algonet.co.uk
Privacy policy · Algonet Pass
Privacy Policy
for Algonet Pass
This policy explains what the Algonet Pass mobile
application (Android package net.algonet.algonetpass, iOS
bundle net.algonet.algonetpass) stores on your phone, what
it sends over the network and to whom, and how you delete it.
Effective date: 25 July 2026 · Last updated: 25 July 2026
The short version. Algonet Pass is a sign-in authenticator for people who already have an account in an Algonet business system at work. It has no user accounts of its own. It shows no adverts, contains no analytics, tracking or advertising software, and sends nothing to Algonet Ltd. The only data it transmits is the cryptographic proof needed to confirm a sign-in, and that goes directly to your own organisation's server — the same server that shows the login page you are signing in to. Your fingerprint or face is never read by the app and never leaves your phone.
1. Who we are
Algonet Ltd ("Algonet", "we", "us") develops and publishes the Algonet Pass app. We are registered in England and Wales under company number 08663797.
Algonet Ltd 20-22 Wenlock Road N1 7GU London, United Kingdom Registered in England and Wales, company no. 08663797 E-mail: hello@algonet.co.ukWrite to that address for any question about this policy or about data held in connection with the app.
2. How the app is used, and who controls your data
Algonet Pass is a workplace tool. Your employer, client or another organisation ("the organisation") runs an Algonet business system on its own server and issues you an account there. The app turns your phone into the second factor for signing in to that account: you scan the code shown on the login page, the app proves it holds the registered key, and the sign-in completes.
This matters for privacy, so it is worth stating plainly:
- The organisation is the data controller for your account and for the sign-in records created on its server. Its own privacy notice governs that data, and it decides how long the records are kept.
- Algonet Ltd is the software supplier. The app communicates only with the server address contained in the code you scan. That server belongs to the organisation. Algonet operates no cloud service behind this app, receives no copy of your sign-ins, and has no access to the organisation's server unless the organisation separately engages us to host or support it — in which case we act on that organisation's instructions under a separate agreement.
3. Data the app stores on your phone
The following is created on your device when you register it with a system, and stays on the device:
| What | Why |
|---|---|
| The private half of an asymmetric key pair, generated on the phone | Proves that this specific phone approved a sign-in. The private key never leaves the device and is never transmitted. |
| A registration record: system identifier, system name, host address, registration token, the server's public key, and your user name as returned by that system | Identifies which system this registration belongs to, and lets the app verify that the server it talks to is the genuine one. |
| App preference: the interface language you selected | So the app opens in the language you chose. |
Registration data is held in encrypted storage: on Android in EncryptedSharedPreferences under a key held in the Android Keystore, and on iOS in the system Keychain. The app keeps no other file, database or log of your activity, and it does not read your contacts, photos, files, calendar or location.
4. Data the app sends, and where it goes
The app contacts exactly one destination: the server address encoded in the code you scan, always over an encrypted HTTPS connection. Each request carries only what the sign-in protocol needs:
- the system identifier and the identifier of the sign-in attempt you scanned;
- the public half of the device key, or the registration token of an existing registration;
- a cryptographic signature, a one-time random value and a timestamp, which together prevent replay and tampering;
- the app version, so the server can tell you when an update is required.
As with any internet request, the receiving server also sees the IP address your phone connects from. A typical Algonet server records the event of a sign-in or a device registration together with the user name, the time, and the IP addresses of the browser and the phone, because that is what a security audit trail requires. Those records belong to the organisation, not to us.
Nothing is sent to Algonet Ltd, and nothing is sent to any third party. The app contains no analytics, crash-reporting, advertising or tracking software development kit of any kind, and it builds no advertising or behavioural profile. We do not sell or rent personal data, and we never receive any to sell.
5. Biometrics and device unlock
Before the app confirms a sign-in or removes a registration, it asks you to authenticate with the biometric or screen-lock method your phone already uses (fingerprint, face or PIN, pattern and passcode). This check is performed entirely by the operating system: Android's BiometricPrompt or Apple's Face ID/Touch ID. Your fingerprint or facial data stays in the phone's secure hardware. The app never reads, stores or transmits it; it only receives a yes or no answer from the operating system.
6. Permissions the app requests
| Permission | Purpose |
|---|---|
| Internet access | To reach your organisation's server and complete the sign-in. |
| Use of biometric hardware | To ask the operating system to confirm it is you before a sign-in is approved. |
The app requests no other permission. In particular it does not ask for the camera: the code on the login page is opened by your phone's own camera or scanner, which then hands the link to the app.
7. Children
Algonet Pass is a workplace authentication tool intended for adults who hold an account in an organisation's business system. It is not directed at children and we do not knowingly collect data about them.
8. Retention and deletion
The app has no account with us, so there is nothing to close on our side. To remove your data:
- Delete a registration: open the app, choose Manage, select the system and remove it. The app deletes the key and the registration record from the phone and tells the server to revoke that device.
- Delete everything the app holds: uninstall the app. Uninstalling removes its encrypted storage and every key and preference in it. The app does not back its data up to any cloud; automatic backup is switched off in the app itself.
- Records held by your organisation: your account and the sign-in log entries live on the organisation's server. Ask that organisation to erase them; it is the controller and can act on your request. If you are unsure whom to contact, write to us at hello@algonet.co.uk and we will point you to the right place.
9. Security
- Every network request uses HTTPS, and the app refuses to connect over an unencrypted link.
- Each request and each response carries a digital signature from an asymmetric key pair, so neither can be forged or altered in transit.
- The app pins the server's public key when the device is registered and refuses to trust a different key afterwards.
- Private keys are stored encrypted at rest, protected by the platform's hardware-backed key store.
- An approval always requires the phone's biometric or screen-lock check, so a lost unlocked phone alone does not grant a sign-in.
10. Your rights
Under the UK GDPR and equivalent legislation you have the right to ask for access to your personal data, and for its correction, erasure or restriction, to object to processing, and to receive a copy in a portable form. Because your account and its sign-in history sit on your organisation's server, address such requests to that organisation first. Where Algonet does act as a controller — essentially, when you write to us directly — contact us at hello@algonet.co.uk.
If you believe your data has been handled improperly, you may complain to the UK Information Commissioner's Office (ico.org.uk) or to the supervisory authority in your country.
11. Changes to this policy
If the app's handling of data changes, we update this page and move the "last updated" date above. The current version is always available at the address in your browser's bar, which is the address given in the app's store listings.
12. Contact
Questions about this policy, about the app, or about a privacy request:
Algonet Ltd 20-22 Wenlock Road N1 7GU London, United Kingdom Registered in England and Wales, company no. 08663797 hello@algonet.co.uk