Application and developer identity. This Privacy Policy is published by Stenli Apps, the product and developer name used by Stancho Gospodinov Manolov, the Apple Developer account holder and App Store seller. Stenli Apps is also the developer and publisher identified in the Google Play store listings for:
- BossCheckin — the employer application, including its Temporary Kiosk and Trusted Kiosk modes; Android package ID
com.bosscheckin.app. - MyCheckin — the employee application for Android and iOS; Android package ID and iOS Bundle ID
com.bosscheckin.employee. - KioskCheckin — the separate Permanent Kiosk application for employer-owned dedicated devices; Android package ID
com.bosscheckin.kioskcheckin. It is provisioned by the employer through BossCheckin rather than installed from its own Google Play listing.
This policy also covers the website bosscheckin.com and the online services operated by Stenli Apps for these applications. Privacy contact: [email protected].
The short version. BossCheckin, MyCheckin and KioskCheckin process business data locally. Core databases and managed vault payloads are encrypted, and clean Trusted/Permanent Kiosk installations additionally protect app-managed personal payloads and private kiosk secrets with device-local keys. Limited operational metadata and temporary files inside Android app-private storage are not claimed to be encrypted. We operate no server that can read your business content. Our online endpoints handle workspace licensing and access provisioning, encrypted routing, content-free iOS wake-ups and signed KioskCheckin software delivery. The relay may temporarily hold end-to-end encrypted office-message envelopes for delivery, but it has no keys to read them. We use no advertising and no analytics SDKs, and we do not sell personal data.
SECTION 01Who does what (roles)
BossCheckin is a tool used by employers to manage their workforce. Three parties matter:
- The employer (“the owner”, “the boss”) — installs the app, enters and controls all business data. For employee personal data processed in the apps, the employer is the data controller in the sense of the EU General Data Protection Regulation (GDPR).
- Employees (“workers”) — use the free MyCheckin client after their employer provisions access to its BossCheckin workspace. They use it to check in, view payslips and chat; they do not purchase access in MyCheckin. Questions about how your data is used at work go first to your employer (see Section 9).
- Stenli Apps (“we”, “the developer”) — provides BossCheckin, MyCheckin and KioskCheckin, the workspace-licensing and access-provisioning service, signed kiosk-module delivery and the optional relay. We are not a processor of your business content: the architecture denies us access to it. We cannot read, restore, or hand over data we never receive.
SECTION 02Data the apps handle — on your devices
The following categories exist inside the apps, on the employer's and employees' own devices. The business-content categories are not transmitted to the developer in readable form. The limited technical identifiers described below are processed by our activation, relay and push services only to activate devices, route encrypted traffic and deliver content-free wake-ups.
| Category | Examples |
|---|---|
| Employee records | Names, phone, email, work site, salary and pay history, worked days/hours, check-in and check-out events, absences, paid leave and sick days, bonuses and deductions, payments, internal manager notes and ratings. |
| Photos | Employee profile photos (set by the employer or uploaded by the worker themselves), receipt/expense photos, photos sent in chat, small colleague-avatar thumbnails distributed to same-site colleagues. |
| Employee documents | Scans or PDFs the employer attaches to an employee (e.g. driving licence, ID), with an expiry date and comment. These are sensitive identity documents and are treated with the strictest retention rules (see Section 8). |
| Messages | Chat between the office and workers, between managers, and between colleagues — text and photos, with delivery/read receipts. These spaces have different visibility: office↔worker chat is part of the business records the employer controls (including backups); colleague (worker↔worker) chat is end-to-end encrypted between the participants only — devices that relay it carry sealed bytes, it is not readable by the employer and is not included in office backups. |
| Technical identifiers | Cryptographic device identities and public keys used for pairing, signing and encryption; opaque owner/tenant and device identifiers; workspace-license and employee-access provisioning state and timestamps; and, after real employer provisioning on iOS, an APNs device token. These identifiers are linked to the provisioned device and used only for app functionality and security — never for advertising, analytics or tracking. |
SECTION 03Where it is stored
- The employer's phone is the source of truth. In the current Protected product mode, the core database is encrypted at rest with SQLCipher, and managed photos/documents live in an additionally encrypted, content-addressed vault. Temporary files created for preview, export or sharing may exist in Android app-private cache until the app or operating system removes them.
- Trusted Kiosks are the built-in BossCheckin kiosk role. Permanent Kiosks run the separate KioskCheckin application. On a clean installation, both use an SQLCipher database, authenticated encryption for app-managed personal payload files, and device-local keys protected by AndroidKeyStore for private kiosk secrets. Public operational metadata such as format markers, hashes, sizes and status flags may remain visible.
- Worker phones hold the worker's own data — their payslips, calendar and messages. Android uses an SQLCipher database; iOS keeps identity secrets in Keychain and app data in the application's private container. Some locally cached profile/colleague images and temporary preview/share files may remain unencrypted inside app-private storage; message payloads and chat attachments are protected in transit with end-to-end encryption.
