Privacy Policy for OASES Mobile

Effective date / Last updated: 14 September 2026

1. Who is responsible

OASES Mobile (the “App”) is published on Google Play and the Apple App Store by Commsoft OASES, the trading name of:

The App is a business tool for aviation maintenance and stock control. It is used by staff and contractors of airlines and maintenance organisations (“your organisation”) that license the OASES platform. You receive your login from your employer — you cannot create an account from inside the App — and the App is not intended for personal or consumer use.

The App connects to two separate places, which determines who to contact about your data:

• Your organisation’s own OASES server. All maintenance, stock, work order and user data goes here. Your organisation controls this data and we handle it only on their instructions. For access, correction or deletion, contact your own IT or data protection team.
• Google Firebase services operated by us. Push notifications, sign-in verification and licence records. We control this data.

2. Data we access, collect, use and share

The App signs in to Firebase using a custom token issued by your organisation’s OASES server. It does not use email/password, phone, social or anonymous sign-in, so Firebase never receives your password.

Data the App accesses but does not collect

• Camera images. Used for live barcode and QR scanning. Frames are read in memory and are never saved, stored or transmitted.
• Biometrics. The App asks the operating system to confirm your fingerprint or face and receives only a yes/no answer. Your biometric data never leaves your device’s secure hardware and is never seen by us.

Data stored on your device

Your saved username, password (if you enable “remember me”), access and refresh tokens, server address, default warehouse and notification preferences are held in your device’s encrypted credential store (Android Keystore or iOS Keychain). See section 7 for exactly what signing out and uninstalling do and do not remove.

3. Data we do not collect

• No analytics or behavioural tracking. The App contains no analytics SDK. We do not record screen views, session duration, user journeys or feature-usage profiles. As disclosed in section 2, we do keep limited numeric feature-usage counters against your username and organisation code, used solely to administer usage-limited licences — not to analyse or profile how you work.
• No advertising. No adverts, no advertising software, and we do not access your device’s advertising ID.
• No crash or performance reporting. Diagnostic logs stay on your device.
• No physical location data. The App does not determine, collect, store or transmit your physical location. On Android 10 and 11, the App may request location permission solely because those Android versions require it to discover nearby Bluetooth barcode scanners and RFID readers. The App does not use this permission to determine your location, and it does not request location permission on Android 12 or later.
• No access to your photo or video library, contacts, calendar, microphone, call logs or SMS. The App has no file or photo picker and cannot attach images, videos or documents.
• We never sell your personal information, and we never share it for advertising or marketing by others.

4. Who we share data with

We share data with no advertisers, no analytics providers, no data brokers and no payment processors. The App has no advertising, no analytics and no in-app purchases.

5. Data security

• Data sent between the App and your organisation’s OASES server is encrypted in transit using HTTPS/TLS, as is all data sent to Firebase.
• Login details and tokens on your device are held in the operating system’s encrypted credential store, and can optionally be protected by biometric authentication.
• Access to the Firebase records described above is restricted to authenticated sessions.

These measures reduce risk but cannot remove it entirely. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

6. Data retention

Where we act on a deletion request, we may need to keep limited information for longer where we have a legal, regulatory, tax, security or fraud-prevention reason to do so. We keep only what is necessary for that purpose, and delete it when the reason no longer applies.

7. Your choices and how to delete your data

Your choices

• Turn notification subscriptions on or off in the App’s notification settings.
• Biometric unlock is optional and can be disabled in the App’s settings.
• Withdraw any device permission in your device settings. Some features will stop working.
• Choose whether the App remembers your password, using the “remember me” setting.

What signing out does

Signing out ends your session with your organisation’s identity provider and clears your refresh token and your selected database from the device. If you have enabled “remember me”, your saved username and password remain in the device’s credential store so that you can sign in again, including by biometric unlock. Turn off “remember me” before signing out if you do not want them kept.

Removing data from your device

• Android: uninstalling the App removes its stored data, including the credential-store entries.
• iOS: uninstalling removes the App’s files, but some credential-store (Keychain) entries can persist. Turn off “remember me” and sign out before uninstalling.

Deleting data held elsewhere

• Your OASES account and work data: contact your own administrator. Accounts are created and removed by your organisation, not by us, and we cannot delete them on a server your organisation operates.
• Licence records, sign-in records and notification tokens held by us: email eis@mitgroup.io and we will delete them, subject to the retention exceptions and the Firebase removal timescales in section 6.

8. Permissions the App asks for

You can withdraw any of these in your device settings. Some features will stop working.

9. Children’s privacy

The App is a workplace tool. Access is provisioned and supervised by your employer, which is responsible for deciding who may use it. It is not directed at children, is not a families programme app, and we do not market it to or knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy. The “Effective date / Last updated” date at the top of this page will change, and material changes will be notified in the App or to your organisation.

11. Contact us

For any privacy question or request, including data deletion:

We aim to respond to privacy requests within 30 days.