ERPWork Privacy Policy

Effective date: 2026-11-01
App: ERPWork (Android package com.buildwithvivek.erpnext)
Developer: Vivdeveloper https://github.com/Vivdeveloper/
Contact: choudharyvivek195@gmail.com

ERPWork is a mobile companion app for ERPNext (Frappe). You sign in with an account that your organisation already created on its own ERPNext site (an open-source ERP, see About ERPNext and Frappe). This policy explains what data the app handles, where it goes, and the choices you have.

Summary

• The app sends your data to the ERPNext site you sign in to, which your organisation runs or chooses. We (the developer) do not run a server that receives your data; the only data that reaches us is crash reports (see below), which contain no ERPNext data.
• Exceptions: when you open the attendance check-in screen, your coordinates are sent to Google Maps to draw a map preview; the app shows small Google AdMob banner ads on Home, the dashboards, lists, documents and the ERPNext tab's workspace, list and report pages (none during the first day after install), so Google's ads SDK collects advertising data (see Ads); and if you allow notifications, your site sends push notifications through Expo and Google Firebase Cloud Messaging; and when the app crashes or hits an error, a crash report goes to Google Firebase Crashlytics so we can fix it; and to keep the app up to date it checks Expo (EAS Update) for in-app updates and reads a small version file from GitHub Pages (see App updates).
• ERPWork AI (optional, off until it is set up on your site): if you use it, your questions, any photo you attach, and the ERPNext data the app looks up to answer them are sent through your organisation's ERPNext site to the AI provider you chose (Anthropic Claude, OpenAI, OpenRouter or Google Gemini), with your own API key. We never receive your key, questions or answers. See ERPWork AI.
• In the EEA, UK and other places where consent is required, ads are personalised only if you allow it; elsewhere, ads may be personalised unless you opt out in your phone's ad settings (see Ads). Otherwise you get non-personalised ads. Crash reports carry technical details only, are not linked to your ERPNext account, and are never used for ads. No other analytics SDKs, and we never sell your data.
• Location is used only in the foreground, when you open Check In or Check Out. Never in the background.
• The app does not create accounts. Your organisation's ERPNext administrator manages your account and the data stored on the site.

Who is responsible for your data

Data you send through ERPWork is stored on your organisation's ERPNext site. Your organisation controls that data and decides how long it is kept; please also read its own privacy notice. The developer is responsible for how the app itself handles data on your device, as described here.

Data the app handles

Contacting people from CRM records

Call, Email and WhatsApp buttons on CRM records open your phone dialer, mail app or WhatsApp with that contact's number or address. The app does not read your phone's contacts or call log.

Data the app does not collect

Apart from the advertising data Google's ads SDK collects (see Ads), the push token described under Third parties and the crash reports described above: no usage analytics; no contacts, call logs, SMS, calendar, health, financial or audio data; no background location. The microphone is used only for voice typing in ERPWork AI, and the app never records, saves or sends audio (see Permissions). The camera is not used to record video, and barcode reading happens on your phone (only the scanned code is sent to your site). Keys from a USB or Bluetooth barcode scanner are read in the background only on the POS selling screen, to recognise scanned codes.

