Privacy Policy

1. Scope

This Privacy Policy explains how Xalo Software collects, uses, stores, and protects information when you use the Musika application. Musika is an offline-first application — your device's local storage is the primary source of truth for all business data.

2. Information We Collect

2.1 License and Activation Data

To operate the Sekiwa license verification system, we collect and store on your device:

• License key and plan information
• Device fingerprint (anonymized hardware identifier for device binding)
• License activation, validation, and expiry timestamps
• License audit events (state changes, tamper detections, grace period events)

This data is stored locally in device secure storage. A minimal activation record may be transmitted to Xalo Software's servers during initial activation for license validation purposes.

2.2 Usage and Diagnostic Data

With your consent, we may collect:

• Anonymous crash reports and error logs
• Basic usage statistics (app version, device OS version)
• These help us improve the Software and fix issues

You can disable diagnostic data collection at any time in the app settings.

2.3 Business Data (Offline-First Model)

Your business data — including sales transactions, product inventory, stock levels, customer records, supplier information, pricing data, purchase history, and receipt details — is stored locally on your device using local SQLite storage. Your device is the authoritative source of truth. All operations work fully offline without any internet connection.

Xalo Software does not have access to your business data unless you explicitly choose to sync or share.

2.4 Optional Cloud Sync

Musika offers an optional cloud sync feature (gated by license plan — included in Standard and above). This feature is entirely opt-in. You control whether your data leaves your device.

How Sync Works

When enabled, your device synchronizes data with Convex Cloud (a third-party backend platform) using a local-first sync queue:

• All writes go to your local SQLite database immediately and are usable offline
• A sync_queue table records pending changes
• A background processor drains the queue to Convex when the device is online
• Changes are pushed and pulled using last-write-wins conflict resolution

What Data Is Synced

When cloud sync is enabled, the following data is transmitted to Convex Cloud:

Reports, stock movements, and analytical data are never synced — they are calculated locally from source records.

When Sync Does NOT Happen

• Cloud sync is disabled by default — no data leaves your device unless you turn it on
• Starter plan licenses cannot enable cloud sync (feature is locked)
• Sync only runs when the device has an active internet connection
• You can disconnect or disable sync at any time from Settings
• Deleting your cloud account removes all remotely stored data

Who Processes Synced Data

Convex Cloud acts as a data processor on behalf of Xalo Software. Their infrastructure stores and transmits synced data. Convex's privacy policy applies to their handling of data in transit and at rest on their platform. We recommend reviewing Convex's Privacy Policy for details on their security practices.

2.5 Support Communications

When you contact support via email, WhatsApp, phone, or other channels, we retain:

• Your contact information (name, phone number, email)
• Details of your inquiry
• Any information you choose to share for troubleshooting

Support records are kept for service improvement and are not used for any other purpose.

3. How We Use Information

We do not use your data for:

• Advertising or marketing
• Selling to third parties
• Profiling or automated decision-making
• Research without anonymization

4. Data Sharing

We do not sell, rent, or trade your personal information or business data to third parties.

We may share information only:

• With your explicit consent
• To comply with legal obligations or lawful requests from authorities in Zimbabwe
• To enforce our Terms of Service and EULA
• With professional advisors (legal, accounting) bound by confidentiality

5. Data Security

We implement appropriate technical and organizational measures to protect your data:

• License data is encrypted using AES-256-GCM encryption
• Cryptographic signatures use Ed25519 for integrity verification
• Device storage uses platform-native secure storage (expo-secure-store)
• Business data is stored in local device storage with restricted access

You are responsible for securing your device with a PIN, password, or biometric lock to prevent unauthorized access to the application and its data.

6. Data Retention

• License data: Retained on your device for the duration of your license plus any applicable grace period. Removed upon license expiry, revocation, or manual reset.
• Business data (local): Retained locally until you uninstall the app, reset app data, or manually delete records.
• Business data (cloud): If you enable cloud sync, a copy of your synced data is retained on Convex Cloud for as long as your sync account is active. Disconnecting sync or deleting your cloud account removes remotely stored data. Local data is unaffected.
• Support records: Retained for the duration of the support inquiry plus 12 months for quality improvement.
• Diagnostic data: Retained in anonymized form for product improvement.

7. Your Rights

Depending on applicable law, you may have the right to:

• Access information we hold about you
• Request correction of inaccurate data
• Request deletion of your data, subject to legal obligations
• Withdraw consent for diagnostic data collection
• Export your business data (use the app's backup features)

To exercise these rights, contact xalosoftware@gmail.com.

8. Third-Party Services

Musika uses the following third-party services:

• Expo (React Native framework) — app development framework. Expo may collect anonymous crash and usage data if enabled. See Expo Privacy Policy.
• Convex (optional, for cloud sync) — backend platform. Convex stores and processes data only when you enable cloud sync. See Convex Privacy Policy.

When cloud sync is disabled, Convex does not receive any data from your device. These services have their own privacy policies which we encourage you to review.

9. Children's Privacy

Musika is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted at musika.xalosoftware.com/privacy and, where appropriate, notified through the app. Continued use after changes constitutes acceptance.

11. Contact

For privacy-related inquiries: