |
| User-generated content (inventory) | Yes | No | App functionality | No | Yes, to the owning company |
| App activity / audit logs | Yes | No | App functionality, accountability | No | Yes |
| Photos or camera | No — decoded on-device, never stored/uploaded | No | App functionality (scan-to-find) | Yes, manual entry works too | No |
| Precise/approximate location | No | — | — | — | — |
| Financial info | No | — | — | — | — |
| Health/fitness | No | — | — | — | — |
| Contacts | No | — | — | — | — |
| Web browsing history | No | — | — | — | — |
| Analytics/advertising IDs | No | — | — | — | — |
| Device/IP for security | Yes, transient, in-memory only | No | Security / abuse prevention | No | Not persisted/linked |
Data deletion: in-app self-service (Account → Delete account) satisfies
Play's "provide a way to request account/data deletion" requirement. Also add this URL to
your Play Console Data Safety form's deletion field:
https://warekenn.kennapps.com/account-deletion.
Encryption in transit: Yes, over HTTPS. Encryption at rest: Supabase encrypts data at rest by default on its managed platform — confirm this still holds for your project tier before answering "Yes" on the store form.