Third parties

• Your ERPNext site. Receives the data listed above. It is operated by or for your organisation, not by us.
• Google Maps. When the check-in screen opens and a location is available, your coordinates are sent to maps.google.com to display an embedded map. Google processes that request under the Google Privacy Policy.
• Google AdMob. The Google Mobile Ads SDK in the app receives the advertising data listed above directly from your phone. Google uses it as described in How Google uses information from sites or apps that use our services and the Google Privacy Policy.
• Push notifications (Expo and Google Firebase Cloud Messaging). If you allow notifications, the app gets a push token for your phone from Expo and stores it, with your phone's model and the app version, in an "ERPWork Push Token" record on each ERPNext site you are signed in to (switching sites in the app keeps you signed in to the others, so you keep getting their notifications). When one of those sites creates a notification for you, it sends the notification title, a short text, the document type and name, the notification's ID, type and link, the site's address and your user ID (usually your login email) through Expo's push service and Google Firebase Cloud Messaging, which relay it to your phone as service providers (see the Expo Privacy Policy and the Google Privacy Policy). Push works on a site only after it is set up there: a user with the System Manager role can do this in the app (Settings > Notifications > Enable for this site), which adds the "ERPWork Push Token" DocType and the "ERPWork Push" Webhook to that site, or the site's administrator can add them by hand. To stop push notifications, turn off notifications for ERPWork in your phone's settings, or sign out of a site or remove it in Settings > Sites & saved logins, which deletes the push token record from that site. Without push, notifications are created on your phone from the current site's notification log while the app is open or recently used.
• Google Firebase Crashlytics. When the app crashes, or catches an error it cannot recover from, the Crashlytics SDK sends a crash report (the crash logs and diagnostics listed above, with a random Crashlytics installation ID and Firebase installation and session IDs used to count how many phones a problem affects) to the developer's Firebase project. Google processes it for us as a service provider under the Firebase privacy and security terms and the Google Privacy Policy; it is not used for advertising and not combined with the ads SDK's data. The reports carry no user ID, name, email, login, site address or ERPNext data. Development builds and the web version send no crash reports.
• App updates (Expo EAS Update and GitHub Pages). In store builds, when the app starts and when you return to it, it asks Expo's update service (u.expo.dev) whether a newer version of the app's code is available, and downloads it if so. The request carries technical details only: platform, app runtime version, the ID of the installed update, the update channel and a random installation ID that Expo generates for this app install (used to deliver updates and count how many installs run each update), plus your IP address as with any internet request. Expo processes it for us as a service provider under the Expo Privacy Policy. The app also downloads a small public file (app-version.json) from our policy site on GitHub Pages, at launch and at most every 6 hours when you return to it, to tell you when a newer version must be installed from the Play Store; GitHub receives your IP address and browser/app details with that request, under the GitHub Privacy Statement. Neither request contains your name, login, site address or ERPNext data, and we do not use them to identify you.
• Your phone's speech service (only if you use voice typing). When you tap the mic in ERPWork AI, your phone's own speech recogniser (on Android usually Google's; on the web, your browser's) turns what you say into text. It may process the audio on its provider's servers under that provider's privacy policy (for Google, the Google Privacy Policy). The app receives only the text.
• Your AI provider (only if you use ERPWork AI). Anthropic, OpenAI, OpenRouter or Google, whichever you choose with your own API key. It receives your questions, attached photos and the ERPNext data looked up to answer them, from your ERPNext site, and processes them under its own terms and privacy policy, not ours. See ERPWork AI.

We do not sell personal data. The only data shared for advertising is what Google's ads SDK collects, described under Ads. Your ERPNext business data, profile and location coordinates are never sent to the ads SDK. We do not send your data to an AI provider ourselves; with ERPWork AI, you or your organisation choose the provider and provide the key.

ERPWork AI

ERPWork AI is an optional assistant that answers questions about your ERPNext data and can help create records. It is off until it is set up: a user with the System Manager and Script Manager roles turns it on for a site in the app (Settings > ERPWork AI > Enable for this site), which adds an "ERPWorkAi Settings" DocType and an "ERPWork AI Chat" API Server Script to that site. Then each user who wants to use it adds their own AI provider, model and API key ("bring your own key"). The developer does not provide an AI service and never receives your key, questions, photos or answers.

