Hesabak Privacy Policy

01Introduction

This Privacy Policy describes how Hesabak ("we", "our", or "the app") handles information when you use our accounting application on Windows, macOS, Linux or Android. We are committed to protecting your privacy, and to describing honestly what the app does rather than claiming to do less.

02Information We Collect

To sign you in and to manage your licence, our account server receives:

• Your mobile phone number
• The one-time code you type in, to confirm that the number is yours
• A device code: a salted SHA-256 hash of your computer's hardware identifier, so that the number of devices on your licence can be counted. The identifier itself never leaves your device.
• Your device name (the computer's name in your operating system), its platform (for example Windows or Android) and the app version, so that you can tell your devices apart
• The business or account holder name you entered in Settings, if any, so that support can recognise your account

From these, the server keeps your licence status, its expiry date and the list of your signed-in devices. We use this information only to sign you in, to check your licence and to help you when you contact support.

03What We Do NOT Collect

We do not collect, store, process, or have access to:

• Your accounting data: invoices, customers and suppliers, products and stock, bank and cash accounts, cheques, expenses, production or payroll
• The usernames and passwords of the people who use the app in your business
• Your books password or your database password (except when you ask us to text it to you; see below)
• Advertising identifiers or tracking IDs
• Location data (the app never requests location permission)
• Photos, camera access, contacts or call information
• Bank card numbers or other payment details
• Analytics, usage statistics or behavioural profiles

04Permissions

On Android, Hesabak asks only for internet access, which it needs for signing in, checking your licence, checking for updates and, if you use one, connecting to a PostgreSQL server.

When you add a logo or restore a backup, you pick the file yourself in your system's file picker, and the app reads only that file. The app does not request location, camera, microphone, contacts, or general access to your files.

05Data Storage

You choose where your books are kept:

• On this device (the default). Your books are stored in encrypted files in the app's own folder and never leave your device unless you copy or back them up yourself.
• On a PostgreSQL server. The server is one that you or your business choose and run, not one of ours. You can protect the books with a books password: every record is then encrypted with AES-256-GCM before it leaves the app, so the server and its backups hold only ciphertext. While the app is connected, it also keeps a copy of your books on this device, so that you can keep viewing them, and changes that have not reached the server yet are not lost.

Backups you make are saved wherever you choose to save them. Uninstalling the app does not delete backups you have saved elsewhere, or books kept on a PostgreSQL server.

06Internet Connections the App Makes

Hesabak connects to the following services:

• Our account server (api.boofismart.ir) — to sign in with a one-time code, to check your licence every few days, to sign a device out, and to text you a password when you ask. It receives the information listed under "Information We Collect".
• Our update server (storage.boofismart.ir) — to check whether a newer version is available and, on Windows, to download the installer when you agree to it. No personal information is sent.
• The exchange-rate service you choose (open.er-api.com, or an address you enter) — only if you turn on automatic exchange rates in Settings. It is off by default, and no personal information is sent.
• The official PostgreSQL download sites (postgresql.org and enterprisedb.com) — only if you choose to install PostgreSQL from inside the app.
• Your PostgreSQL server — only if you choose to keep your books on one.

As with any internet request, these servers can see your IP address and the time of the request. We do not use that information to identify or profile you.

07Texting a Password to You

If you forget the password of your books or of your PostgreSQL database, you can ask the app to text it to you. The password is then sent over HTTPS to our account server, which passes it to an SMS provider to text it to your own signed-in phone number, and to no other number. This happens only when you confirm it, and we do not keep the password after the message is sent. If you prefer that the password never leaves your device, simply do not use this option.

08Third-Party Services

Hesabak uses a small number of third-party services, strictly to deliver features you ask for:

• An SMS provider — to deliver your sign-in code, and a password you ask us to text to you
• open.er-api.com — for exchange rates, only if you turn this on
• postgresql.org and EnterpriseDB — for the PostgreSQL installer, only if you install it from the app

The app does NOT integrate with:

• Any analytics or crash-reporting service
• Any advertising network
• Any social media platform
• Any tracking or data-collection tool

09Advertisements and Monetization

Hesabak is sold as a licence for a number of devices. There are no advertisements in the app. We do not:

• Display advertisements
• Collect data for advertising purposes
• Share information with advertising networks
• Sell or rent data to anyone

10Children's Privacy

Hesabak is business software, intended for adults who keep the accounts of a shop or company. It is not directed at children, and we do not knowingly collect personal information from children under 13. If you believe a child has signed in with their phone number, contact us and we will delete it.

11Data Security

All connections to our servers use encrypted HTTPS. Books stored on your device are kept in encrypted files, and each person in your business signs in with their own username and password, which are stored only as salted hashes. On a PostgreSQL server, a books password encrypts every record before it is sent, and connections to the server can be secured with TLS. Your device's own security, and the security of any PostgreSQL server you choose, also protect your data, so keep them up to date.

12Your Rights and Choices

You remain in control at all times:

• Keep your books only on your device, or move them to a PostgreSQL server and back, whenever you like
• Export a backup of your books at any time
• Sign a device out in Settings, which removes it from your licence
• Leave automatic exchange rates switched off
• Delete all local data by uninstalling the app, or with the factory reset in Settings

You can ask us at any time for a copy of the information our account server holds about your phone number, to correct it, or to delete it. Deleting it ends your licence, because the licence is tied to the number.

13International Users

Hesabak can be used anywhere. Our account and update servers are located in Iran, so your phone number and device information are processed there. Your books are never sent to our servers.

14Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the app or in legal requirements. We will notify you of any significant changes by:

• Updating the "Effective Date" at the top of this policy
• Posting the updated policy in the app and on our website

We encourage you to review this Privacy Policy periodically. Continued use of the app after changes constitutes acceptance of the updated policy.

15Contact Us

If you have any questions, concerns, or suggestions regarding this Privacy Policy or Hesabak, please feel free to contact us at:

Email: amin.joharinia@gmail.com
Telegram: @BoofiSmart
Developer: Amin Joharinia

16Compliance

This Privacy Policy is intended to comply with:

• Google Play Store policies, including the Data Safety declaration
• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Children's Online Privacy Protection Act (COPPA)
• Other applicable privacy laws and regulations