Privacy policy
Inspeclr is an inspection and audit app. It works without an account, and your inspections stay on your device. This policy says exactly what the app does with your information, and it matches what the app's code does.
Who we are
Inspeclr is made by Tibrcode Software Development, Abu Dhabi, United Arab Emirates ("we"). For anything about your privacy, write to support@tibrcode.com. For the information that passes through our cloud service, we are the controller.
In short
- There are no accounts. We do not know who you are.
- Your inspections, photos, notes, clients, sites, templates and settings are kept only on your device. We cannot see them.
- Your inspections and what you write leave your device only when you do something that needs it: you share or export a report or a backup, you connect your Google Drive, you use an AI feature you have allowed, you write to support, or you flag an AI answer.
- The Android and iOS apps are free and show ads from Google AdMob, which receives what it needs to show them, within the choices you make (below) — never your inspections. The web app has no ads. No selling of your data, no analytics of what you do in the app.
What stays on your device
Everything you create in the app: inspections and their answers, notes, photos, signatures, locations you add to an answer, clients, sites, assets, templates, schedules, corrective actions, your inspector name and title, and your settings. It is kept in the app's storage on your phone, or in your browser's storage on the web. On a phone, photos are kept in the app's private folder, and automatic backups are written to the folder Documents/Inspeclr/backups on the device.
Android's backup to your Google account leaves all of it out. When you set up a new Android phone (Android 12 or later) by copying from your old one, it moves with you, except your own AI key, which you enter again. On an iPhone, iCloud Backup, when you have it on, includes the app's data, which Apple keeps encrypted; setting up a new iPhone from that backup, or from your old iPhone, brings it back.
None of this is sent to us. It leaves your device only when you share or export it yourself (a PDF, an Excel file, a backup file), through the app or service you choose.
What leaves your device, and when
The free AI (Inspeclr AI)
The AI features are optional. Each one asks for your permission the first time, says what will be sent, and sends nothing until you allow it. You can take each permission back, or turn the AI off, in Settings → AI. When you use one, only what that feature needs is sent to our cloud service, which passes it to Cloudflare Workers AI and returns the answer:
- A photo to a suggested finding: that photo, the item's question, its category and the report's language.
- A voice note: the recording and its language. The recording is not kept, on your phone or anywhere else.
- An executive summary: the inspection's results: counts, score, the items that failed with their notes, and the corrective actions. No photos and no names of clients, sites or people.
- A template translated: the template's texts.
- A new template drafted: your description, or pictures of the pages of a paper checklist you choose.
- A value read from a photo: the photo you take for it and the item's question. The photo is not added to the inspection.
- A review before finishing: the answers, notes and corrective actions as text. No photos, signatures or locations.
What is sent is used to produce the answer and is not stored: not by our service, and not by Cloudflare's AI Gateway, which we set to keep no log and no copy. The models run on Cloudflare's network: Google's Gemma for text and pictures, OpenAI's Whisper for speech (open models run by Cloudflare; nothing is sent to Google or OpenAI).
To keep the free AI free, the app first gets a session for an hour: it sends a random number made on your device when the app was installed (the "installation id") and the result of a human check (below). Our service counts how many AI requests each installation id makes each day, to apply the daily limit; that count is deleted the next day. More about the AI: AI notice.
The human check (Cloudflare Turnstile)
Before the free AI's session (at most once an hour) and before a message from the web's support form, Cloudflare Turnstile checks that a person, not a program, is using the app. Its script comes from challenges.cloudflare.com and looks at signals from your browser to do this; usually you see nothing, and sometimes it asks you to tick a box. Cloudflare handles this under its own Turnstile privacy terms.
Your own AI provider ("My own key")
If you choose to use your own AI provider instead of Inspeclr AI, the same requests go directly from your device to that provider, with your key: api.openai.com (OpenAI), api.anthropic.com (Anthropic), generativelanguage.googleapis.com (Google), openrouter.ai (OpenRouter), or the address of another service you enter. They never pass through our service. What the provider keeps is set by your agreement with it. Your key is kept in your phone's secure storage (Android Keystore, iOS Keychain), or in your browser encrypted with a key that cannot be read out; it is never sent to us.
Flagging an AI answer
Next to every AI answer there is a button to report it (offensive, unsafe, wrong, or something else). If you use it, our service keeps the answer as the AI gave it, the reason, the words you add, which feature and model gave it, the language, and the app's version and platform — and nothing that identifies you or your device. Reports are kept for 90 days, then deleted, so that we can find and fix problems.
Writing to support
- By e-mail: your e-mail app sends what you write to support@tibrcode.com. The app adds its version, build, system, browser and language to the message so we can help; you can see and change everything before sending.
- The web's support form: your e-mail address, your message, and the app's language, version, build, commit, system and browser are sent through our service and Cloudflare's e-mail service to support@tibrcode.com. Our service does not keep them.
We keep support messages in our mailbox as long as we need them to help you and keep a record of what was asked; you can ask us to delete yours.
