Privacy Policy

This policy explains what TNT SOFT S.R.L. ("us", "we" or "our") collects through the branchbay.dev website (the "Site"), the BranchBay and BranchShell desktop applications, and BranchShell for iPhone, iPad and Android, why, and who else sees it. We are the controller of the personal data described here.

In short: there are no accounts, no advertising and no tracking across other companies' apps or websites, and we do not sell personal data. Your repositories, servers, keys, passwords and vaults stay on your devices (and, with the phone apps' backups, in your own iCloud or Google account, encrypted), and the apps connect to your servers directly, never through us.

BranchShell for iPhone and iPad

The iPhone and iPad app collects no data. It has no analytics, no crash reporting and no account, and it sends nothing to us.

• Your vaults, hosts, keys, snippets and command history are stored on the device, encrypted. Face ID and Touch ID are handled by iOS: the app learns only whether you were recognised.
• iCloud Backup, on unless you turn it off in Profile, keeps a copy of each vault in your own iCloud account, in the app's private iCloud storage, so a vault survives deleting the app or moving to a new device. The copy is the vault as it is on the device, encrypted with the vault's password: Apple stores it under Apple's privacy policy, we have no access to it, and restoring it takes the password. You can delete the copies in the app or in your iCloud settings.
• The camera is used only to read the QR codes the desktop app shows when you move a vault to your phone. The codes are read on the device.
• Connections to your servers and databases go directly from the device to them.
• The subscription is sold and billed by Apple under Apple's privacy policy. We never see your payment details; Apple gives us sales reports that do not identify you.

BranchShell for Android

The Android app collects no data either. It has no analytics, no crash reporting, no advertising and no account, and it sends nothing to us.

• Your vaults, hosts, keys, snippets and command history are stored on the device, encrypted. Fingerprint and face unlock are handled by Android: the app learns only whether you were recognised.
• Android's backup keeps a copy of the vault files in your Google account, so they come back when you install the app again or move to a new phone. The copy is each vault as it is on the device, encrypted with its password: Google stores it under Google's privacy policy, and we have no access to it. Nothing else of the app's goes into the backup. You can turn backups off in Android's settings.
• The camera is used only to read the QR codes the desktop app shows when you move a vault to your phone. The codes are read on the device.
• Connections to your servers and databases go directly from the device to them.
• The subscription is sold and billed by Google Play under Google's privacy policy. We never see your payment details; Google gives us sales reports that do not identify you.

The desktop applications

BranchBay and BranchShell for macOS, Windows and Linux send the following, and nothing else:

• Trial: to allow one free trial per computer, the app sends a one-way hash of this computer's identifiers. We store the hash with the dates the trial started and was last checked. It cannot be turned back into the identifiers and is not linked to your name or email.
• Licence: when you activate or check a licence, the app sends your licence key and a label for the computer (its name and operating system) to Lemon Squeezy, so you can tell your computers apart when you move the licence.
• Updates: the app downloads update information and updates from releases.branchbay.dev. Like any web server, it records the IP address of each request.
• Crash reports: when the app crashes, it sends a report to Sentry with the error, where in the code it happened, the app version and the operating system. No IP address or account is attached; an error message may occasionally quote a file path.

The website and purchases

The Site uses Google Analytics, which sets cookies, to count visits and see which pages are read, from which countries and on which devices. Our hosting keeps standard server logs, including IP addresses, for security and to keep the Site running.

Desktop licences are sold by our reseller Lemon Squeezy, the merchant of record, which collects your name, email address, billing address and payment details. We receive your name, email address and order details so we can send and support your licence. The licence reset page sends the licence key you enter to Lemon Squeezy to clear its activations.

Who else sees it

We share data only with the services named above, each for the purpose given: Apple (the App Store), Lemon Squeezy (desktop licences), Google (website analytics), Sentry (crash reports) and our hosting providers. Some of them process data outside the European Union under the safeguards the GDPR requires. We disclose data to authorities only when the law requires it.

How long we keep it

Trial records are kept while they are needed to allow one trial per computer. Order records are kept as long as the law requires for accounting. Crash reports, analytics and server logs are deleted on a rolling basis by the services that hold them.

Your rights

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to its use, or to move it elsewhere. Write to contact@branchbay.dev . You can also complain to your data protection authority; ours is Romania's ANSPDCP.

Children

Our products are tools for developers and are not directed at children under 16. We do not knowingly collect their data.

Changes

We will post any change to this policy on this page and update the date above.

Contact us

If you have any questions about this policy, please contact us at contact@branchbay.dev .