Privacy Policy

1. Overview

GeoSync is a B2B field team management platform. The application is used by organizations (tenants) to manage their field employees. This creates a three-party relationship:

• Developer (Us): Akhlak Hossain Jim — the creator and operator of the GeoSync platform.
• Tenant Organization: The company or business that subscribes to GeoSync and deploys it for their team.
• End Users: Employees, managers, and admins who use the app at the direction of the tenant organization.

By downloading, installing, or using GeoSync, you agree to the data practices described in this policy. If you are using GeoSync as an employee assigned by your employer, your employer's use of your data is governed by their own internal policies, and they are the data controller for your activity data within their organization.

2. Data We Collect

We collect the following categories of information when you use GeoSync:

2.1 Account & Identity Information

• Full name and email address (used for authentication via Supabase Auth)
• Organization name and ID
• User role (Super Admin, Admin, Manager, or Employee)
• Profile photo (if provided)
• Device information (push notification tokens)

2.2 Location Data

• Precise GPS coordinates (latitude/longitude) at check-in, check-out, break start, and break end
• Background location data when the app is active and tracking is enabled
• Historical route data (movement paths recorded during tracked work sessions)
• Location attached to expense submissions

2.3 Work & Activity Data

• Task assignments, statuses, progress notes, and completion records
• Attendance records: check-in/check-out timestamps and calculated work hours
• Break start and end times and locations
• CRM data: leads, client interactions, visit notes, and pipeline stages
• Expense reports and receipt data

2.4 Automatically Collected Information

• App usage patterns and session information
• Error logs and crash reports
• Device type, operating system version, and app version
• Push notification engagement data

3. Location Data — Special Notice

Location data is the central feature of GeoSync. Here is exactly how your location is used:

• When collected: Location is recorded at specific events (check-in, check-out, break management) and periodically during active tracked sessions.
• Who can see it: Your Managers, Admins, and Super Admins within your organization can view your real-time and historical location.
• Why it is needed: To enable territory verification, route history playback, attendance confirmation, and client visit tracking.
• Storage: Location data is stored in our secured Supabase PostgreSQL database with row-level security (RLS) policies ensuring only authorized personnel within your organization can access your data.
• Opt-out: You may revoke location permissions in your device settings, but this will prevent core app functionality from working. Contact your employer or organization admin for adjustments to tracking policies.

4. How We Use Your Data

We use collected data for the following purposes:

• Core App Functionality: To enable attendance tracking, real-time team mapping, task management, and CRM features.
• Authentication & Security: To verify your identity, manage sessions, and protect your account.
• Organization Management: To provide tenant organizations with oversight tools, analytics, and reporting.
• Push Notifications: To send task assignments, follow-up reminders, and operational alerts.
• App Improvement: To analyze usage patterns, fix bugs, and improve features (using anonymized or aggregated data).
• Legal Compliance: To comply with applicable laws and respond to lawful requests from authorities.

We do not use your personal data for advertising, sell your data to third parties, or use it for purposes unrelated to GeoSync's field management functionality.

5. Data Sharing

GeoSync shares data only in the following limited circumstances:

• Within Your Organization: Your activity data (location, attendance, tasks) is visible to authorized members of your organization (Managers, Admins, Super Admins) as determined by your employer.
• Service Providers:
  • →Supabase: Database, authentication, and real-time infrastructure
  • →Expo / EAS: App build and push notification delivery
  • →MapLibre / OpenStreetMap: Map tile rendering (no personal data shared)
• Legal Requirements: We may disclose data when required by law, court order, or to protect the rights, property, or safety of GeoSync, its users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale, your data may be transferred to the acquiring entity with adequate privacy protections in place.

We do not sell, rent, or trade personal data to any third party for commercial purposes.

6. Data Retention

We retain your data for as long as your account is active or as required to provide services to your organization:

• Account Data: Retained while your account is active. Deleted within 30 days of account deletion request.
• Location History: Retained for up to 12 months of operational history, then automatically archived or deleted.
• Attendance Records: Retained for the duration of employment tracking as required by your tenant organization's data retention policy.
• Task & CRM Data: Retained for the life of the tenant subscription, and for 30 days after subscription termination.
• Archived Tasks: Data that has been archived by a manager is retained in a non-active state for compliance purposes.

You may request deletion of your data at any time. See the Your Rights section or visit our Account Deletion page.

7. Your Rights

Depending on your location and applicable law, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("Right to be Forgotten"). See Account Deletion.
• Right to Restrict Processing: Request that we limit how we process your data in certain circumstances.
• Right to Data Portability: Request your data in a portable, machine-readable format.
• Right to Object: Object to processing of your data for certain purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise your rights, contact us at support@geosync.app or visit our Account Deletion page.

8. Security

We take data security seriously and implement industry-standard protections:

• Encryption in Transit: All data is transmitted over HTTPS/TLS encrypted connections.
• Encryption at Rest: Data is encrypted at rest within our Supabase infrastructure.
• Row-Level Security (RLS): PostgreSQL RLS policies ensure that users can only access data belonging to their organization.
• Authentication: Secure session management through Supabase Auth with JWT tokens stored in device secure storage (Expo SecureStore).
• Role-Based Access Control: Strict RBAC ensures each user can only see and modify data appropriate to their role.
• No Data Selling: Your data is never sold, shared with advertisers, or used for commercial purposes outside of GeoSync's stated functionality.

While we implement robust security measures, no system can guarantee 100% security. We encourage users to use strong passwords and report any security concerns to security@geosync.app.

9. Children's Privacy

GeoSync is a professional business application intended exclusively for use by adults (18+) in a commercial employment context. We do not knowingly collect personal data from individuals under the age of 18.

If you believe a minor has provided us with personal data, please contact us immediately at support@geosync.app and we will promptly delete such data.

10. Third-Party Services & SDKs

GeoSync integrates the following third-party services, each subject to their own privacy policies:

• Supabase (supabase.com) — Database, authentication, and real-time subscriptions. Privacy Policy
• Expo / EAS (expo.dev) — App infrastructure and push notification delivery. Privacy Policy
• OpenStreetMap (openstreetmap.org) — Map tile data. No personal data is transmitted to OSM. Privacy Policy
• MapLibre — Open-source map rendering library. No data collected.
• Google Play Services — For app distribution and push notifications on Android.

11. Policy Changes

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last updated" date at the top of this page.
• For material changes, we will notify users through in-app notifications or email.
• Continued use of GeoSync after policy changes constitutes acceptance of the updated policy.

We encourage you to review this policy periodically. Previous versions are available upon request.

12. Contact Us

For privacy-related inquiries, data access requests, or to report a security concern:

We aim to respond to all privacy requests within 30 days.