Your Google Drive (if you connect it)
In Settings → Google Drive you can connect your own Google Drive. On its own screens, Google asks you to let Inspeclr use only the files Inspeclr makes (Google's "drive.file" permission): Inspeclr cannot see anything else in your Drive. When you connect, the app reads your Google account's e-mail address and name from Drive, to show whose Drive it is, and makes a folder named Inspeclr with Backups and Reports in it.
While it is connected, the app keeps a copy of everything on this device in Backups, in a folder for this device: your inspections, notes, photos, signatures, files and settings. It brings the copy up to date after you complete an inspection, once a day when you open the app, and when you tap Back up now. Each photo goes up once; what you delete here leaves the copy, and a deleted photo goes to your Drive's bin. In Settings → Google Drive you can let photos wait for Wi-Fi.
You can bring that copy back onto a device — a new phone, or one that lost its data — with Restore from Google Drive, in Settings → Google Drive or on the first screen of a new installation. The app downloads it from your Drive straight to the device, checks every file before anything on the device changes, and keeps what came down only until the restore is done, so that one that stopped can go on. A new device can take the old one's place: the old device's folder in Backups then carries the new one's name, and the new device's backups go on there.
With Save each final report in Drive on (Settings → Google Drive; on unless you turn it off), the Android app also puts each final report in Reports, as a PDF in a folder named after its client: when you complete an inspection, and again when you sign it, the signed copy taking the place of the first.
All of it goes directly between your device and Google: to www.googleapis.com, and on the web Google's sign-in script comes from accounts.google.com. Nothing passes through our service: we never see your files, your Google account or the permission Google gives the app. Google keeps your Drive under your own agreement with it. Disconnecting (Settings → Google Drive → Disconnect, or Delete all my data) asks Google, at oauth2.googleapis.com, to take the permission back; the files already in your Drive stay there until you delete them.
Ads (the Android and iOS apps)
The Android and iOS apps are free, and show ads served by Google AdMob (Google LLC; in the European Economic Area, the United Kingdom and Switzerland, Google Ireland Limited): a banner under the bottom bar, and on some screens an ad among the items, marked as an ad. There are no ads on the web, in training, while you carry out an inspection, or in your reports.
To choose the ads, show them, count them and stop fraud, Google's software in the app sends Google: the phone's advertising identifier (Android's advertising ID; on an iPhone, the advertising identifier only if you allow tracking), the IP address (from which Google works out an approximate location), the phone's model, system and language, the app's name and version, and how the ads are seen and tapped. Google receives this under its own privacy policy and how Google uses information from sites or apps that use its services; we receive only totals (how many ads were shown, and what they earned). Your inspections, notes, photos, names, places and settings are never sent to Google or to any advertiser.
Your choices:
- In the European Economic Area, the United Kingdom and Switzerland, before any ad, Google's consent form asks whether your data may be used for ads, including ads that suit you. If you do not agree, Google shows only limited ads, which use no identifier for advertising. In US states with privacy laws, the same form lets you opt out of the use of your data for targeted ads. Where the law gives you this choice, Settings → Privacy & Security → Ad choices opens the form again.
- On an iPhone, the system asks whether Inspeclr may track you across other companies' apps and websites. If you choose not to allow it, the advertising identifier is not used.
- On Android, you can reset or delete the advertising ID in the phone's settings (Settings → Privacy → Ads, or Settings → Google → Ads).
- The ads are set for a general audience: none rated for adults only, and none aimed at children.
Updates
On a phone, when the app starts, it asks our service which versions are still supported (nothing about you is sent), and it asks Google Play on Android, or the App Store on iOS, whether a newer version exists. On the web, the app's own files come from app.inspeclr.com, which may download a newer version of the app in the background.
Crash reports
If the app fails, it can send a report of what failed in its code to Sentry, our crash-report service, so that we can fix it: the kind of error, where in the app's code it happened, the app's version and build, the system, the device's model and its state at that moment (memory, storage, battery, screen, language and time zone, and which of the app's permissions are allowed), the browser's name, and the installation id. Never your inspections, notes, names, photos or the texts on the screen. The app asks you before sending any; you can change your choice in Settings → Privacy & Security. Sentry keeps the reports in the European Union (Germany). Like any server, it sees the IP address of the connection; it is set not to store that address, nor a place worked out from it.
Opening the app on the web
The web app is served by Vercel from app.inspeclr.com. Like every website, Vercel receives your IP address, your browser's description and the address you open, and keeps them in its logs for a short time under its own policy. The app's fonts and pictures are its own files: no other site is contacted to show them. Our website, inspeclr.com, is served by Vercel in the same way; its pages have no scripts, no cookies and no analytics.
What Cloudflare sees
Our cloud service runs on Cloudflare. To answer any request, Cloudflare receives your IP address and an approximate location, and our service limits how many requests one address can make each minute. Our service is set not to keep Cloudflare's per-request records: its logs hold only, for a failure, the route, an error code and the error's name — never what was sent.
The servers the app contacts
- app.inspeclr.com — the web app's files (Vercel).
