Privacy policy

When you create an account, we decide how your account data is used, and we are responsible for it.

When your apps send us data about their users, such as user IDs and device tokens, we process it on your behalf and only to run Lakolosy for you. For that data, your app is responsible toward its users, and we help you answer their requests.

• Your name, your email address and a hash of your password. We never store the password itself.
• Your teams: their names, members and roles, and the email addresses you invite.
• Sign-in sessions, with the IP address and browser that started each one, to keep you signed in safely.

• App names and colors.
• API keys. Secret keys are stored as a one-way hash and shown to you only once.
• The credentials you connect: your APNs .p8 key with its key ID, team ID and bundle ID, your Firebase service account, and your Cloudflare RealtimeKit IDs and token. They are encrypted with AES-256-GCM and never written to logs.

Your app and your server send us:

• The user ID you choose for each person, and optionally a name, an avatar URL, a locale and custom data.
• From each device, through the SDK: the platform, push and VoIP tokens, APNs environment, app bundle ID and version, OS version, device model, locale, time zone, SDK version, and whether notifications and full-screen rings are allowed.

For every ring and push we keep the caller name and avatar, the title and body, the custom data you attach, call IDs and join tokens, and what happened on each device, such as delivered, accepted, declined or missed, with the time.

• To deliver rings and notifications, and to show them to you in the Studio.
• To keep Lakolosy secure and working: rate limits, abuse prevention and fixing errors.
• To contact you about your account and important changes.

We do not sell personal data, show ads, or use data to profile anyone.

The Studio uses one cookie to keep you signed in. There are no analytics or advertising cookies, and this website loads its fonts from our own servers rather than from a third party.

• Cloudflare runs Lakolosy: hosting, the database, queues and storage.
• Apple Push Notification service delivers rings and pushes to iPhones. It receives device tokens and the push content.
• Firebase Cloud Messaging, by Google, does the same for Android phones.
• Cloudflare RealtimeKit hosts calls, under your own Cloudflare account, if you connect it.

These providers operate worldwide, so your data may be processed outside Madagascar.

• Delivery logs: 30 days.
• Rings and notifications: 90 days.
• Users and devices: until you delete them in the Studio or through the API.
• Apps: when you delete an app, it stops at once, and its users, devices, keys, credentials and history are erased within a few hours.
• Your account: until you ask us to delete it.

All traffic uses HTTPS. Credentials are encrypted, secret keys are hashed, and a ring token only works for one ring on one device. Only the members of your team can see your apps.

You can see and correct your account details in the Studio. To get a copy of your data, or to delete your account and everything in it, write to tianiazymarindrano@gmail.com. We answer within 30 days.

People who use an app built on Lakolosy should contact that app first, and we will help it answer. You can also complain to the data protection authority where you live.

Lakolosy is a tool for developers and is not meant for children under 16.

When this policy changes, we update the date at the top. Before important changes take effect, we tell you by email or in the Studio.

Questions about privacy: tianiazymarindrano@gmail.com. Marindrano, Madagascar.