All-G StockMate INVENTORY & STOCK CONTROL Current release

Legal documentation

Privacy Policy for All-G StockMate

Local-first inventory architecture, device communication, and personal data governance.

Version: 0.9.0-ea.6 (Early Access) • Effective Date: September 30, 2026 • Document Status: Ready for publication (READY_FOR_PUBLICATION)

1. Introduction, Software Operator, and Data Governance Scope

This Privacy Policy describes the policies and practices regarding the processing of data in connection with the use of the All-G StockMate software (desktop application for Windows and mobile application for Android), hereinafter referred to as the "Application" or "Software".

Software Operator and data controller for data processed directly by All-G Solutions:
Olga Klasa All G Solutions
Brand: All-G Solutions
Registered Office / Business Address: ul. Stanisława Ignacego Witkiewicza 51 lok. 7, 71-124 Szczecin, Poland
Tax Identification Number (NIP): 6731884436
Domain Website: allgstockmate.com
General Contact Email: contact@allgstockmate.com
Privacy and Support Email: support@allgstockmate.com

Important Role Delineation in Local-First Architecture:

  • No All-G Access to Local Data: All-G Solutions is the software operator and data controller solely with respect to data processed directly by All-G Solutions (such as technical support email correspondence). All-G Solutions has no technical access to the User's local database and does not act as a data controller for inventory or invoice records created and stored locally by the User on their own devices.
  • User as Controller of Local Records: All local inventory data and invoice documents remain under the User's sole custody and control. Where data stored locally contains personal data of third parties (such as sole proprietor suppliers), the legal obligations of a data controller under applicable data protection laws (including GDPR) rest entirely with the User.
  • Third-Party Components: Diagnostic telemetry collected by the Google ML Kit SDK is governed by the independent privacy policies of Google LLC as the component provider.

For questions or inquiries regarding the Software, privacy, or user rights, please contact us at: support@allgstockmate.com.

2. Local-First Architecture and Absence of All-G Cloud

StockMate in its Free and Standard tiers is engineered with a local-first architecture:

  1. No Cloud Database: All-G Solutions does not operate, host, or maintain any centralized cloud database for Free and Standard tiers.
  2. Local Windows Host: All operational warehouse data (product catalog, inventory stock levels, transaction history, invoice documents, and settings) is stored exclusively on the user's local Windows computer in a local SQLite database (inventory.db).
  3. No Cloud Accounts Required: Using the Application in Free and Standard tiers does not require creating a cloud account with All-G or registering an online identity.

3. Local Area Network (LAN) Communication — Important Notice Regarding HTTP Cleartext Transport

The Android mobile client connects to the Windows desktop server exclusively across the user's local network (LAN / Wi-Fi):

  1. Cleartext HTTP in Early Access: In the current Early Access release (0.9.0-ea.6), communication across the local network is established over cleartext HTTP (http://<computer-ip>:<port>).
  2. No TLS Encryption on LAN: The local connection does not use TLS/HTTPS encryption. Consequently, data transmitted between the mobile phone and desktop computer across the local network is NOT cryptographically encrypted in transit.
  3. User Security Recommendations: The user should operate the Application exclusively within a trusted, private local network (such as a company or home network secured with WPA2/WPA3). Using the StockMate mobile connection on open, public, or untrusted Wi-Fi networks is strongly discouraged, as network traffic could be intercepted by third parties on that local network.
  4. Google Play Data Safety Alignment: Due to the cleartext HTTP transport on LAN, the Google Play Data Safety declaration for the Application accurately discloses that collected data is not encrypted in transit across all channels (ALL_COLLECTED_DATA_ENCRYPTED_IN_TRANSIT=NO).

4. Scope and Categories of Data Transmitted between Devices (Android -> Desktop)

When using the mobile module across the local network, operational queries and data necessary for warehouse management are transmitted.

The vast majority of this information constitutes commercial and warehouse operational data, rather than personal data, unless it directly identifies an individual sole proprietor or employee.

Categories of data transmitted over the local network include:

  • Pairing and Device Identification Data: Android hardware model name (android.os.Build.MODEL, e.g. "Pixel 8"), 6-digit one-time desktop pairing PIN, and internal technical session token (Bearer token);
  • Product Catalog: Product names, categories, subcategories, units of measure, alert thresholds, classification facet IDs, and producer SKU codes;
  • Barcodes: EAN, UPC, Code 128 barcodes transmitted for product search, catalog assignment, or stock counts;
  • Queries and Filters: Text-based search queries within the warehouse catalog;
  • Inventory Stock and Movements: Warehouse storage zone IDs, transfer quantities between locations, and operational movement notes;
  • Stocktake Audits: Physical inventory session names, timestamps, physical counted quantities, and audit notes;
  • Invoice Documents and Images: Photo captures from the device camera (JPEG) and document files (PDF) transmitted to the desktop for local analysis;
  • Invoice Records and Line Items: Invoice document numbers, issue dates, supplier/vendor legal names, supplier tax identification numbers (Tax ID / NIP), net amounts, VAT tax amounts, gross totals, line-item product descriptions, and unit net/gross purchase prices.

