Livestock Manager — Privacy Policy

Who is responsible

Livestock Manager is provided under the Brightworx Studio brand, Jakkalskop Farm, George, South Africa. Brightworx Studio is a trading name, not a separate legal entity. Contact admin@brightworxstudio.com. Updated: 18 October 2026.

We determine how account access, subscriptions, security and support information are used. The farm owner or organisation determines why people are included in its farm records and who may access them; we provide the selected storage and synchronisation functions. These roles depend on the activity and applicable law. We do not claim that accepting this notice replaces a required processing agreement or the farm's own duties to its staff and invited users.

Records you enter

The app keeps livestock, groups, medication, dosing, weights, breeding, farm-user details, calendar entries and camp boundaries in its local database on your device. A farm remains local unless its owner deliberately enables secure sharing in Farms & Users.

For a shared farm, the app sends that farm's records and later changes to our service so invited signed-in users can synchronise the same farm across their devices. This includes animals, groups, camps and drawn boundaries, movements, medication and dosing records, weights, breeding records, tasks, farm-user names, email addresses and roles. Other local farms are not uploaded merely because one farm is shared. We process these records to provide synchronisation, membership and access control; we do not use farm records for advertising.

The owner or a permitted manager invites users by email and assigns a role. An invitation is matched to the verified email used to sign in. A protected account key rather than a password controls membership. The service records the farm name, membership, verified email, role, synchronisation revision and record updates needed to keep devices consistent. Unused invitations expire after 48 hours; the service refuses expired invitations before Google's asynchronous physical cleanup. Accepted memberships do not expire under that rule. Users should not invite people without authority to disclose the farm information.

Do not enter another person's information unless you have a lawful reason and authority to do so. You control the farm records you create and may edit or delete them through the app.

Maps and location

Opening the map retrieves Google Maps content over the internet. Google receives requests for the viewed map area and automatically collects information associated with the Maps SDK, including device and request metadata, IP address, crash metrics, a Maps-specific pseudonymous identifier and map interactions such as panning and zooming. Map requests can reveal the area you view, including the area around your device if you choose current location.

Google's Maps terms allow Google to use and retain relevant request data to provide and improve its products and services under its own privacy policy. These SDK transfers are disclosed separately from our hosting of shared-farm records; we do not describe all Google processing as solely on our instructions. The updated Play Data safety declaration includes SDK-related data sharing. This is not an advertising integration or a sale of farm records.

The app requests location permission for centring the map on your position. It does not currently request background location permission. You can deny or revoke location permission; manually navigating the map remains a separate function. Drawn camp boundaries are stored locally; map imagery is supplied by the map provider.

Drawn camp boundaries remain in the app's local database and are rendered over the map on your device. If the farm owner enables secure sharing, the boundary coordinates are also synchronised through our service for invited users; the underlying Google map imagery is not copied into the farm record. See Google's Privacy Policy. The production configuration uses the Google Maps SDK for Android.

Camera, files and recognition

You may choose files for livestock import and use the camera to scan a medication label. Google ML Kit processes recognition input on the device. Its published documentation states that recognition input and results are not sent to Google for recognition, but the SDK sends technical metrics. These can include device/app information, installation identifiers, performance and error information, feature events, and input/output sizes. Google uses these for diagnostics and usage analytics, with HTTPS protection in transit.

See ML Kit privacy information and its data-disclosure guidance. On-device document processing does not mean the app collects no technical data.

Reminders

Notification permission allows livestock reminders to appear on your device, potentially on the lock screen according to your settings. You can turn reminders off in app settings or Android settings. The current implementation uses local reminders rather than a Brightworx messaging server.

Backups, exports and Android services

You choose a backup folder through Android's document picker. You may also give the app continuing access to that folder for scheduled backups. The default schedule is monthly, due on the first day of the month, and you may change or disable it. Android may delay background work, so the app displays the actual last successful backup. The destination may be local storage or a cloud-storage provider you select; choosing a provider does not turn it into a Brightworx Studio cloud-backup service.

The backup features available depend on your installed app version. The older 0.24.28 Google Play build creates readable JSON backups; the forthcoming encryption-enabled update changes new portable backups to encrypted .lmbak files. Updating does not retroactively encrypt or erase old files.

In versions supporting recovery-key backups, new manual and scheduled .lmbak files each have a fresh random data-encryption key protected independently by the backup password and a 256-bit random recovery key, using AES-256-GCM authenticated encryption. The password path uses PBKDF2-HMAC-SHA256 with a fresh salt and 600,000 iterations. The phone caches the password and recovery key under Android Keystore protection, outside Android backup and readable farm exports, so scheduled backups can run without repeated entry. Neither secret is sent to Brightworx Studio or stored by our service. Save the recovery key separately from the phone and backup files. Anyone with a matching key and file can read that backup. A replacement device can unlock a recovery-enabled backup using its password or matching key; account sign-in alone is not enough. If both are lost and no accessible records remain, we cannot unlock those encrypted backups. Changing the password affects future files only and retains the same recovery key. Older password-only files still need their original password; recovery cannot be added to them retrospectively without first unlocking and re-exporting their contents.

