Privacy Policy

Last updated: 18 September 2026 · Applies to Virtual Manager version 1.9.8 and later · Android package virtual_manager.app

Virtual Manager is built on the principle that your business data belongs to you. This policy explains what the app handles, where it is kept, what leaves your device and what does not, and the choices you have.

1. Who this policy covers

This policy covers the Virtual Manager application on Android and Windows, and the optional cloud sync service behind it. Virtual Manager is developed by Tamia ("we", "us"). In this policy, "you" means the person or business that installs the app and owns the account.

If you were given access to Virtual Manager by your employer — for example by scanning a QR code or entering a one-time code they gave you — then your employer controls that data, not us. See section 6.

2. Information the app handles

2.1 Business records you enter

Everything you record in the app, including:

• Suppliers and customers — names, phone numbers and balances.
• Purchases, sales, payments, receipts and out passes.
• Inventory items, stock batches, movements and adjustments.
• Expenses, and the tax details you choose to enter.
• Images you add, such as a receipt stamp design or an employee photo.

2.2 Information about other people

Some of what you enter is personal information about people other than yourself. Specifically:

• Employees — name, phone number, monthly salary, joining date, photo, and whether they are currently active.
• Attendance — the date, the status you mark (present, absent, half day or leave), check-in and check-out times, any notes you add, and who marked the record.
• Salary records — the monthly salary calculation, amounts paid, outstanding balances, reversals and the reasons given for them.
• Customers and suppliers — names and phone numbers.

We do not use this information for any purpose of our own. We store and sync it so the app works for you. Your obligations in respect of this information are set out in section 6.

2.3 Staff accounts and access

If you give your team access to the app, we handle the records needed to make that work: the user record and display name you create, the role and permissions you assign, the QR codes and one-time codes you generate, active sessions, and a record of which devices are signed in. You can revoke any of these at any time from within the app.

2.4 Your account information

If you choose to sign in, we handle your email address, an account identifier, and an authentication token. Passwords are never stored in readable form. If you set a staff login password or enable App Lock, only a cryptographic hash is kept — the password itself is never stored or transmitted.

2.5 Device and change information

To keep multiple devices in sync and to let you see who changed what, the app records a device identifier, a device name and the platform, and stamps each record with the user and device that created or last modified it. This is visible to you as the account owner, and it means that when a staff member records a sale or marks attendance, you can see that it was them. Please make sure your staff are aware of this.

2.6 What we do not collect

Virtual Manager contains no analytics, no advertising, no crash-reporting service and no tracking software of any kind. Specifically, we do not collect:

• Location data.
• Your contacts, messages, call logs or calendar.
• Usage statistics, behavioural data or an advertising identifier.
• Anything from other apps on your device.

3. Device permissions

• Internet — used only for cloud sync, signing in, checking for updates, and downloading the optional Urdu font. The app works fully without it.
• Camera — used in two places, and only when you open them: scanning a QR code to sign a staff member in, and taking a photo for an employee record or a receipt stamp. The app does not access the camera at any other time.
• Photos — when you choose an existing image, the app uses your system's photo picker and receives only the single picture you select. On Android it does not request access to your photo library, and the broad media permissions are explicitly removed from the app.

Virtual Manager does not request microphone, location, contacts or background-activity permissions.

4. Where your data is stored

On your device, by default. All records are written to an encrypted database on your own device. The encryption key is held in your operating system's secure storage. If you never sign in, your data never leaves your device.

In the cloud, only if you choose. When you sign in and cloud sync is active, your records are also stored with our cloud provider, Supabase, so you can use several devices and recover your data if you lose one. Data is encrypted in transit and at rest, and database access rules restrict every record to your own account.

To be clear about what this does and does not mean: cloud sync is not end-to-end encrypted. Your records are encrypted in storage and in transit, but they are not encrypted in a way that would make them unreadable to us as the service operator. We do not access them, and we have no business reason to — but we are not able to claim that we technically cannot.

Our cloud infrastructure is operated by Supabase and may store and process data on servers outside your country.

5. How your data is used

Your records are used for one purpose: to provide the features of the app — recording transactions, calculating stock and profit, producing reports and receipts, running payroll, and synchronising between your devices.

We do not sell, rent or share your data with advertisers or data brokers. We do not analyse the contents of your business records. We do not use your data to train machine-learning models.

6. Your responsibilities as a business owner

When you enter information about your employees, customers or suppliers, you are the one deciding to collect it, and in most jurisdictions that makes you responsible for it under data-protection law. We act on your instructions in handling it. This means it is your responsibility to:

• Have a lawful basis for recording your employees' personal data, attendance and salary information.
• Tell your staff what you are recording about them, including that the app attributes each change to the person and device that made it.
• Handle any request from an employee, customer or supplier to see, correct or delete their information. The app lets you edit or delete any record.
• Give staff access only to what they need, and revoke it promptly when someone leaves.

7. Third-party services

We use as few outside services as possible. These are all of them:

• Supabase — cloud database, sign-in and file storage. Receives your business records, account details and uploaded images, but only when you are signed in with cloud sync. Acts as our data processor.
• Google Fonts — the app downloads its display fonts from Google's font servers the first time they are needed, then caches them. No business data is sent; this is a request for a font file.
• Google Play — on Android, used to deliver app updates. Subject to Google's own privacy policy.

When you share a receipt or export a PDF, the app hands the file to whatever app you pick — your messaging app, email client or printer. What happens to it then is governed by that app, not by us.

8. Security

• Your local database is encrypted on your device, with the key held in your operating system's secure storage.
• Data in transit is protected with TLS.
• Cloud records are protected by row-level security rules so that one account cannot read another's data.
• You can enable App Lock, which requires a password to open the app and gives you a recovery code to store somewhere safe.
• Staff access can be revoked instantly, and you can see and release any signed-in device.

No system is perfectly secure. You are responsible for keeping your device, your account credentials and your App Lock recovery code safe.

9. Keeping and deleting data

Your records are kept as long as your account is active, or until you delete them. When you delete a record in the app it is marked as deleted and hidden from view; it may be retained for a period so that your devices can sync the deletion correctly, and is then removed.

You have two ways to remove everything:

• Reset All Data, in the app's Settings, clears all local data, settings, App Lock state and sync information on that device — and, if you are signed in, wipes your cloud data too.
• Delete your account by emailing support@virtual-manager.app. We will delete your account and its cloud data within 30 days.

Deleting cloud data does not remove copies already on your own devices, and deleting local data on one device does not affect another. Exports and receipts you have already shared or saved elsewhere are outside our control.

10. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete the personal information we hold about you, and to object to how it is handled. Most of this you can do yourself inside the app at any time: every record can be viewed, edited, exported to PDF and deleted. For anything else, email support@virtual-manager.app and we will respond within 30 days.

11. Children

Virtual Manager is a business tool intended for adults. It is not directed at children under 13, and we do not knowingly collect information from them.

12. Changes to this policy

We may update this policy as the app changes. The "Last updated" date above reflects the latest revision. If a change materially affects how your information is handled, we will make that clear in the app.

13. Contact

For privacy questions, data requests or account deletion, email support@virtual-manager.app.

← Back to home