Privacy

Who we are

Tor is an appointment, client-book and invoicing app for independent professionals. The service lives at tor-app.com.

This page says what the app records, where it keeps it, for how long, and what you can do about it. It is written to be read in full.

Two people, two situations

Tor involves two people who are not in the same position, and almost everything else on this page follows from that.

• The professional opens an account, accepts the terms of use and decides what to record. For what concerns them, we are the data controller.
• Their client installs nothing and opens no account. They book, receive a message, open a link. What is recorded about them belongs to the professional: they collect it, they decide to keep it, they answer for it. We only host it on their behalf. In GDPR terms: they are the controller, we are the processor.

This is not a legal formality. It is the reason we do not read a professional’s client book, do not use it for anything, and show it to nobody.

What we keep about the professional

• The account’s email address and password. The password is never kept as such: we hold only a fingerprint of it, and we cannot read it back.
• The business details: name, booking page address, phone, email, address, logo, time zone, language, currency.
• The diary settings: slot length, minimum notice before an appointment, how far ahead clients may book, the cancellation notice, when the reminder goes out.
• The catalogue: services, durations, prices, photos.
• The books: receipts, invoices, payments, expenses.
• A device identifier, if notifications are on, so that this phone and no other can be alerted.
• A log of what was done in the account, used to understand an incident.

What the professional records about their clients

They enter it themselves, or the client fills it in when booking on the public page.

• First name, last name (optional), phone number, email address (optional).
• A photo, a date of birth, the language to write to them in: all three optional.
• Details some trades use — marital status, number of children, student — all optional.
• Their appointments, the notes the professional writes about them, their receipts, the rating they left.
• Whether they agreed to receive offers, when, and who recorded it; if they later asked to stop, when.

Age is never stored: it is recomputed from the date of birth at the moment it is shown, so that it is not wrong for the rest of the year.

The client agreed to nothing with us. What they agreed, they agreed with their professional. That is why a request to correct or erase goes through them.

The health declaration

Some trades have a declaration signed before a treatment. That is health data, and it is handled differently from everything else.

• It sits in a separate database that no ordinary query from the app can reach. The only way in is a named function that checks the professional is the one asking, and returns one declaration at a time.
• It is never used for anything else: no statistic, no selection, no campaign, no message. That impossibility is written into the database’s privileges, not into a good intention.
• It appears in no technical report.
• When an account is deleted, it is erased explicitly, and before everything else.

We do not read it. It was signed between a client and their professional, and it is not our business.

The booking page

A business’s public page counts its visits, so the professional knows whether it is working. A visit records the date, the page opened, the page it was reached from, and the language. No IP address, no identifier, no cookie: nothing that would let two visits by the same person be recognised.

The site uses no cookies, on any page. The chosen language and a started booking are kept in the tab for the length of the visit, and disappear when it closes.

The link a client receives carries a key that opens their appointment and nothing else. If that key turns up in a referring address, it is removed before the visit is recorded.

No audience measurement, no ad network and no outside script runs on the site.

Messages and notifications

The professional can send messages themselves: the app prepares the text, they pick SMS, WhatsApp or email, and their phone sends it. We do not see the conversation. The app keeps a record of what was prepared and when, so that the same thing is not offered twice.

If they turn on automatic SMS — confirmation, reminder, receipt — or send an offer, our server sends the SMS on their behalf, under the sender name “tor-app”, through an SMS provider. We do it for them, following their settings, never for ourselves. We keep the text, the time it was sent and the provider’s answer, so nothing is sent twice and their monthly budget is kept.

The professional does receive notifications on their phone — a booking request, tomorrow’s schedule. Those go through Google’s notification service (Firebase). They are short and never carry health data.

Crash reports

If the app closes on its own, a report goes to Firebase Crashlytics (Google): the call stack, the device model, the OS version, the app version, the language, and the identifier of the open business — a business, not a person.

A report never carries the original error message, because a server sometimes copies the value it has just refused into it. It carries no name, number, email, note, declaration answer or receipt content.

There is no audience measurement in the app: Google Analytics is not installed in it, and the crash report is the only send of this kind.

What we do not do

• We do not sell, rent or trade any data.
• We show no advertising and work with no ad network.
• We do not read a professional’s client book — unless they ask us for help with a specific problem, and only for as long as it takes to fix it.
• We build no profile and cross-reference nothing from one business to another.
• We train no model on your data.

Where all this lives

• The database and the files are with Supabase, in a data centre in Frankfurt, Germany.
• Notifications and crash reports go through Firebase (Google).
• The SMS our server sends go through an SMS provider.
• The site and the booking pages are served by Cloudflare Pages.

Everything travels over an encrypted connection. The files — client photos, receipts, declarations — are private; only service photos, which the professional publishes on their own page, are visible without an account.

Each business is separated from the others by rules the database itself enforces, not the app: a query that would step outside its business is refused by the server, whatever code sent it.

For how long

As long as the account exists. The professional can erase a client from their book at any time; that client’s health declarations go with them.

When the professional deletes their account, everything goes: the business, the catalogue, the clients, the appointments, the notes, the messages, the ratings, the books, the files, and the account itself. Health declarations are deleted explicitly, before the rest.

We keep no copy. Bookkeeping retention duties fall on the professional, not on us: that is why the app lets you export everything before leaving.

Your rights

If you are a professional: you can see, correct, export and delete what concerns you from inside the app, without writing to us and without waiting.

If you are the client of a professional who uses Tor: the record about you is theirs, not ours. Ask them — they can show, correct or erase what they recorded, straight from the app. If you write to us, we will pass it on and change nothing ourselves: that data is not ours.

A professional’s offers by SMS go only to clients who agreed to them: by ticking the box on the booking page, or by telling the professional, who records it. Every offer SMS ends with a link to stop them, and that link opens nothing else. Stopping offers stops only offers: a confirmation, a reminder or a receipt is part of the appointment itself, and keeps coming.

Writing to us

showfar.dev@gmail.com — in English, French or Hebrew.

This page changes when the app changes. The date at the top says when, and significant changes are announced in the app before they take effect.