Privacy Policy · Qabr Sync

Qabr Sync is an iPhone app that helps families privately save, find and preserve the resting places of loved ones. This policy explains what information Qabr Sync uses, why it uses it, and the choices you have. It applies to the Qabr Sync app and to this website.

In this policy, "we", "us" and "our" mean Qabr Sync, which operates the Qabr Sync app and this website.

The short version

Qabrs you save stay on your iPhone unless you turn on Cloud Backup or share them with a Family Circle.
We never receive your live location. Location is used only while you are using the app, to save a Qabr's position and to guide you back to it.
The app contains no advertising, no analytics trackers and no third-party software that collects information about you. We do not sell your information.
You can delete your account and its cloud data from inside the app at any time.

Information Qabr Sync uses

Qabr Sync works in two places: on your iPhone and, for some features, on servers we operate. Most of what you record stays on your phone. Information reaches our servers only when you sign in, turn on Cloud Backup, or take part in a Family Circle. The information involved is:

Account information: your email address, if you sign in.
Qabr information: the details you record about a loved one's resting place.
Location information: the saved position of a Qabr, and your phone's location while you save or find one.
Photos: the photograph you attach to a Qabr.
Family Circle information: the name you choose to show your family, and what you share or post in a circle.
Purchase information: whether you hold a Qabr+ subscription.
Technical information needed to run the service reliably.

What stays on your iPhone

If you use Qabr Sync without signing in and without joining a Family Circle, nothing you record is sent to us. Whatever you choose, the following never leave your phone:

personal notes on a Qabr and your favourites;
your private visit history, except that a visit you confirm on a Qabr shared with a Family Circle is posted to that circle as a moment, as described below;
the exact day and month of a birth or death (only the years and the burial date can be backed up or shared);
Family Legacy, the family tree you build, including the details and portraits of living relatives;
remembrance reminders, which are created and delivered by your phone;
your phone's live location, compass heading and the route you walk.

Information on your phone is protected by iOS and is removed when you delete the app.

Account information

You can use Qabr Sync without an account. An account is needed to use Cloud Backup, to create a Family Circle, and to buy Qabr+.

Signing in is passwordless. You enter your email address and we email you a six-digit code, which expires after ten minutes. We store your email address, the time it was verified, and records of your sign-in sessions. There is no password to store, and we do not store your name, your contacts, your Apple Account or any identifier of your phone. Sessions stay valid while you use the app, expire after 90 days without use, and end when you sign out.

To protect sign-in from abuse we keep a scrambled (hashed) form of the internet address a code was requested from, together with the code request itself, and clear them once they are more than 24 hours old.

You can join another family's circle without an account: an invitation code and a display name are enough. Your access is a secure key kept on your phone, and the circle's manager can end it at any time.

Qabr and family information

When you save a Qabr you can record a name, your relationship to the person, their gender, dates of birth, death and burial, the cemetery and city, a photograph, a personal note and the position of the Qabr. You can also keep a private record of visits and other moments.

Family Circle. A Family Circle is created by one person, the manager, who invites relatives with a code. Members join with a display name and, if they wish, their relationship to the family. That name is what the circle sees; members' email addresses are never shown to a circle.

A circle sees only what is deliberately shared with it: the Qabrs the manager has shared, with their written details, saved location and photograph, plus visits recorded against those Qabrs, planned visits, and the circle's updates feed. Visits are shown anonymously ("A family member visited") unless you choose to be named. Planned visits show the name you chose, so the family knows who is organising, together with any short note you add.

A member's own Qabrs never leave their phone unless the member submits one to the circle's manager. Submitting sends that Qabr's written details, its exact saved location and its photograph to the manager, and the Qabr becomes visible to the circle only if the manager approves it. The member is told this before sending.

Location information

Qabr Sync asks for your location only when you save a Qabr's position or use Find Qabr, and only while you are using the app ("While Using the App" permission). It never tracks you in the background. Your phone's live position is never sent to us and never stored: it is used on the phone to work out how far you are from a Qabr and which way to walk.

