Privacy policy — TourCheck Mobile
This notice covers the TourCheck mobile app (Android and iOS) — a companion for the TourCheck Nextcloud round & checkpoint documentation app on your organisation’s server.
Last updated: 14 October 2026
Publisher
Software by Design GbRHusumer Baum 2
24837 Schleswig, Germany
Email: info@software-by-design.de
Privacy: datenschutz@software-by-design.de
1. Scope
Software by Design does not operate a central cloud that stores your guard rounds, checkpoints, or evidence. Your employer or IT provider operates the Nextcloud you connect to.
2. Who is responsible?
| Data | Typical controller |
|---|---|
| Rounds, checkpoint events, incident reports, position data on the server | Your organisation (Nextcloud operator) |
| App on your device | You choose the server; employer policies apply to server data |
| Publisher of the mobile app | Software by Design GbR (this policy) |
3. Data on your device
- Nextcloud server URL and Login Flow app password (never your main password) — or a station pairing secret — in the device secure store (Keychain / Keystore)
- Offline evidence queue and cached rounds — encrypted on the device (AES-256-GCM, key in the secure store)
- Locale / theme preferences
4. Data sent to your server
Checkpoint confirmations, incident reports with the photos, voice notes, and signatures you create, panic/SOS signals, and offline-queue syncs — only to the Nextcloud URL you or your organisation configured. Production builds use HTTPS.
5. Location — only when your site turns it on
- Geo-stamps are attached to checkpoint evidence only when the site enabled them
- Live position streams only while a round is active on a site that turned on live tracking — always with a visible indicator, never covertly
- Position data is deleted automatically after the retention period configured by your organisation
- The app never records activity recognition
6. Permissions
- Network — HTTPS to your Nextcloud
- Camera — scan checkpoint QR codes and attach evidence photos
- NFC — read checkpoint tags
- Microphone — voice notes for incidents
- Location — geo-stamps and the opt-in live position described above
- Notifications — round and sync status
7. What we do not do
- No advertising or analytics SDKs in the app
- No sale of personal data
- No transfer of your data to a Software by Design central cloud
- No background tracking without the visible opt-in described above
8. License seats (TCK2)
Named mobile seats use TCK2 license envelopes verified with a public key embedded in the app. That check does not phone home to Software by Design with your round or position data.
9. Your rights (GDPR)
Ask your employer / Nextcloud admin for access, correction, or deletion of server records. Contact us for questions about the published app binary.
10. Children
The app is intended for workplace use by adults (guards, facility and safety staff).
11. Changes
We may update this page when the app changes. The date above is authoritative for this document.