1. Introduction
COSBRIK is a construction and business operations mobile application provided by COSBRIK ("we," "us," or "our"). This Privacy Policy explains what information the COSBRIK mobile app uses, how that information is used, and the choices available to users.
This policy is intended to describe the current behavior of the mobile app as implemented at the time of this update. If you do not agree with this policy, do not use the app.
2. Scope
This policy applies to the COSBRIK mobile app and information processed through the app. It does not govern the privacy practices of third-party websites, app stores, device manufacturers, or operating-system providers that may also interact with your device or app distribution.
3. Information We Process
3.1 Information you provide when signing in or using the app
Depending on your role and how your organization uses COSBRIK, the app may process:
- Email address used to sign in
- Password entered at sign-in
- Your name and profile details returned by the COSBRIK backend
- Company, role, and site assignment information associated with your account
- Business records you create, view, update, or approve in the app, such as site, material, ledger, payment, customer, supplier, or other operational data
- Images or attachments that you choose to capture or upload through app features
3.2 Authentication and device-related data
To support secure sign-in and session management, the app processes:
- Access tokens used for authenticated API requests
- Refresh tokens used to renew sessions
- A generated device identifier used by the backend login flow
- A biometric-login preference stored on the device
- Optional saved credentials on the device when the user enables convenience features tied to biometric sign-in
3.3 Biometric authentication
If you enable biometric sign-in, the app uses the biometric capabilities exposed by your device operating system, such as fingerprint or face authentication.
- We do not receive or store your raw fingerprint, face scan, or other biometric template on our servers.
- Biometric matching is handled by your device and operating system.
- The app only receives the result of whether local authentication succeeded.
3.4 Images, camera, and photo selection
Some features allow you to attach images for operational records.
- If you choose to take a photo, the app may request camera access.
- If you choose to upload an existing image, the app may request access to photos or media made available by the operating system.
- The app accesses images only when you initiate those actions.
3.5 Automatically processed technical data
When the app communicates with the backend, standard technical information may be processed by our systems or infrastructure, such as:
- IP address
- Request metadata
- Device-generated identifiers used for session handling
- Error and diagnostic information needed to operate and secure the service
4. How We Use Information
We use information processed through the app for the following purposes:
- To authenticate users and maintain active sessions
- To provide role-based access to business features and data
- To store and retrieve records needed for construction, finance, sales, material, and site workflows
- To support optional biometric sign-in on the user’s device
- To upload, display, and manage user-selected images and related records
- To protect the service, investigate misuse, and maintain operational security
- To comply with applicable law, lawful requests, and internal recordkeeping needs
5. What the App Stores on the Device
The mobile app stores a limited set of data locally on the device, including:
- Access token in app memory during an active session
- Refresh token in secure device storage
- Generated device identifier in secure device storage
- Optional saved email and password in secure device storage when the user enables biometric convenience flows
- Biometric-enabled preference in secure device storage
Locally stored data is used to keep users signed in, support session refresh, and allow optional biometric login behavior.
6. Data Sharing and Disclosure
We do not sell personal information.
We may disclose or make information available only in limited situations such as:
- To service providers or infrastructure providers that host or support the backend service
- Within your organization, to authorized users based on role and permissions
- When required by law, regulation, court order, or valid governmental request
- As part of a merger, acquisition, financing, reorganization, or asset transfer
- To protect the rights, security, and operation of COSBRIK, our users, or others
7. Third-Party and Platform Dependencies
The app relies on platform and software components that may process limited technical information as part of providing their function, including:
- Google Play and Android platform services used to distribute and run the app
- Device biometric frameworks used for local authentication
- Secure local storage mechanisms provided by the device platform
These third parties operate under their own terms and privacy practices.
8. Data Retention
We keep data for as long as reasonably necessary for operational, contractual, legal, security, and recordkeeping purposes.
- Data stored locally on the device may remain until the user signs out, disables a feature, clears app data, or uninstalls the app, subject to device behavior.
- Backend records may be retained for legitimate business and compliance purposes even if a user stops using the app.
9. Security
We use reasonable administrative, technical, and organizational measures intended to protect information processed through the app. No method of storage, transmission, or electronic processing is completely secure, and we cannot guarantee absolute security.
10. Your Choices
Depending on your device and organizational use of COSBRIK, you may be able to:
- Choose whether to enable biometric sign-in
- Decline camera or photo access permissions
- Remove the app from your device
- Request account, profile, or data assistance through your organization or by contacting us
If you want locally stored credentials removed from the device, you should sign out, disable biometric login if enabled, and clear app data or uninstall the app if needed.
11. Children
COSBRIK is a business application and is not intended for children.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date above. Continued use of the app after an update means the updated policy will apply going forward.
13. Contact Us
14. Android Permissions Summary
At the time of this update, the Android app manifest explicitly declares:
- INTERNET for backend communication
- USE_FINGERPRINT and USE_BIOMETRIC for optional biometric authentication
In addition, app features may trigger operating-system-managed camera or photo-selection access when the user chooses to capture or upload images.