What is saved is the position of the Qabr itself: a single point with an accuracy radius, kept on your phone with the Qabr. Cloud Backup copies that saved position, and the few GPS readings used to calculate it, to our servers so your other devices can guide you again. Sharing a Qabr, or submitting one to a circle, sends its saved position (without the GPS readings) so that the family can use Find Qabr. Location guidance is approximate; the Qabr photo provides the final confirmation.

If you decline location access you can still save a Qabr without a position and use everything else in the app; only Find Qabr and location capture are unavailable. You can change the permission at any time in iOS Settings.

Photos

You can add a photograph to a Qabr with the camera or by choosing one from your photo library. Qabr Sync only receives the photo you choose; it cannot browse or read your library. Before a photo is stored it is reduced in size and re-saved without the original file's hidden data, so any location or camera details embedded in the photo are removed.

A photo is sent to our servers only when its Qabr is backed up with Cloud Backup, shared with a Family Circle, or submitted for a manager's approval. Photos are stored in a private store that is never publicly accessible, and can only be fetched by you and by the people the Qabr has been shared with. Copies of shared photos kept on a family member's phone are removed when that member leaves or is removed from the circle.

Choosing Save Photo writes a copy of a Qabr's photograph to your Photos library. The app asks permission to add photos only at that moment, and never asks for permission to read your library.

Cloud synchronisation

Cloud Backup is part of Qabr+. With Qabr+ and "Back up Qabrs on this device" turned on, the Qabrs saved under your account are copied to our servers automatically: their written details, saved position and the GPS readings behind it, their row position and reference Qabr, and their photograph. Personal notes, favourites, your visit history and the exact day and month of a birth or death are never backed up. Backup lets you restore your Qabrs on another iPhone signed into the same account.

When you sign in on a phone that already holds Qabrs, we ask before backing them up. When there are none, Qabrs you save from then on are backed up, as the sign-in screen explains. You can turn backup off or on at any time in Settings. Turning it off, or letting Qabr+ lapse, pauses uploads; nothing is deleted, and you keep access to everything already backed up.

Family Circle sharing works through the same servers. Sharing a Qabr stores a copy of it there so that the circle can see it, whether or not you use Cloud Backup.

Our servers are hosted for us by Microsoft Azure in the United Kingdom.

Purchases and subscriptions

Qabr+ is bought through Apple's App Store with your Apple Account. Apple handles payment; we never receive your card or billing details. To link the subscription to your Qabr Sync account, the app sends us the App Store transaction number, and we confirm it directly with Apple. We store Apple's transaction identifier, the plan, its expiry date and renewal status, tied to your account. Apple also notifies our servers when a subscription renews, expires, is refunded or is cancelled, so that Qabr+ stays accurate.

Deleting your Qabr Sync account does not cancel a Qabr+ subscription. See Account and data deletion.

Analytics and diagnostics

Qabr Sync contains no analytics, advertising or crash-reporting software from other companies, and does not use any identifier of your phone for tracking. The app sends us nothing about how you use it.

Our servers keep standard technical logs to keep the service reliable and secure: which part of the service was called, whether it succeeded, and error categories. They are designed to contain no email addresses, sign-in codes, tokens or Qabr details, and they are kept for 90 days.

If you have chosen in iOS Settings to share crash and usage data with app developers, Apple may pass anonymised crash reports to us. If you email us for support from the app, the message includes your app version and iOS version to help us diagnose problems; it never includes your Qabrs or family information.

How information is used

We use information to:

provide Qabr Sync's features: saving, finding, backing up and sharing Qabrs, visits, planned visits and Family Circle updates;
sign you in and keep your account secure;
send sign-in codes by email, the only automated emails the service sends;
provide Qabr+ and confirm your subscription status with Apple;
keep the service reliable, diagnose problems and prevent abuse;
respond when you contact us for support.

We do not use your information for advertising, we do not sell it, and we do not share it with data brokers.