• How it works. Your question (and any photo you attach, for example a business card to create a Lead) goes from the app to your ERPNext site, whose Server Script reads your key and sends the request to your AI provider over HTTPS; the reply comes back the same way. To answer, the app looks up ERPNext data with your own login and permissions (search, lists, single records, counts and reports you can already see) and that data is sent to the AI provider as part of the conversation. The request also includes your user ID, the site's address and today's date.
• Your API key. Stored on your organisation's ERPNext site in an encrypted password field of your own "ERPWorkAi Settings" record. It is never shown again or sent back to the phone, and the script does not include it in replies or error messages. As with any ERPNext password field, the site's screens and API never show it in plain text, though whoever runs the site's server can technically decrypt it.
• Changes need your Confirm. The AI can only propose creating a Lead, Timesheet, ToDo or Task, adding time to your draft Timesheet, or changing a record's status. Nothing is saved until you tap Confirm (for a Timesheet you choose Save, as a draft, or Save & Submit), and it is saved with your own permissions. Switch off "Allow actions" in Settings > ERPWork AI to keep the AI to answering questions only. The AI cannot read or change the site's setup (DocTypes, fields, scripts, roles, users, permissions or settings).
• Learning from your own records. Before it proposes a new Lead, ToDo, Task or Timesheet, the app reads your own recent records of that type (about the last 10, with the fields you usually fill and the values you usually pick; for Timesheets, also this week's timesheets) so the AI can pre-fill the new one and ask only for what is missing. For a Lead it also searches for possible duplicates with the same email, phone number or company name. This data is read with your own permissions and is sent to your AI provider as part of the conversation, like any other lookup.
• Photos. A photo you take or pick for a question (for example a business card to create a Lead) is made smaller on your phone (to at most 1024 pixels on its long side) and sent through your ERPNext site to your AI provider with that one question. It is not saved on the site, and it is not kept in the saved chat history.
• Voice typing. The mic in the chat turns your speech into text in the message box using your phone's speech service (see Permissions). You can edit the text before sending; the app does not record, save or send any audio.
• Copying answers. Copy puts an answer's text on your phone's clipboard, where other apps you paste into can read it.
• Chat history stays on your phone. Chats are saved only on this device (in the app's private storage; in the browser's local storage on the web), per site and user: up to 30 earlier chats of up to 200 messages each. They are not stored on your ERPNext site or in any cloud by the app. Photos you attach are sent for that one question and are not kept in the saved history.
• Your AI provider's terms apply. What the provider does with requests (for example keeping logs for abuse monitoring, or using them to improve its models) is set by its own terms and your account settings with it: Anthropic (Claude), OpenAI, OpenRouter (which also passes requests to the model's own provider) and Google (Gemini). Google's free tier of the Gemini API may use prompts and answers to improve Google's products; for business data, use a paid API key and check your organisation's rules before using ERPWork AI.
• Answers can be wrong. Answers are generated by AI, are labelled "AI-generated" and may be incomplete or incorrect; the chat shows "ERPWork AI can make mistakes". Check important figures in ERPNext before relying on them.
• Reporting an answer. If an answer is offensive, wrong or inappropriate, tap Report on it and pick a reason. This opens your email app with a message to us containing the reason, the question and the answer (each cut to 1,500 characters), the AI provider and model, the app version and the time; you can edit it before sending, and nothing is sent unless you send it. We use reports only to improve ERPWork AI's safeguards and delete them once handled.
• Turning it off. Switch off "Enabled" in Settings > ERPWork AI, or ask your administrator to delete your "ERPWorkAi Settings" record (which deletes your key) or disable the "ERPWork AI Chat" Server Script. You can also revoke the key in your AI provider's account at any time.

Ads

ERPWork shows small banner ads, clearly marked "Ad": one fixed at the bottom of Home, the app dashboards, lists and documents, plus one in the middle of Home and of each app dashboard. On the ERPNext tab, one fixed banner shows on workspace, list and report pages (not on forms or while you type). Ads are served by Google AdMob. There are no ads on sign-in, forms or while editing, or settings, and no ads at all during the first day after you install the app.

