Caravan — Privacy Policy
Last updated 15 September 2026. Caravan is a private task-management app for the staff of Vishwakarma Developers (“we”, “us”). It is not available to the public and is distributed only to our own staff.
ટૂંકમાં
Caravan એ ફક્ત અમારા સ્ટાફ માટેની ઍપ છે. તે તમારું નામ, વપરાશકર્તા નામ, તમે બનાવેલાં કાર્યો, ટિપ્પણીઓ અને તમે રેકોર્ડ કરેલી અવાજ-નોંધ સાચવે છે. તે તમારું સ્થાન, સંપર્કો કે ફોટા વાંચતી નથી. તેમાં કોઈ જાહેરાત નથી અને અમે તમારી માહિતી કોઈને વેચતા નથી.
આ ફક્ત સારાંશ છે. નીચેની અંગ્રેજી વિગત જ અધિકૃત છે.
What the app collects
| Data | Why | Kept |
|---|---|---|
| Name and username | To identify who created, was assigned, or commented on a task. | While your account exists. |
| Email address (optional) | Account notices only, when an administrator has recorded one. Many accounts have none. | While your account exists. |
| Tasks, comments, projects | The content of the app: what you write is what the app is for. | Until deleted by you or an administrator. |
| Voice notes | Audio you record and attach to a task, in place of typing. | Automatically deleted 12 months after recording. |
| Sign-in credentials | The public half of the passkey your phone creates. We never receive your fingerprint, face, screen lock, or the private key. | Until the passkey is removed. |
| Sign-in activity | Times of sign-in and failed attempts, to lock an account under attack and to keep an audit trail. | While your account exists. |
| Notification token | An identifier for your handset, issued by Google, so notifications reach the right device. | Until you sign out or the token stops working. |
What the app does not collect
- Your location. The app has no location permission and never requests one.
- Your contacts, calendar, photos, files, SMS, or call history.
- Any advertising identifier. There are no adverts and no advertising SDKs.
- Analytics or behavioural tracking. There is no analytics or crash-reporting SDK in the app.
- Biometric data. Your fingerprint or face is checked by your phone, and never leaves it.
Permissions the app asks for
- Microphone — only while you are recording a voice note, and only when you press record.
- Notifications — to tell you a task was assigned to you or someone commented. You can refuse, and the app still works.
- Network access — to reach our server.
Notifications contain no content
A notification says that a task was assigned to you, or that someone commented on a task you can see. It never contains the task’s title, its description, or the text of a comment. Google delivers it, so Google sees the notification — which is exactly why there is nothing in it to see.
Who else is involved
- Amazon Web Services hosts the server and stores voice notes, in the Asia Pacific (Mumbai) region. Your tasks, comments and recordings are held there.
- Google (Firebase Cloud Messaging) delivers notifications. It issues the device token described above, and a separate installation identifier for the app on your handset. Google’s delivery network is international, so a notification — which carries no task content — may pass outside India on its way to you.
We do not sell your data, and we do not share it with anyone for advertising, marketing, or any other purpose beyond running the app.
What is stored on your phone
The app keeps a copy of your tasks on the handset so it works without a signal, holds a voice note you recorded until the server accepts it, and stores your sign-in token in the phone’s secure keystore (Android Keystore / iOS Keychain). Signing out erases all of it, including any voice note not yet sent — which is deliberate, because these handsets are sometimes shared.
How it is protected
- Everything between the app and the server travels over HTTPS.
- Sign-in uses a passkey held in your phone’s secure hardware; there is no password to steal or reuse after your first sign-in.
- Sessions can be ended remotely by an administrator at any time.
- Accounts lock themselves temporarily after repeated failed sign-ins.
- You can only see tasks you created, were assigned, or that belong to a project you are a member of. This is enforced by the server, not by the app.
Your choices, and deleting your data
Accounts are created and managed by an administrator — you cannot sign up for Caravan yourself, and there is no public registration. To see what we hold about you, correct it, or ask for your account and its data to be deleted, contact us at pruthviraj@vishwakarma.one or speak to your administrator. We will respond within 30 days.
Some records must outlive an account for the app to stay coherent — a task you created still shows who created it, and the security audit trail records who did what. Where that applies, we disable the account and remove or anonymise what we can, rather than leaving your data live.
Children
Caravan is a workplace tool issued to our staff. It is not directed at children and is not available to anyone under 18.
Changes
If this policy changes we will update this page and the date at the top. If a change is significant, staff will be told directly rather than being expected to notice.