This is an English translation for your convenience. The Russian version is the governing one; if the two differ, the Russian version prevails.
1. General
1.1. This privacy policy (the "Policy") applies to all information that the owner of the Skladik app ("we", the "Operator") receives about users of the Skladik mobile app for iOS and Android, the website https://skladik.io and the API at api.skladik.io (together, the "Service").
1.2. The Policy follows Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data". For users located in the European Union we also comply with Regulation (EU) 2016/679 (GDPR) to the extent it applies to us.
1.3. By using the Service you confirm that you have read the Policy. Processing needed to sign in and run your account is based on the Terms of Use; where the law requires consent, we obtain it separately — see Consent to data processing.
1.4. The Service is not meant for special categories of personal data (health, beliefs, etc.) or biometric data. Please don't store such information in item descriptions and notes.
2. Data we process
2.1. Data you enter yourself
| Data | What exactly | Required? |
|---|---|---|
| Phone number | Used as your login: the confirmation code is sent to it | Yes — you cannot sign in without it |
| Name | Shown to members of your team | No |
| Stockroom contents | Folders and storage places, items, quantities, prices, notes, tags, custom fields, codes and labels, activity history, jobs, stock counts, pick lists, vendors, orders, alert rules, reports, imported files | No — this is what you use the Service for |
| Photos | Photos of items and folders, pictures for AI features, photos of receipts | No |
| Other people's data | Names and contacts of people you lend items to; vendor details; phone numbers of people you invite to a team | No |
| Settings | Theme, accent colour, button, printing and notification settings | No |
| Integrations | Webhook URLs and settings of the API keys you create | No |
Other people's data. If you enter information about other people into the Service (for example, who borrowed an item), you are responsible for having the right to do so. We process such information only on your instructions and only to run your stockroom.
2.2. Data collected automatically
| Data | What exactly |
|---|---|
| Server request log | IP address, time, request address and method, response code, duration, app version, client software (User-Agent), account ID, and the JSON contents of requests and responses — except sign-in, API keys and webhooks, which are not recorded at all; tokens, keys and secrets in other requests are masked |
| Sign-in sessions | Time of sign-in and last activity, IP address, client software — so you can see your devices and we can end a session |
| SMS log | Phone number, text of the message sent (it contains the code), time, delivery status, delivery channel |
| Confirmation code | Stored only as a cryptographic hash; valid for 5 minutes, then the record is deleted within a day |
| Push token | Device identifier for Firebase Cloud Messaging notifications — if you allowed notifications |
| Crash and performance reports | Error description and stack trace, device model, OS and app version, IP address, headers of the app's network requests, app log, performance measurements. On an error and in 10 % of regular sessions — a screen recording with text and images masked |
| Usage statistics (Android only) | App launches and usage, device model and OS version, app instance ID — collected by Google Analytics for Firebase, built into the Android version |
2.3. We do not collect your location, your address book, advertising identifiers, and we don't track you across other apps and websites.
3. Purposes and legal grounds
| Purpose | Data | Legal ground |
|---|---|---|
| Registration, sign-in, running your account | Phone number, code, sessions | Performance of the Terms of Use (Art. 6(1)(5) of 152-FZ; Art. 6(1)(b) GDPR) |
| Storing and syncing your stockroom, teamwork | Stockroom contents, photos, name | Performance of the Terms of Use |
| AI features (recognition from a photo, placement suggestions, receipt parsing) | The picture and the data needed for the answer | Performance of the Terms — only when you start the feature yourself |
| Notifications | Push token, notification text | Your consent — the system notification permission |
| Abuse prevention, SMS cost accounting, incident investigation | Request and SMS logs, IP addresses | Legitimate interests of the Operator (Art. 6(1)(7) of 152-FZ; Art. 6(1)(f) GDPR) |
| Fixing errors and improving stability | Crash reports, usage statistics | Legitimate interests of the Operator |
| Answering your messages | Your email address and the message | Your request (Art. 6(1)(5) of 152-FZ) |
| Complying with the law | Data requested in due legal form | Law (Art. 6(1)(2) of 152-FZ) |
3.1. We do not use your data for advertising, don't sell it and don't share it with third parties for marketing. Decisions with legal effects for you are not made solely by automated means.
4. Device permissions
- Camera — to scan codes and photograph items. Viewfinder frames are recognised on the device and are not sent anywhere; only pictures you save or send to an AI feature go to the server.
- Photos — to pick a picture from your gallery or save a label as an image.
- Bluetooth — only to print labels on a thermal printer.
- Location (may be requested on Android) — the system requires it to search for nearby Bluetooth devices. The app does not determine, store or send your location.
- Notifications — for alerts about stockroom and team events.
You can revoke any permission in your device settings; the related feature will stop working, the rest will keep working.
5. Who receives the data
5.1. To run the Service we engage the following organisations to process data. Each receives only what it needs for its task.
| Recipient | Where it processes | What it receives | Why |
|---|---|---|---|
| DigitalOcean, LLC | Data centre in Germany; the company is registered in the USA | All account and stockroom data, photos, logs | Servers, database and file storage of the Service |
| SMS Aero (smsaero.ru) | Russia | Phone number, message text with the code | Delivering the confirmation code |
| Telegram (via SMS Aero) | Outside Russia | Phone number, message text with the code | If the number is registered in Telegram, the code may arrive as a Telegram message instead of an SMS |
| Anthropic, PBC | USA | The picture and related request data: for example, names and dimensions of your folders for a placement suggestion, a list of items for a job suggestion | AI features — only when you start them yourself |
| Google LLC — Firebase Cloud Messaging | USA | Push token, notification text | Delivering push notifications |
| Apple Inc. — Apple Push Notification service | USA | Push token, notification text | Delivering push notifications to iPhone and iPad |
| Google LLC — Google Analytics for Firebase | USA | Usage statistics from section 2.2 | Stability and usage statistics of the Android version |
5.2. Crash reports are collected by a Sentry system running on our own server at a hosting provider in Austria (EU); the data is not passed to the company Sentry.