- Backup destinations may hold protected payroll and file payloads encrypted with the owner's keys. A backup ZIP is not one opaque encrypted container: its limited signed manifest and operational profile metadata may remain visible.
- The developer's infrastructure holds no readable copy of your business content.
Every record in the system is digitally signed (Ed25519) in an append-only history, so tampering is detectable by the devices themselves.
SECTION 04How data moves between devices
- Local network (default): devices discover each other on the employer's WiFi/LAN and exchange data directly, sealed end-to-end with libsodium (X25519 key agreement + authenticated encryption). Chat content is additionally sealed per message and per photo.
- Optional internet relay: if the employer enables internet mode, devices that can't reach each other locally connect outbound to
relay.bosscheckin.comand exchange the same sealed frames through it. The relay is a blind forwarder — see Section 5. - Optional Google Drive backup: the employer may enable incremental backups to their own Google Drive account. Protected payroll and file payloads arrive already encrypted with the owner's keys. The package can also contain a limited signed manifest and operational profile metadata that are not encrypted as one opaque container.
- Courier device: a phone may physically carry backup data between sites with no network at all. It cannot decrypt owner-sealed payroll and file payloads, although limited signed manifest and operational profile metadata may be visible.
- Permanent Kiosk provisioning and updates: after the employer confirms the first module download, BossCheckin downloads the signed KioskCheckin module from
bosscheckin.com, verifies it and caches it on the employer's phone. A factory-reset kiosk receives that module from the employer's phone over the local network during QR provisioning. The same local path is used for later Permanent Kiosk updates. The employer can control automatic updates or start a manual check/update; this software-delivery flow contains no employee or payroll content. - Optional access-hardware integration: if the employer connects BossCheckin to an on-premises access system (an electric door, gate or barrier) via the integration API, valid check-in events trigger that local hardware. This is a local integration on the employer's premises — it sends no data to us or to any third party.
SECTION 05What our servers actually see
The developer-operated online endpoints used by the Apps process the following limited information:
| Service | Processes | Does NOT process |
|---|---|---|
| Workspace licensing & access provisioning activation.bosscheckin.com |
Technical activation credentials for employer-allocated access seats, the owner's public key (business identifier), provisioned device identifiers and timestamps — the minimum needed to issue and account for workspace licenses and device access. Kept for license bookkeeping. | Any business content. No names, no salaries, no messages, no photos. |
| Internet relay (optional) relay.bosscheckin.com |
Routing metadata: which tenant (an opaque identifier), which device endpoints are connected, frame sizes and timestamps. Standard connection logs (IP addresses) exist transiently at the network layer. For reliable office-to-worker delivery, sealed office-message envelopes may be held in a store-and-forward mailbox for up to 7 days and are deleted after delivery or expiry. | Readable content — frames and queued office-message envelopes are end-to-end encrypted and the relay has no decryption keys. |
| Automatic TLS certificate (optional) activation.bosscheckin.com |
If the owner turns on the automatic certificate, the phone sends a certificate-signing request (no private key — that never leaves the phone) and the owner's public key, and publishes the phone's local network (LAN) IP address as a public DNS record so browsers on the office network can reach it over real HTTPS. We obtain a standard Let's Encrypt certificate on the owner's behalf. | The private key (stays on the phone), and any business content. The published LAN IP is a private-range address (e.g. 10.x / 192.168.x) that is meaningless outside the office network. |
| KioskCheckin module delivery bosscheckin.com/kiosk/ |
A small version manifest and the signed KioskCheckin APK; standard web-request data such as IP address, timestamp, requested path and transfer size may appear in transient infrastructure logs. When Automatic update is on, the employer's BossCheckin phone checks the manifest about once per day. | Employee identities, check-ins, payroll, messages, photos, documents or any other business content. Permanent Kiosk devices receive the module from the employer's phone over the LAN and do not need to contact this endpoint directly. |
The automatic certificate is off by default — the manual, self-signed option (you install the certificate once) is always available and exposes nothing externally. Auto mode needs internet only when issuing or renewing (about every two months); day-to-day operation stays offline either way.
Content-free iOS wake-up notifications: MyCheckin registers an Apple Push Notification service (APNs) device token after the employer provisions real workspace access on the employee's device. The relay stores that technical token, linked to the opaque device and tenant identifiers, so it can wake a sleeping iPhone to fetch still-encrypted data. The token remains registered while the device is active; an invalid token is removed when APNs reports it as no longer valid. The push contains no employee name, message, payroll information or other business content. Apple processes the delivery metadata under its own terms.
We use no analytics, no advertising SDKs, no crash-reporting that exfiltrates your data, and no trackers — in the apps or on this website.