PDF management reports, CSV reports and GeoJSON camp-map exports are deliberately readable for sharing and external analysis; they are not password-encrypted backups. In the encryption-enabled update, the spreadsheet export ZIP contains readable CSV files (which may include farm-user names and email addresses) plus an encrypted complete-backup.lmbak recovery file. The app warns before creating this ZIP. Extract its .lmbak file before using Backup & Restore. Choose storage and recipients carefully; encrypting the recovery file does not encrypt the reports or the surrounding ZIP.

The app creates new dated files and does not automatically remove or rewrite older backups. Older JSON files remain unencrypted and readable to anyone with file/folder access. They remain importable. Previously created provider/system backups are not remotely erased by this update. If the folder is moved, deleted, disconnected or its permission is withdrawn, scheduled backup may fail; check the status shown in Backup & Restore. In the recovery-key-enabled version, new portable backups require both the secured password and a saved, confirmed recovery key; encryption failure never falls back to readable JSON. The supported encrypted-backup size is 64 MB of unencrypted content. Existing full-database upgrade checkpoints are separate from portable farm backups and may remain password-only; retain their original password.

The encryption-enabled update disables Android-managed backup and its extraction rules exclude the raw database, app files and preferences from cloud backup and device transfer. Older versions may allow Android-managed backup. Use the supported in-app backup for portable recovery; do not rely on a device transfer to recover a device-bound encryption key. Device/vendor behaviour can vary; no claim is made that copies created by older builds have been erased. Shared-farm synchronisation is not a substitute for an independently checked backup: another authorised user's edit or deletion can also synchronise, and stopping sharing removes the server copy.

Support messages

If you use the in-app comments and requests form, the app sends your chosen category, message, app version and language to Brightworx Studio through our access service. Your verified signed-in email address is included so that we can reply when follow-up is needed. The form does not automatically attach your farm records, backups, photos or other files. We use the submission to answer your request, improve the app, and handle related service or legal matters. Do not paste sensitive farm information into the form unless it is needed for your request.

Sign-in, free month and subscriptions — prepared for launch

The planned release provides one free calendar month per eligible app account, without payment details. It does not automatically convert into a paid subscription. A subsequent subscription requires an explicit Google Play purchase. Google handles payment details; we do not receive or store payment-card numbers.

You may use Google sign-in or enter another email address and follow the one-time secure link sent through Firebase Authentication. The identity provider supplies a signed token to our access service. The service processes the verified identifier and email and uses a keyed hash to recognise and link the account. Your email is used for shared-farm invitations, support replies and to show which account is signed in. Google and Firebase identity services process sign-in information under Google's policies. We do not receive your Google password or email-account password.

Our prepared service stores the protected account identifier, identity-link record, trial start/end dates, whether paid access has been used, terms version and acceptance time, purchase tokens and their account association, verification times and subscription state. We use these records to provide access, restore purchases, prevent repeated trials and handle account deletion. Google Play is consulted to verify purchases and sends subscription-status notifications.

The services used include Google Cloud Run, Firestore, Secret Manager and Pub/Sub, Google's identity and Play services, and Gmail SMTP for delivering support messages. Firestore and the Cloud Run service are configured in Johannesburg (africa-south1). This does not mean all processing is confined to South Africa: Firebase Authentication runs in the United States, Secret Manager's automatic replication is global, and the inspected Cloud Logging buckets are global. Google and its subprocessors also process service data under the applicable service terms. We do not claim that regional hosting alone satisfies international-transfer law.

Shared-farm records, memberships and pending invitations are stored in Firestore. A daily database backup schedule retains copies for fourteen days; additional seven-day point-in-time recovery is not enabled. These server backups are separate from your selected device backup folder. Cloud application/request logs have a 30-day retention setting and can include IP addresses and request metadata; the required administrative audit bucket has a locked 400-day retention setting. These are different records, not one universal log-expiry period. Passwords, authentication tokens and purchase tokens must not be included in support messages or application diagnostics. The Android app uses an encrypted access cache excluded from its farm backup and Android backup. Offline access lasts up to 72 hours within the verified access period; a device restart requires verification.

