EstateSync Privacy Policy

In force from 1 October 2026. Version 1.4.

EstateSync is an app for running a Sri Lankan tea estate — its sections, its workers, the work they do each day, and the payroll that follows from it. It is published by LeafChain Technologies (Pvt) Ltd.

This policy explains what the app records, who else can see it, how long it is kept, and how to have it removed. It covers the EstateSync mobile app, the EstateSync web portal and the server behind them.

Two different people are described in this app

Most privacy policies describe one person: the user. This app holds information about two, and they stand in different relationships to us.

You, the estate owner or manager who signs in. You give us your own name, mobile number and NIC when you register.
Your workers, the people you employ. You record their details. They never sign in, and most of them will never see this app.

For your own account, we decide how the data is used and we answer for it. For worker records, you decide what to enter and why; we store and process it on your instructions for as long as your account exists. Telling your workers that you keep these records, and answering them if they ask what you hold, is your responsibility as their employer — not ours.

What the app records

Your account: full name, mobile number, NIC number, and your password — kept only as a scrypt hash, never as text that we or anyone else can read back. If you choose to give one, we also keep your email address, such as to contact you about your account. If you sign up on our website you are asked for one so that we can add you to the closed-testing list for the Android app on Google Play, and it is passed to Google Play for that purpose only. It is not used to sign in and not used for marketing.
Your estates: the estate name, the contact details you enter for it, and the sections within it.
Your workers: full name and the worker code you assign, and — only if you enter them — NIC number, mobile number, address, emergency contact name and mobile, and free-text notes.
Work and pay: each worker's daily work records, the salary schemes and rates you set, monthly payroll totals, and the advance and recovery ledger.
Tea accounts: if you link a tea supplier account, the details you type to link it. The link itself is held by the tea service, not by us — see below.
Technical records: your app version and platform, and the network address and device description your requests arrive with, in server logs and in a security log of sign-ins, failed sign-ins, sign-outs and deletion requests.
Notifications: if you allow notifications, the push token Google assigns your phone for delivering them, the language you have chosen for the app, and a log of the messages we have sent you.

Failed sign-ins are recorded against a masked mobile number — for example +94 7X XXX XX67 — so that the security log itself is not a list of which numbers hold accounts.

What the app does not do

There is no advertising in EstateSync, and it uses no advertising identifier.
There is no analytics, tracking or crash-reporting service in it. Neither the app nor the web portal contains any third-party component that reports your use of it to anyone.
It does not ask for or use your location, camera, photos, contacts or call log.
We do not sell your data or your workers' data, and we do not share it for anyone else's marketing.

Why we hold it

To provide the service you signed up for. The estate, worker, daily-record and payroll features are this data — without it there is no app.
To sign you in, keep you signed in, and keep other people out of your account.
To limit abuse. Failed sign-ins and one-time codes are counted per mobile number and per network address, because every SMS costs real money and an unlimited one is a way to spend it.
To answer you when you contact us for support.
To meet a legal obligation, where one applies to us.

Who else it reaches

We use a small number of service providers. Each is used for one job, and none is permitted to use the data for its own purposes.

Provider	What it does
Supabase	Hosts the database the records are stored in.
Railway	Runs the server and holds its logs.
Hutch	Delivers one-time verification codes by SMS. Receives the mobile number the code is going to, and nothing else.
TeaSync	A separate tea-collection service. Used only if you link a tea supplier account.
Google Play	Hosts the Android app's closed-testing list. Receives the email address you gave at sign-up, and only so that you can be given access to the app.
Google Firebase Cloud Messaging	Delivers push notifications to your phone. Receives the push token for your phone and the text of each message, and nothing else about you.

Tea accounts and TeaSync

TeaSync is a separate service used by tea collection centres. EstateSync keeps no copy of your tea link, because the centre can revoke it at any moment and a stale copy would be the one thing this must never show you. Every request is passed to TeaSync as it is made.

To link an account you enter your mobile number, tea account number and NIC. These are sent to TeaSync so it can find your supplier record and text you a code. They are not stored by us.

If your tea centre or factory is not on the list, you can tell us about it: its name, its address, and the name and mobile number of its owner or manager. We store these so that the TeaSync team can contact that centre about joining. If you delete your account, that record is kept but is no longer connected to you.

When we fetch a month's figures, TeaSync returns more than the app needs, including bank details. Our server removes the supplier's bank account number, branch, NIC and mobile number before the response reaches your phone.

Notifications

The app can tell you when something changes — for example, when a tea centre you are linked to records a delivery. Messages are sent in the language you have chosen in the app, and only to phones you are currently signed in on: signing out of a phone stops messages to it.

Messages about your tea account are requested by TeaSync and sent by our server. TeaSync tells our server only which account to notify and what the message says; it does not receive your phone's push token.

Notifications are optional. Your phone asks you before the app can show any, and you can switch them off at any time in your phone's settings.

How long it is kept

A sign-in lasts at most 60 days, used or not. After that you sign in again. An account holds at most 2 sign-ins at once, and a new one beyond that ends the oldest.
Everything else is kept while your account exists. Payroll history that disappeared after a few months would defeat the purpose of the app.
When you ask for deletion, the account is scheduled and the data is removed 7 days later. During those days you can still sign in and cancel it.
Server logs recording the technical details of a request are kept briefly for security and troubleshooting, then rotated away.
A phone's push token is used only while the sign-in that registered it is live, and is deleted as soon as Google reports that it no longer works. The log of messages sent to you is kept while your account exists.

Deleting your account

You can delete your account from within the app, under My Profile. You can also do it without the app, on the page below, which asks only for your mobile number and password.

Delete your EstateSync account

Deletion is real, not anonymisation. Your account, the estates you own, their sections, every worker, every daily work record, every salary scheme, every payroll month including closed ones, and every ledger entry are deleted outright.

How it is protected

All traffic between the app and the server is encrypted with HTTPS.
Passwords are hashed with scrypt. There is no way to read one back — including for us.
The token that keeps you signed in is held on your phone in the iOS Keychain or the Android Keystore, and the server keeps only a digest of it, never the token itself. In the web portal, your sign-in is held in cookies that page scripts cannot read, used only to keep you signed in and to remember your language and the estate you have open.
Every query is scoped to a single estate, so one account's records cannot be returned to another.
Passwords, one-time codes and sign-in tokens are never written to our logs, and neither are the terms you type when searching for a worker.

Your choices

You can see and correct your own account details, and your estate and worker records, in the app at any time.
You can read this policy and use the app in English or Sinhala, and change that whenever you like. Notifications follow the same choice.
You can switch notifications off at any time in your phone's settings.
You can delete your account, with the effect described above.
You can contact us with a question about any of this, using the details at the end of this page.

Children

EstateSync is a tool for running a business. It is not directed at children and is not intended for them. Do not create an account if you are under 18.

Changes to this policy

If this policy changes, the new version is published at this same address with a new version number and a new effective date. The version in force is always the one you are reading here.

Who to contact

Questions about this policy, or about the data held under your account, go to:

Company	LeafChain Technologies (Pvt) Ltd
Registration	PV 00345239
Phone	0718990100

This policy is published in English and Sinhala. If the two versions differ, the English version governs.