Privacy Policy

Last updated: September 20, 2026

1. About this policy

This policy explains what the mobile app you installed collects from you, why, and who it is shared with. Each business we work with gets its own edition of the app, published under that business’s own name and branding. The editions differ only in name and appearance (they collect and handle your information identically), and this policy covers all of them.

The apps covered, by the name each one carries in its store listing:

  • Toti's Barbershop

Two parties are involved. ap.ments is the booking platform the app is built on. Its developer, Jordan Ivanov, publishes the apps and operates them and the servers behind them. The business whose app you installed uses it to run its appointments, and its staff can see the details you provide so they can serve you. If you have a question about how a particular business uses your information, contact that business. For questions about the app itself, contact us at ap.ments@gmail.com.

2. Information we collect

We collect the information you give us in the app, a notification token if you allow notifications, and technical diagnostics about the app itself:

  • Account details: your first name, last name, email address, phone number, and a password. Passwords are stored only as a cryptographic hash (bcrypt) and are never readable by us.
  • Profile details: an optional profile photo you choose from your photo library, an avatar colour, your preferred language, and whether your email address has been verified.
  • Appointment data: the bookings you make or that staff make for you (date, time, services, the staff member, price, and status), along with the notifications generated from them.
  • Business content (staff accounts only): if you are an employee or owner, the content you enter in the management area: staff biographies, working hours, absence reasons, service and product details, and business images.
  • Notification token: if you allow notifications, a push token that identifies your installation of the app so we can deliver appointment notices to it.
  • Diagnostics: builds of the app other than our own debug builds report technical measurements to Expo’s EAS Observe service, so that we can find and fix what is broken or slow. Every report carries a random identifier for your installation of the app and for the current session, your device model, operating system and version, the app’s version, and your device language.

    Once each time the app starts, we also send how long it took to become usable, whether the device was on Wi-Fi, mobile data or offline, its battery level and whether it was charging or in low-power mode, how warm it was running, how many network requests the app made while starting, how many bytes those carried, how many were slow or failed and the host name of the slowest one, and how many frames were slow to draw. If the device runs short of memory, we send how much it had.

    For each screen we send how long it took to appear and its address inside the app, which on a screen showing a single appointment, client, team member, product or salon includes that record’s internal identifier, a number, not its contents. When an error occurs we send its message and a technical trace of where it happened; a message returned by our own server can mention a date or time from the request that failed.

    This tells us how the app behaved and which part of it was open. It is not used to build a profile of you, it is not shared with advertisers, and your name, email address, phone number and the contents of your appointments are not part of it.

3. What we do not collect

  • No location data. The app never requests location access. Map coordinates shown in the app belong to the business’s premises, not to you.
  • No advertising, attribution or product analytics. The app contains no advertising or attribution toolkits and no product-analytics service. Apart from the technical diagnostics described in section 2, nothing records what you do in the app, and none of it is sold or shared with advertisers or data brokers.
  • No advertising identifiers. There are no advertisements and no advertising toolkits in the app.
  • No payment information. You pay the business directly, in person. No card or bank details are entered into or handled by the app.
  • No access to your contacts, calendar, microphone, or camera. The app reads only the single image you select when you choose to set a photo.

4. How we use your information

Everything above is used to operate the app and nothing else. Specifically:

  • To create your account, sign you in, and keep your session secure.
  • To show, book, change, and cancel appointments, and to display them to the staff serving you.
  • To send you service messages about your bookings (confirmations, changes, cancellations, and reminders) by push notification and in the app itself.
  • To verify your email address so account recovery and notices reach you.
  • To display your profile: your name, photo, avatar colour, and chosen language.
  • To keep the service secure, prevent abuse, and answer you when you contact us for help.

We do not use your information for advertising or marketing, we do not build profiles of you, and we do not track you across other companies’ apps or websites.

5. Permissions the app asks for

  • Photo library: requested only when you tap to change a photo. Only the image you select is uploaded; we cannot see the rest of your library.
  • Notifications: optional. If you decline, or later turn notifications off in your device settings, the app keeps working; you will simply stop receiving appointment notices on your device.

6. Who your information is shared with

  • The business whose app you use. Its staff can see your name, contact details, and appointments in order to serve you.
  • Service providers acting on our instructions: Render (application hosting and database), Amazon Web Services (image storage, in the EU, Stockholm region), Expo together with Apple and Google (delivery of push notifications), Expo again (EAS Observe, the crash and performance diagnostics described in section 2), and our email provider (delivery of account emails: welcome, verification and password reset). They may use your information only to perform these services for us.
  • Legal reasons: where we are required by law or valid legal process, or to protect the rights and safety of our users or ourselves.

We do not sell your information, and we do not share it with data brokers or advertising networks.

7. Security

  • All traffic between the app and our servers is encrypted with HTTPS/TLS.
  • Passwords are stored only as bcrypt hashes.
  • Your sign-in token is kept in your device’s secure storage (the iOS Keychain or the Android Keystore) and expires after 30 days.
  • Access to production data is limited to authorised personnel.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Retention and deleting your account

We keep your information for as long as your account exists. You can delete your account at any time from within the app: open Profile and choose Delete account.

Deleting your account removes your account record, your appointment history, and your profile photo from our storage. Copies may persist briefly in routine encrypted backups before those backups are rotated out.

9. Your rights

Depending on where you live, you have rights over your personal information, including:

  • Access: ask what we hold about you.
  • Correction: your name, email, phone, and photo can be corrected directly on the Profile screen at any time.
  • Deletion: available in the app, as described above, or on request.
  • Portability: ask for a copy of your data in a portable format.
  • Objection and restriction: object to or ask us to limit certain processing, and withdraw notification consent at any time in your device settings.

To exercise any of these, write to ap.ments@gmail.com. You also have the right to complain to your local data protection authority.

10. Children

The app is not directed to children under 16, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Changes are posted on this page with a revised “last updated” date, and significant changes will be announced in the app.

12. Contact us

For any question about this policy or your information, contact the developer, Jordan Ivanov (ap.ments), at ap.ments@gmail.com.