While signed in, use Settings → Account & subscription → Delete my online account and confirm the deletion, or visit https://brightworxstudio.com/livestock-manager/delete-account/ without installing the app. A successful in-app deletion signs the app out and returns it to the first welcome page. An owner must stop sharing owned farms before deleting the account; account deletion does not silently delete a farm used by other members. Stopping sharing removes the active server farm records, pending invitations and memberships after cleanup succeeds, and leaves a minimal keyed deletion marker. Interrupted cleanup can be retried. Previously created server backups expire separately.

Deleting a non-owner account removes its shared memberships and pending invitations, account record, purchase-token links and tracked Firebase Authentication identities. Limited keyed records remain to stop old sessions regaining access and to preserve established account-identity links. These identifiers are pseudonymous, not anonymous, and presently have no automatic expiry. A separate trial-use marker has a two-year retention period; deletion can extend that marker as described below. Support correspondence and required logs are handled separately. Google independently retains its own purchase/account records. Account deletion does not cancel a Google Play subscription and does not remotely erase local farm copies or exported backups on any device.

Online account records are kept while needed to provide or restore access. Purchase-link records are assigned an expiry two calendar years after the corresponding Google Play entitlement expires and are removed earlier on successful account deletion. The trial marker is assigned two calendar years when a trial starts; deleting an account that has used a trial or paid access retains it until the later of its existing expiry and two years after deletion. Expiry cleanup is asynchronous. Per-account request counters are overwritten as requests arrive and removed on account deletion; they do not currently have an automatic inactivity expiry.

The in-app support database assigns an expiry two calendar years after submission, not after closure. Email delivery creates additional mailbox and reply copies; database expiry does not delete those copies. Our support policy uses the same original-submission date for controlled email copies and replies, allows valid earlier deletion requests and specific legal holds, and does not restart the two-year period when a request is answered or closed. Mailbox copies require separate review and deletion; automatic email deletion has not been enabled. You can request deletion of a support submission and its controlled correspondence without deleting your account. We will explain any information that must be retained and why. Legal preservation, where required, is limited to the relevant information and purpose rather than retaining every account record indefinitely.

Retention, deletion and security

Local farm records remain until you remove them or clear the app's storage. The app's Reset all data option clears its farm database; Android's clear-storage function also removes local preferences and other app storage. For a shared farm, deleting only a local copy does not delete the server copy or other users' copies. Use Stop sharing as the owner to remove the shared server copy, or Leave shared farm to remove your membership. These actions do not erase copies already downloaded or backed up by another authorised user. They also do not delete backups stored elsewhere or cancel a Google Play subscription. Independently delete exported files and manage any system or provider backups you control. Restoring an older backup can restore previously deleted records.

Brightworx Studio cannot remotely delete local or backup copies held on users' devices or storage accounts. For information you send us, request access, correction or deletion at the address above; we may need proportionate identity verification and confirmation from the farm owner where other users' shared rights are involved. Do not send a password or recovery key. Information already captured in a retained server backup can remain until that copy expires. Any disaster restoration must be isolated and have subsequent deletions and access removals reapplied before serving users. A separate recovery log retains keyed security references and change markers, not copies of farm records or credentials. Completed log entries are eligible for daily cleanup after 21 days; unresolved operations remain for investigation and block recovery. Storage restoration and a separate seeded recovery rehearsal have been tested; live restoration remains an operator-controlled process, not an automatic guarantee. Google retains its own payment and billing records under Google's policies; Brightworx Studio does not receive payment-card details. We do not promise deletion of records that must lawfully be retained.

In the forthcoming encryption-enabled release, the working farm database uses SQLCipher with a random key protected by Android Keystore. Existing databases undergo a checked upgrade with an encrypted recovery copy. The older Play build relies on Android's application-storage/device protections instead of this additional database encryption. This does not encrypt every preference, screen, notification, report or file on the device, and it does not protect an unlocked authorised session from misuse. Older app versions must not be installed over a converted database.

Shared records travel over HTTPS and server access requires a verified token plus farm membership. Google-managed encryption protects Firestore storage, but our authorised service can read shared records: this is not end-to-end encryption. Removing a member blocks subsequent protected server access; it cannot retract an already delivered response or remotely erase downloaded copies. Server-side credentials and secrets are not included in the Android app. No system is completely immune to loss or unauthorised access. Protect your phone and exported files, and promptly remove former staff or unintended invitees.

Your rights and changes

Depending on the applicable law, you may request access, correction, deletion, restriction or portability, object to relevant processing, or withdraw consent where consent is the basis. Withdrawal does not undo earlier lawful processing. We assess requests against legal duties and the rights of other people; we explain a refusal or extension where required. You may complain to the South African Information Regulator or the competent authority in your jurisdiction. This notice does not restrict rights provided by local law.

We will update this policy when our practices change and provide notice or seek consent where required.