We share information only in these situations:

With your Family Circle, when you share a Qabr, submit one, record a visit or post to the circle, as described above.
With Microsoft Azure, which hosts our servers, database, photo storage, monitoring and the delivery of sign-in code emails, in the United Kingdom. Microsoft processes this information only to provide those services to us.
With Apple, in connection with App Store purchases: we ask Apple to confirm Qabr+ transactions, and Apple sends us subscription updates.
When required by law, or to protect the rights, property or safety of Qabr Sync, our users or others.

We do not sell personal information, and our servers are located in the United Kingdom.

Data retention

Information on your phone stays there for as long as you keep it, and is removed when you delete the app. On our servers:

Sign-in codes and the hashed internet address that requested them are cleared once they are more than 24 hours old. Sign-in sessions end when you sign out and expire after 90 days without use.
Backed-up and shared Qabrs are kept until you delete the Qabr, your Family Circle or your account. When you delete a backed-up Qabr, its photograph is removed immediately; a hidden record of its written details is kept so that the deletion reaches your other devices and the Qabr can be restored if you save it again, and that record is erased with your account or circle.
When you leave a circle or are removed from it, the Qabrs you submitted stop being shared at once and any submission awaiting approval is withdrawn and its photograph deleted. A copy of each Qabr you submitted that had been approved, with its details, location and photograph, remains in that circle's storage, no longer visible to anyone, until the circle is deleted. Planned visits you posted are cancelled. Updates you posted with your name, such as a named visit, remain in that circle's history.
Backups and logs. Our database and photo storage keep short-term backups for up to 7 days after something is deleted, and technical logs are kept for 90 days.

Your rights and choices

Most of your choices are in the app. You can allow or refuse location access in iOS Settings, turn Cloud Backup on or off, share or stop sharing any Qabr, leave a Family Circle, delete individual Qabrs, turn remembrance reminders on or off, sign out, and delete your account.

Depending on where you live, you may also have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to complain to a data protection authority. To exercise any of these rights, contact us using the details below.

Account and data deletion

You can delete your account from inside the app: Settings → Qabr Sync Account → Manage Account → Delete Qabr Sync Account. The app explains what will happen and asks you to confirm twice. You can also email qabrsync@gmail.com with the subject "Deletion request" and we will delete your account for you.

Deleting your account immediately and permanently removes your account and email address, signs out every device, deletes your backed-up Qabrs and their photographs, deletes your own Family Circle (its members lose access to what was shared with them), and ends your memberships in other families' circles as described under Data retention. Deleted information may remain in short-term backups for up to 7 days.

Two things remain. First, if you bought Qabr+, a record that ties that subscription to your former account is kept so that nobody else can claim it; it contains only Apple's transaction identifier and an internal account number, never your email address or name. Second, updates you posted with your name in another family's circle remain in that circle's history.

Deleting your account does not cancel a Qabr+ subscription. Subscriptions are managed in your Apple Account's subscription settings, and the app offers to open them before you delete. A subscription bought under a deleted account cannot be linked to a new account by the app; contact us if you need help with this.

Deleting your account does not erase the app's data on your phone. Qabrs saved under the account stop being available on that phone; Qabrs saved while signed out are unaffected. Deleting the app removes everything on the phone.

Children's privacy

Qabr Sync is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Security

The app talks to our servers only over encrypted HTTPS connections, and our database and photo storage accept encrypted connections only. Sign-in codes, session keys and Family Circle keys are stored on our servers only in scrambled (hashed) form, so a copy of the database would not reveal them. Photographs are kept in a private store that is never publicly accessible, and our hosting provider encrypts stored data. Server credentials are kept in a managed secrets store, not in the app.

On your phone, Qabr Sync's files are protected by iOS data protection, so they are encrypted while the phone is locked, and your sign-in and circle keys are kept in the iOS Keychain, tied to that phone, so a backup cannot carry them to another device.

No method of storage or transmission is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond quickly if something goes wrong.

Changes to this policy

We may update this policy from time to time. The current version is always on this page, with its date at the top. If we make a significant change, we will say so here.

Contact

If you have a question or request about privacy, email qabrsync@gmail.com.