- api.inspeclr.com, and until it is ready inspeclr-api.omar-matouki.workers.dev — our cloud service (Cloudflare), only for the uses above. Test versions of the app use inspeclr-api-staging.omar-matouki.workers.dev instead.
- challenges.cloudflare.com — the human check (Cloudflare Turnstile).
- api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, openrouter.ai — only with your own key, the provider you choose.
- www.googleapis.com, oauth2.googleapis.com and, on the web, accounts.google.com — your own Google Drive, only if you connect it.
- ingest.de.sentry.io — crash reports (Sentry, in the European Union), only when you allow them.
- googleads.g.doubleclick.net, pagead2.googlesyndication.com, fundingchoicesmessages.google.com and other Google ad servers — the ads and Google's consent form, in the Android and iOS apps.
- Google Play and the App Store — through your phone's store app, for updates.
Links you open yourself (our website inspeclr.com, your e-mail app, a store page) leave the app.
Why we may use it (legal bases)
- To give you a feature you ask for: the AI requests, the human check that protects them, support, the connection to your Google Drive (performance of a service you request).
- With your consent: sending your content to the AI, crash reports, and, in the European Economic Area, the United Kingdom and Switzerland, the use of your data for ads. You can withdraw consent at any time in Settings; this does not affect what was done before.
- For our legitimate interests in a safe, working service: the daily limits, the per-address limit, the failure logs, the update checks, the AI reports, and showing the ads that keep the Android and iOS apps free (outside those places).
Where it is processed
Cloudflare, Vercel, Sentry and Google run worldwide, including in the United States. Where the law requires it, transfers rely on the providers' data processing terms with the European Commission's Standard Contractual Clauses, or another lawful mechanism.
How long it is kept
- On your device: until you delete it. See Your data.
- AI requests: not kept.
- Daily AI counts: until the next day (UTC).
- AI reports: 90 days.
- Support messages: as long as needed to help you; ask us to delete them.
- Cloudflare's and Vercel's logs: for a short time, under their own policies.
- Crash reports, if any: up to 90 days.
- What Google's ad software receives: under Google's own policy; we receive only totals.
Your rights
Depending on where you live, you can ask to access, correct, delete, restrict or move your personal data, object to its use, and withdraw a consent. Because your inspections never reach us, you hold them yourself: you can export them (a backup or a report) and delete them (Settings → Privacy & Security → Delete all my data, or by uninstalling the app). For what reaches us — support messages and AI reports — write to support@tibrcode.com; AI reports carry nothing that identifies you, so tell us the answer and when you flagged it. You can also complain to your data protection authority.
Children
Inspeclr is a professional tool. It is not meant for children under 13, or under 16 in the European Economic Area, and we do not knowingly receive information about them.
Security
The AI requests and every other request travel encrypted (HTTPS). Sessions with our service are signed and last an hour. Backup files are not encrypted: keep them where only you can reach them.
The app has no lock of its own: it relies on your device's, so set a screen lock (a PIN, a pattern, a password, your fingerprint or your face). On a phone, the phone encrypts the app's storage, and only Inspeclr opens it, once the phone is unlocked.
What can be seen without the app: the reminders you turn on name the inspection or the action, on the lock screen too unless your phone hides notification content there (on Android, Settings → Notifications; on an iPhone, Settings → Notifications → Show Previews); and the automatic backups in Documents/Inspeclr/backups, which a file manager, or an app you allow to read all your files, can open once the phone is unlocked. On the web, the app's data is in your browser: anyone who can use your computer account and that browser can open it.
For residents of particular places
- European Economic Area, United Kingdom (GDPR, UK GDPR): Tibrcode Software Development is the controller for the information that reaches our service. You have the rights above and may complain to your supervisory authority.
- United Arab Emirates (Federal Decree-Law No. 45 of 2021 on personal data): you have the rights to information, access, correction, deletion, restriction, objection and to stop processing; write to us, or complain to the UAE Data Office.
- Saudi Arabia (Personal Data Protection Law): you have the rights to be informed, to access, to obtain a copy, to correct and to delete; write to us, or complain to the Saudi Data and AI Authority (SDAIA).
- California (CCPA, CPRA): we do not sell personal information. In the Android and iOS apps, Google's ad software receives identifiers (the advertising ID, an IP address) and how the ads are used, for ads that may suit you: the law may call this "sharing" for targeted advertising. You can opt out in Settings → Privacy & Security → Ad choices, or by deleting the advertising ID in your phone's settings. The categories that reach us are those above: identifiers (the random installation id, an IP address seen by Cloudflare), the content you choose to send to the AI, and what you write to support. You have the rights to know, delete, correct and not be discriminated against.
- Brazil (LGPD): you have the rights of Article 18; write to us, or to the ANPD.
- India (Digital Personal Data Protection Act, 2023): for grievances, write to support@tibrcode.com; you may also approach the Data Protection Board of India.
Changes
When this policy changes, its version and date change. If the change is material, the app asks you to read it again before you go on.
Also read: Terms of use, AI notice, Your data.