Privacy

What is stored

Your account

When you sign in with Apple or Google, the server keeps the identifier Apple or Google gives it for you. It is a string of letters and digits, not your name and not your e-mail address. With Apple it also keeps one token Apple issues, sealed, for a single use: telling Apple the account is gone when you delete it.

Beside that: when the account was made and last used, whether it has been approved, and your phone's time zone offset.

KeptUntil you delete the account.

Your devices

For each phone or tablet that is signed in: a fingerprint of its sign-in token (never the token itself), an identifier the app made up for that device, and when it signed in and was last used.

KeptUntil that device signs in again, which replaces it, or the account is deleted. Signing out, or 400 days without use, ends the sign-in but leaves the row.

Samsara link

Your Samsara username and password, your driver id and name as Samsara gives them, and the sessions Samsara issues to the server. All sealed.

The password is kept so the server can sign in again for you when Samsara ends a session. It does that only while you are using the app: when you open it, refresh, or send a filing. Never on a timer.

KeptUntil you unlink Samsara or delete the account. The password is also deleted the moment Samsara refuses it, and with the sessions when no device of yours has used the account for 90 days.

TransFlo link

What you type to enrol: e-mail address, first and last name, phone number and driver code. And the token TransFlo issues for you. All sealed.

KeptUntil you unlink TransFlo or delete the account. The token is also deleted when no device of yours has used the account for 90 days.

Your loads from dispatch

One copy, sealed, of the routes dispatch lists for you in Samsara: load numbers, stops and their addresses and map positions, appointment times, freight bill details and notes. It is replaced each time it is fetched: when you open the app or refresh, and about twice a day while a device of yours has been used in the last 14 days.

Samsara's reply as it arrived, before the server reads it, is kept (sealed) only for an account where the operator has switched that on to fix a reading problem. Switching it off deletes it.

KeptUntil you unlink Samsara or delete the account.

Pages

The scans and paperwork pages you send with a filing are stored sealed, passed on to Samsara or TransFlo as that filing, and then removed.

Beside each page, not sealed: a SHA-256 hash of its bytes (which is also the name of its file), its size, whether it is a JPEG or a TIFF, when it arrived and which filing named it. The hash is also in the log line of the page's upload.

KeptOne day after the filing ended. One week if the server could not tell whether the filing arrived. One day if no filing used them.

Filing records

For each filing: its kind, the app's own id for the stop or load, when it was received, how it ended, the confirmation number, any message the provider gave, and for a filing that was not sent the lines that say why (they can quote the form's labels). This record is what stops the same paperwork being filed twice.

What was sent (the load number, the form's answers, your phone's model and system version) and the provider's ids for it are sealed beside the record.

KeptThe record: until you delete the account. What was sent: 30 days after the filing was accepted or not sent. A filing whose outcome is unknown keeps it until you mark it as arrived in the app (then 30 days), or else until you delete the account.

History

One row each time the server signed in to Samsara for you, enrolled you at TransFlo, or was told by a provider to wait: the time, a one-word result and a status number. Nothing you typed and nothing the provider said.

KeptUntil you delete the account.

Fingerprints

For checks that must work without opening anything sealed, the server keeps keyed fingerprints that cannot be turned back into the value: of your Samsara driver id, so one driver cannot be linked to two accounts; of the stop or load a filing was for, so it is not filed twice; and of a username Samsara has just refused, to slow down guessing.

KeptWith the link or the filing record they belong to. A refused username's: one day.

The server's log

One line per request: the time, the first eight characters of your account id, the method and the address asked for (for a filing, that address holds the app's id for the stop or load), the status and how long it took. For each call to a provider: its name, the status and how long it took, and for a scan the name of the host Samsara had it sent to.

KeptThe server keeps no log file. Its lines go to the hosting service's log, which this server does not control.

What sealed means

Sealed means encrypted (AES-256-GCM) with a key that is handed to the server when it starts and is never written to its disk. A copy of the disk, or of a backup, cannot be read without that key.

The operator of this server holds the key and can therefore read what is sealed, your Samsara password included. So could anyone who took control of the running server. Ids, states, times and the fingerprints above are not sealed.

Never stored or logged

• Your name, e-mail address or password at Apple or Google.
• Your Franklin sign-in token. Only its fingerprint is kept.
• Your location, your pay, your settings, and your own records in the app. They are not sent to this server.
• Your network address. It is counted in memory to slow down repeated sign-in attempts and is not written to the database or the log.
• In the log: the content of any request or reply, a password, a token, a cookie, or anything a provider answered.

Your Samsara password is never sent back to any device, yours included. These pages set no cookies, run no scripts and load nothing from any other site.

Who it is sent to

• Samsara: your username and password, to sign in as you; and each document you file, with its scans.
• TransFlo: your enrolment details when you link; and each paperwork batch you file, with its load number and your phone's model, system version and time zone offset.
• Apple or Google: what is needed to check your sign-in, and with Apple to cancel it when you delete the account.

Nobody else. Nothing is sold, and nothing is used for advertising or analytics.

Unlinking a provider

In Franklin: Settings › Account › ELD Provider › Unlink Samsara. The server deletes your Samsara username, password and sessions and its copy of your loads from dispatch, at once.

Settings › Account › Paperwork Provider › Unlink TransFlo deletes your enrolment details and your TransFlo token, at once.

Your filing records stay until you delete the account. Neither provider offers a way to sign out from here, so a Samsara session ends on Samsara's own schedule, and your enrolment stays valid at TransFlo. Unlinking is refused for a moment while a filing of yours is being sent.

Deleting your account

In Franklin: Settings › Account › Delete Account. The server deletes the account and everything listed above that belongs to it, in one step: your sign-in, your devices, both links, your loads from dispatch, your pages, your filing records and your history. It then asks Apple to cancel the token it held. An account that is still waiting for approval can be deleted the same way.

The loads on your phone are not touched. Deleting is refused for a moment while a filing of yours is being sent.

Deleting the app from your phone does neither: it does not sign you out and does not delete the account. The phone's keychain keeps the sign-in, and the server takes it until it has gone 400 days without use. Sign out, or delete the account, before you delete the app.

What deleting cannot reach: documents already filed with Samsara and TransFlo, your enrolment at TransFlo, and backups (below).

The operator can also delete an account by hand. Ask at the address at the foot of this page.

Backups

The hosting service takes a daily copy of the server's disk and keeps each one for 14 days. Something you deleted is still inside those copies, sealed where it was sealed, until they expire.

If a copy is ever put back, an account deleted after it was taken comes back with it, and so do old filing records. The operator then starts the server so that, before it answers anything, it erases every stored password, session, token, copy of loads and page from the restored disk and signs every device out, so every driver signs in and links again. You would have to delete the account once more.

The operator

Franklin's server is run by its developer. New accounts are switched on by hand. The operator can approve an account, sign it out everywhere, unlink a provider, delete the account, and pause all filing.

If the key is ever thought to be exposed, the operator can order every stored Samsara password, session and TransFlo token deleted and every device signed out.

Contact

[Contact address: to be filled in by the operator before this page is published]