SECTION 06Device permissions and why they exist
| Permission | Used for |
|---|---|
| Camera | Scanning check-in, device-pairing and Permanent Kiosk provisioning QR codes; taking photos the employer chooses to attach (e.g. receipts). Employee access is delivered over the local network and does not use an activation QR. QR scans are processed on-device; no image is sent to us. |
| NFC | Tap-to-check-in: the kiosk and the worker's phone exchange a signed, single-use token over a ~4 cm radio link. Entirely offline; nothing is sent to the internet. |
| Location (MyCheckin and KioskCheckin on applicable Android versions) | Android requires this permission for local WiFi information used to detect a courier hotspot or read the current network name during kiosk setup. It is not used for GPS tracking, is not stored as employee history and is not sent to us. |
| Notifications | Message notifications, document-expiry reminders, content-free iOS wake-ups, and the persistent notification Android requires for long-running connections. MyCheckin asks for iOS notification permission only after real employer activation, not on the public demo screen. |
| Network / WiFi state | Discovering your own devices on the local network, keeping device-to-device connections alive, and transferring the KioskCheckin module from the employer's phone to Permanent Kiosks. |
| Android Device Owner (Permanent Kiosk only) | Locking an employer-owned, factory-reset Android device into a dedicated check-in terminal, making KioskCheckin its Home app and installing correctly signed updates. This is established only when the employer deliberately scans the provisioning QR during Android's initial setup. |
SECTION 07Optional AI access (MCP)
The employer may enable a read-only endpoint on their own phone's Office Web server (standard MCP protocol) so that an AI assistant the employer runs can read the business sections the employer explicitly grants (e.g. sites, employees, money summaries, leave, reports). Important properties:
- Off by default. Nothing is exposed unless the employer turns it on and creates an access token.
- Read-only and section-gated. Chat messages are never exposed.
- The app sends nothing to any AI provider. If the employer connects an AI client that forwards data to a provider, that is the employer's own integration outside the app, and the employer is responsible for it.
SECTION 08Retention & deletion
- The employer controls the data lifecycle. Records can be deleted into a recycle bin (restorable) and purged from there.
- Automatic GDPR retention scrub: the employer sets a retention period for former employees. Once a former employee passes that period, their personal data — photo, phone, email, uploaded identity documents, internal notes — is automatically and permanently erased on the employer's devices and the change propagates to kiosks. Payroll history (amounts, worked time) is retained, because payroll law (BG/EU) requires employers to keep it.
- Backups: copies in the employer's Google Drive, NAS or designated backup devices may retain earlier snapshots until they are refreshed or deleted by the employer. Protected payroll and file payloads remain encrypted with the employer's keys; limited signed manifest and operational profile metadata may remain visible.
- Our servers: activation records are kept as long as needed for license accounting; relay routing and connection metadata is operational and transient; sealed office-message mailbox items expire after at most 7 days; iOS push tokens remain registered while valid and are removed when APNs reports that they are no longer valid.
SECTION 09Your rights (especially if you're an employee)
Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection regarding your personal data.
If you are an employee whose data is in BossCheckin: your employer is the data controller — exercise your rights with them. We, the developer, cannot access, identify, export or delete your business content because we receive no readable copy of it. The employer controls the devices, optional backup destinations and data lifecycle.
If you believe your rights have been infringed, you may lodge a complaint with your supervisory authority — in Bulgaria, the Commission for Personal Data Protection (КЗЛД).
SECTION 10Third-party services
| Party | Role | What they can see |
|---|---|---|
| Cloudflare | Network edge for this website and the developer-operated activation, relay and KioskCheckin module-delivery endpoints. | Standard network traffic data (IPs, TLS metadata and web requests). Relay traffic through it is end-to-end encrypted ciphertext. |
| Google Play distribution of BossCheckin and MyCheckin; Android device provisioning; optional Drive backup in the employer's own account; fonts on this website. | Play and Android: standard distribution, install and device-provisioning information on Google's side. Drive: owner-encrypted payroll/file payloads plus limited signed manifest and operational profile metadata. Fonts: standard web font requests. KioskCheckin is delivered by Stenli Apps through the employer's BossCheckin device, not through a separate Play listing. | |
| Apple | App Store distribution of MyCheckin and delivery of content-free APNs wake-up notifications. | Standard App Store installation/device information and APNs delivery metadata on Apple's side. Business content is not placed in push notifications. |
That's the whole list. No data brokers, no advertisers, no “trusted partners”.
SECTION 11This website
bosscheckin.com is a static site. It sets no cookies, runs no analytics, and contains no tracking pixels. It loads fonts from Google Fonts (a standard request to Google's servers) and is served through Cloudflare, which keeps standard transient connection logs. If you email us, we receive what you send us and use it only to reply.
SECTION 12Children
BossCheckin, MyCheckin and KioskCheckin are workforce-management tools for businesses and are not directed at children. We do not knowingly process children's data.
SECTION 13Changes to this policy
If the apps gain capabilities that change anything described here, this policy will be updated before or together with the release, and the effective date above will change. Substantive changes will be summarised at the top of this page.
SECTION 14Contact
Developer and publisher: Stenli Apps
Apple Developer account holder and App Store seller: Stancho Gospodinov Manolov
Applications: BossCheckin (com.bosscheckin.app), MyCheckin for Android and iOS (com.bosscheckin.employee) and KioskCheckin (com.bosscheckin.kioskcheckin)
Privacy point of contact: [email protected]