• Consent (EEA, UK and where required). Before personalised ads are shown, the app asks for your choice using Google's consent form (User Messaging Platform). If you do not consent, you get non-personalised ads.
• Everywhere else. Android does not ask before apps read the advertising ID, so ads may be personalised unless you opt out of ads personalisation or delete your advertising ID in your phone's ad settings (see below).
• Non-personalised ads are based on context, such as the app and your approximate location, not on your profile. Google may still use identifiers and similar data for frequency capping, aggregated ad reporting and fraud prevention.

How to opt out or change your choice:

• In the app: Settings > Privacy & ads (shown where Google's consent rules apply, such as the EEA and UK), to review or change your ad consent.
• Phone settings: Settings > Privacy > Ads (or Settings > Google > Ads), where you can delete your advertising ID or opt out of ads personalisation.
• Google: My Ad Center, to control the ads Google shows you.

Data stored on your device

• Saved logins. If you turn on "remember", your username and password are stored in the phone's secure storage (encrypted with a key kept in the Android Keystore). Remove them any time in Settings > Sites & saved logins.
• Session. The session cookie of each site you are signed in to (up to five) is kept by the phone's networking system, with the user you signed in as, so you can switch between sites without signing in again. Signing out of a site or removing it ends that session.
• Cache. Recently loaded ERPNext data and site images are cached to make the app faster. Signing out clears this cache and removes the app's notifications and reminders. Downloaded PDFs or attachments may remain in the app's temporary cache folder until the system clears it or you clear the app's storage.
• ERPWork AI chats. Your AI chats (up to 30 earlier chats of up to 200 messages each, per site and user) are kept in the app's private storage on the phone. Delete one chat from the chat list, or a whole conversation with Clear chat; all chats are deleted when you sign out, use Settings > Clear cache, clear the app's data or uninstall the app.
• Changes made offline. Comments, status changes with a remark, follow-up To Dos and check-ins made without a connection are kept on the phone (encrypted on Android) for that site and user until they are sent, or until you discard them in the pending changes list.
• POS settings and quick items. The POS screen's scan settings (camera strip, hardware scanner, how repeat scans behave) are kept on this phone, and the "Sold most here" quick items are counted on the phone per site and POS Profile from the sales you complete. They are not sent anywhere and are cleared with the app's cache or data. Held POS orders are saved as drafts on your ERPNext site.
• Pictures from your site. Item, profile and site images are loaded from your ERPNext site and may be cached on the phone.
• App data is excluded from Android cloud backup.

Permissions

• Location (foreground only). Asked with your phone's permission dialog (once after sign-in, and again when you open Check In or Check Out if not yet allowed), and used only for attendance check-in/check-out, never in the background. Optional unless your organisation's HR settings require location for check-ins.
• Notifications. To show alerts for assignments, approvals, mentions and your reminders, including push notifications when the app is closed. Optional.
• Camera and photos. Camera permission is asked once after sign-in (and again if needed when you take a photo or scan); the camera is used only while you choose to take a photo (profile, attachments, or a photo for ERPWork AI such as a business card) or scan barcodes (Scan, the Barcodes screen, or the camera strip on the POS screen while you have it open), always in the foreground. Existing photos are chosen through the system photo picker; the app does not request photo or storage permission and does not get access to your whole photo library.
• Microphone and speech recognition (optional). Asked only when you tap the mic in ERPWork AI to type by voice, and used only while it is listening (shown by a red mic). Your phone's own speech service (Apple on iPhone, Google on Android, or your browser on the web) turns the speech into text, and may process the audio on its servers under its own privacy policy. The text appears in the chat box for you to edit and send; the app does not save or send any audio. Without this permission, everything else in ERPWork AI still works by typing.
• USB and Bluetooth barcode scanners. No permission is needed: a scanner paired with your phone types like a keyboard. On the POS selling screen the app listens for these keystrokes while no other field is in use (you can switch this off in the POS scan settings) only to recognise scanned codes; it does not log or send other typing. On the Barcodes screen the scanner simply types into the code field.
• Biometrics (fingerprint or face unlock). Used only to lock and unlock the app. Verification happens on your device; the app receives only a pass/fail result, and no biometric data leaves your phone.
• Advertising ID. Android lets the ads SDK read the advertising ID without a prompt; you can delete it or opt out of ads personalisation in your phone's ad settings.