5.3. Users in Russia connect to the Service through our server in Moscow (Russia), which accepts the connection and forwards it to the main servers of the Service. No Service data is stored on that server.
5.4. Under its commercial API terms Anthropic does not use data sent through it to train models. Even so, please don't send pictures with personal information to AI features if you are not prepared to transfer it outside Russia.
5.5. We may disclose data to public authorities only when the law expressly requires it and the request is made in due form.
6. Where data is stored and cross-border transfers
6.1. The main database, files and backups are stored in a DigitalOcean data centre in Germany. Germany is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and ensures adequate protection of data subjects' rights.
6.2. Transfers to the USA (Anthropic, Google, Apple) are cross-border transfers to a country not on the list of countries with adequate protection. They happen only to the extent described in section 5 and only to run the features you use. The ground is performance of the Terms of Use and your consent, including the one given in the consent to data processing.
6.3. If you don't want your data transferred to the USA, don't use AI features and turn off notifications — the rest of the Service keeps working.
7. Retention
| Data | How long it is kept |
|---|---|
| Account and stockroom contents, photos | While the account exists. After deletion — immediately from the live database and storage; from database backups — within 7 days |
| AI request history | The last 50 requests per account; older ones and their pictures are deleted automatically |
| Confirmation code | Valid for 5 minutes; the record is deleted within a day after it expires |
| Sign-in session | Until you sign out or 30 days without use |
| Request and response contents in the log | 30 days, including after the account is deleted |
| Server request log (without contents), SMS log | 12 months, including after the account is deleted — for SMS cost accounting and abuse investigation |
| Crash reports | 90 days |
| Usage statistics (Android) | No more than 14 months |
| Push token | Until you sign out, delete the account or the system refreshes the token |
| Support correspondence | 3 years from the last message |
8. Who else can see your data
- Members of your team. If you work in a team, its members see the team's data within their role, plus your name and phone number in the member list.
- Recipients of your integrations. If you set up a webhook or issue an API key, data goes where you pointed it. The owners of those services are responsible for them.
- Anyone who has a photo link. Photos of items and folders are served by a direct link with a long random name (via cdn.skladik.io) without a sign-in check — this lets the app show them quickly, including offline. Such a link is practically impossible to guess, but if you share it, anyone who receives it can open the photo.
- Our staff — only when needed for support, investigating an error or as required by law; access to the admin panel is protected by personal accounts.
9. How we protect data
- All connections between the app, the website and the servers are encrypted (HTTPS/TLS).
- Confirmation codes are stored only as a hash; the number of attempts and how often a code can be requested are limited.
- Access tokens live 30 minutes and sessions can be ended; when an account is blocked, all its sessions are revoked.
- Data of different users and teams is isolated; access is checked on every request.
- Service keys and passwords are kept in a dedicated secrets vault, not in the code.
- The database is backed up daily.
No system is perfectly secure. If we learn of a breach affecting your data, we will notify you and Roskomnadzor within the time limits set by law.
10. Your rights
You have the right to:
- find out what data of yours we process and get a copy;
- correct inaccurate data — most of it can be changed in the app;
- delete your account and data — see section 11;
- withdraw consent — deleting the account or writing to us is enough; withdrawal does not affect the lawfulness of processing before it;
- export your data — reports export from the app to CSV, XLSX and PDF;
- object to processing based on legitimate interests;
- complain to Roskomnadzor (rkn.gov.ru), and users in the EU — to the supervisory authority of their country.
Send requests to support@skladik.io and include the phone number linked to your account. We will reply within 10 working days (this may be extended by 5 more working days with an explanation).
11. Deleting your account
11.1. You delete the account in the app: «Ещё» (More) → «Профиль и настройки» (Profile and settings) → «Удалить аккаунт» (Delete account). If you have no access to the app, write to us — see Delete your account.
11.2. Deleting permanently removes: the account, your personal stockroom with all its contents, photos and AI-history pictures in storage, sessions, push tokens and settings. Teams with nobody else in them are deleted entirely; shared teams where you are the only owner pass to the most senior remaining member. Records you created in shared teams are deleted together with the account.
11.3. Request and SMS logs are kept for the period in section 7 (request contents — no longer than 30 days), no longer linked to the deleted account anywhere in the Service. Data disappears from database backups within 7 days.
11.4. After deletion you can sign in with the same number again — a new, empty account will be created.
12. Children
The Service is not intended for people under 14, and we don't knowingly collect their data. If you learn that a child has given us their data, write to us and we will delete it.
13. Website and cookies
The website skladik.io uses no cookies, visitor counters or third-party scripts and loads no resources from other domains (fonts, analytics, ads). Like any web server, the website's server writes the IP address, time and requested address to a technical log, used only to keep the website running and secure.
14. Changes to this policy
We may update the Policy, for example when new features or providers appear. The current version is always published on this page with its date at the top. We will announce material changes — new categories of data, recipients or purposes — in the app before they take effect.