Last updated: June 1, 2026
This Privacy Policy explains how NodeCypher Inc. ("NodeCypher", "we", "us", "our") handles information in connection with the GRC Pocket Auditor mobile app (the "App") and our website at https://nodecypher.com (the "Site").
Plain-English summary: The App runs on your device. Your audit answers, scores, and results are stored only on your device and are never sent to us. The App has no account, and we do not collect your name or email through it. The limited information we or our providers handle is described below.
NodeCypher Inc., 9580 Yonge St, Unit 9, Richmond Hill, Ontario, Canada. For any privacy question or request, contact privacy@nodecypher.com. Our Data Protection Officer can be reached at dpo@nodecypher.com.
(a) Purchase information. In-app purchases are processed by the Apple App Store or Google Play and by our entitlement provider, RevenueCat. These providers process purchase and receipt data and assign an anonymous app-user identifier to manage your unlocks and the "restore purchases" feature. We receive purchase status linked to that anonymous identifier — we do not receive your name, email, or payment-card details. See the privacy policies of Apple, Google, and RevenueCat.
(b) Website and document-access logs. When you visit the Site or open a remediation-document link, our hosting provider automatically records standard technical information such as IP address, date/time, the page or file requested, and browser/device type. This is used to operate and secure the Service.
(c) Bookings and enquiries. If you book a consultation (via Cal.com) or contact us by email, we receive the information you provide (such as name, email, and message) to respond and deliver the service. Cal.com processes booking data per its own privacy policy.
(d) Usage analytics. The App currently does not use third-party usage analytics. If this changes, we will update this Policy and the App Store / Google Play data disclosures before collecting such data.
Where UK/EU data-protection law applies, we rely on: performance of a contract (providing the purchases/services you request); our legitimate interests (operating, securing, and improving the Service); consent (where required); and legal obligations. Where processing relies on consent, you may withdraw it at any time.
We do not sell your personal data. We share limited data only with service providers acting on our behalf — Apple, Google, RevenueCat (purchases), Cal.com (bookings), and our hosting provider — and where required by law.
Some providers (e.g., RevenueCat, Cal.com, hosting) may process data outside your country, including in the United States. Where required, such transfers are covered by appropriate safeguards such as Standard Contractual Clauses.
Device-stored data remains until you delete it or uninstall the App. Purchase records are retained by the stores/RevenueCat per their policies and as needed for support and legal/accounting requirements. Enquiry and booking data is kept only as long as necessary for its purpose and any legal requirements. Server logs are retained for a limited period for security and operations.
Subject to applicable law (including UK/EU GDPR), you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. Because most of your information stays on your device and we operate without accounts, the personal data we hold about you is minimal. To make a request about data we hold, contact privacy@nodecypher.com. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO).
US/California residents: you may have rights to know, delete, and opt out of the "sale" of personal information. We do not sell personal information. — confirm wording with counsel.
The App and Site are intended for business use by adults and are not directed at children. We do not knowingly collect personal data from children.
We use reasonable technical and organisational measures to protect information. The on-device design means your audit data is not exposed through our systems. No method of transmission or storage is completely secure.
We may update this Policy. We will post the updated version with a new "Last updated" date and, where appropriate, update the in-app and store disclosures.
NodeCypher Inc., 9580 Yonge St, Unit 9, Richmond Hill, Ontario, Canada, dpo@nodecypher.com.