You can change any permission in your phone's settings at any time.

Security

The app only connects to sites using HTTPS, so data between the app and your ERPNext site is encrypted in transit. The Google Maps request, the data the ads SDK sends to Google and crash reports sent to Firebase Crashlytics are also encrypted in transit, and your ERPNext site calls your AI provider over HTTPS. AI API keys are stored only on your ERPNext site, in an encrypted password field, never on the phone. Saved passwords are kept in Android's secure storage (Android Keystore). On Android, screenshots and screen recording are blocked on screens that show business data (dashboards, lists, documents, reports, POS and the AI chat), which also hides them in the recent-apps view. No method of transmission or storage is completely secure, but we work to protect your data.

Retention and deletion

• On your ERPNext site: data is kept according to your organisation's policies. To have your account or data deleted, ask your organisation's ERPNext administrator, who controls that site.
• On your device: signing out of a site clears cached data and notifications, and deletes this phone's push token record from that site. Removing a site in Settings > Sites & saved logins signs you out of it, deletes its push token record and deletes the saved login. Signing out also deletes your ERPWork AI chats, as do Settings > Clear cache and Clear chat in the chat itself. Uninstalling the app or clearing its data removes all app data from the phone.
• ERPWork AI: your AI settings record (with your key) stays on your ERPNext site until you or your administrator delete it. Requests sent to your AI provider are kept according to that provider's own policies and your account settings with it; we do not receive or hold them.
• Help from us: email choudharyvivek195@gmail.com and we will help you reach the right person. We do not hold copies of your ERPNext data ourselves.
• Advertising data: data collected by Google's ads SDK is held by Google under its own retention policies (see How Google retains data); we do not receive it. You can reset or delete your advertising ID in your phone's settings and manage ad data in My Ad Center.
• Crash reports: Firebase Crashlytics keeps crash stack traces and their identifiers for 90 days, then deletes them. Because reports are not linked to your account, we cannot look up yours by name or email; if you want them deleted sooner, email us and we can delete all of this app's crash data in Firebase. Uninstalling the app removes its installation ID.

The app has a "Delete account & data" option in Settings > About that explains these steps.

Children

ERPWork is a business app for employees of organisations using ERPNext. It is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect data from children.

About ERPNext and Frappe

ERPNext is a free and open-source ERP (accounting, sales, purchasing, stock, CRM, projects and more), and Frappe HR adds HR and attendance. Both are built on the open-source Frappe Framework and made by Frappe Technologies with a worldwide community.

• Open source. ERPNext and Frappe HR are licensed under the GNU GPL v3, and the Frappe Framework under the MIT licence. Their source code is public: github.com/frappe/erpnext, github.com/frappe/hrms and github.com/frappe/frappe.
• Your own site. Anyone can install ERPNext on their own server for free, or get a managed site on Frappe Cloud. Your data stays on the site you or your organisation chose.
• Learn more. ERPNext documentation and the Frappe community forum.

ERPWork is an independent app that works with any ERPNext site through its standard API. It is not made, endorsed or supported by Frappe Technologies, the ERPNext project or Frappe Cloud. "ERPNext" and "Frappe" are trademarks of Frappe Technologies Pvt. Ltd.

Changes to this policy

We may update this policy when the app changes. We will post the new version on this page with a new effective date, and highlight significant changes in the app or store listing.

Contact

Vivdeveloper
GitHub: github.com/Vivdeveloper
Email: choudharyvivek195@gmail.com