5. Mobile Device Permissions (Camera) and Barcode Scanning

  1. Camera Permission (android.permission.CAMERA): The camera permission is invoked strictly upon user action for two purposes:
    • optically scanning item barcodes via the camera viewfinder dialog,
    • capturing photo images of invoice documents in the invoice module.
  2. Local Frame Processing: Video frames from the camera during barcode scanning are processed solely in volatile device memory (RAM). Camera frames and decoded barcode values are NEVER sent to Google servers or All-G. Frame buffers are closed and discarded immediately after each analysis attempt.

6. Third-Party Component: Google ML Kit Barcode Scanning

The mobile application embeds the Google ML Kit Barcode Scanning SDK (com.google.mlkit:barcode-scanning, version 17.3.0), provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

  1. Bundled Model: The machine learning model responsible for barcode recognition is bundled directly within the application package and operates offline on the phone without requiring dynamic model downloads from Google Play Services during scanning.
  2. SDK Telemetry and Diagnostics: The Google ML Kit library contains Google's standard diagnostic telemetry mechanisms (Firelog/Playlog). If the mobile device has an active Internet connection, the ML Kit SDK may transmit technical telemetry to Google LLC regarding SDK operations, including:
    • technical hardware specifications (device model, Android OS version),
    • SDK and application installation identifiers,
    • performance metrics (scan execution latency, barcode formats detected, error codes, API configuration).
  3. SDK Telemetry Security: All diagnostic telemetry dispatched by Google ML Kit is transmitted directly to Google servers over encrypted HTTPS.
  4. No Inventory Data Sent to Google: Google LLC does not receive decoded barcode content, product names, inventory quantities, or invoice photos through the StockMate scanner.
  5. Google Privacy Policy: For details on how Google processes diagnostic telemetry, refer to the Google Privacy Policy: https://policies.google.com/privacy.

7. Local Invoice Document Processing (OCR)

The automated invoice analysis module operates using the Docling / RapidOCR engine executing directly on the user's Windows computer:

  1. On-Premise Desktop Processing: Converting invoice images or PDF documents into structured text and tables takes place 100% locally on the user's computer hardware.
  2. No Transmission to All-G: Invoice photos, PDF documents, recognized text tables, and extracted items are NEVER transmitted to All-G Solutions servers.
  3. No Cloud OCR Engines: In the current Free and Standard tiers, the Application does not integrate or utilize any third-party cloud OCR API.

8. Absence of All-G Telemetry, Analytics, and Advertising

  1. Zero Behavioral Analytics: All-G Solutions does not track or collect data regarding user workflows, screen navigation, operating duration, or feature interactions.
  2. No Third-Party Trackers: No tracking or marketing SDKs (such as Google Analytics for Firebase, Mixpanel, Adjust, AppsFlyer, etc.) are embedded in the Application.
  3. No Third-Party Crash Reporting: The Application does not transmit error reports or crash dumps to external services (such as Crashlytics, Sentry, Bugsnag, etc.). Diagnostic logs remain strictly on the local device.
  4. No Advertisements: The Software contains no advertisements and incorporates no ad network SDKs (such as Google AdMob).

9. Status of the OCR Improvement Program

For complete transparency, we disclose the technical status of the OCR Improvement Program:

  1. Currently Completely Inactive: In version 0.9.0-ea.6, functionality for collecting document samples for OCR training DOES NOT EXIST AND IS INACTIVE (OCR_IMPROVEMENT_COLLECTION_ACTIVE=NO). No invoices, images, or extracted text snippets are harvested for development.
  2. Framework for Potential Future Program: Should such a program be introduced in future releases:
    • participation will be strictly voluntary and require explicit, separate consent (opt-in);
    • the default setting will always be disabled (OFF);
    • accepting this Privacy Policy or the Terms / EULA DOES NOT constitute consent to participate in the OCR Improvement Program;
    • refusing to participate or revoking consent will not restrict or degrade any core software features;
    • launching any document collection feature will be preceded by a dedicated formal privacy boundary audit (privacy gate).

10. Data Retention, Backups, and Deletion

  1. User Data Ownership and Custody: Because all inventory and invoice data resides exclusively on the user's local devices, the user retains sole authority over data retention periods, archival strategies, and backups.
  2. Data Deletion:
    • Deleting inventory data from the Windows computer is achieved by deleting the SQLite database file (inventory.db) or uninstalling the desktop application along with its data directory.
    • Uninstalling the Android mobile app clears mobile cache and the session token, but does not delete the database on the desktop computer.
  3. Data Subject Rights (GDPR): Where the user processes personal data of individuals (such as sole proprietor suppliers) within their inventory database, the user acts as the data controller and can fulfill access, rectification, or deletion requests directly via the Application interface or local database.

11. Amendments to this Privacy Policy

All-G Solutions reserves the right to update this Privacy Policy to reflect technological modifications, software enhancements (notably the future introduction of TLS encryption on the LAN transport), or changes in legal requirements.

Any revised policy will be published with an updated effective date in the Software documentation repository.

12. Contact Information

If you have questions, comments, or concerns regarding this Privacy Policy, please contact us at:

All-G Solutions
Support Email: support@allgstockmate.com
General Email: contact@allgstockmate.com
Website: allgstockmate.com
Postal Address: ul. Stanisława Ignacego Witkiewicza 51 lok. 7, 71-124 Szczecin, Poland

← Back to All-G StockMate