Last updated: 24 October 2026

Controller: Les services de consultation BLUE FOX inc. (Blue Fox), bonjour@symbifox.com

Symbifox Mobile is a client for your own Odoo instance. The app has no server or service of its own, and creates no account: you sign in with your account on the instance, which your organisation manages.

English version of PRIVACY.md, carrying the date of the French policy it translates. Both say the same thing; where they differ, the French one governs, because it is the one Blue Fox writes first.

In one sentence

The app talks only to the Odoo instance you point it at yourself, has no analytics and no advertising, and transmits nothing to any other service, with the exceptions described below (remote images in an email, notification distributor, calls).

One version

Symbifox Mobile is distributed through Google Play and through the Symbifox F-Droid repository, and it is the same app on both. It does not contain the SMS relay: it neither declares nor requests access to SMS and MMS, the call log or contacts, and reads none of them. The relay, which was part of Symbifox Mobile from version 3.0.0 to version 3.22.0, is a separate app again, BF SMS Relay, distributed through the F-Droid repository only. What Symbifox Mobile does with what it left on the phone is described at the end of this page.

What the app reaches

• Your Odoo instance, the one whose address you enter on first launch. The app reads and writes there what your Odoo account already allows you, depending on the modules your instance offers: your email, the texts of the business lines, the call log of the instance's phone system, your calendar, your tasks and activities, your notes, your conversations with Gen, your discussions with colleagues, your timers, your NFC tags and the Tokens vault, which is stored there encrypted.
• The microphone, only during something you start: a call, a dictation, a spoken conversation with Gen or a meeting recording. A recording carries on with the screen off, and a notification shows it for as long as it lasts. The audio goes to your instance, which transcribes it.
• The files you choose: a photo, a PDF, an audio or video file that you attach, share to the app or upload. The app does not browse your storage and does not ask for access to it.
• Your organisation's name, time zone and brand colours, read from the same instance, to adapt the look and show the organisation's time.

Permissions

NFC and biometrics are ordinary permissions, granted automatically, like network access, the foreground service of a call or a recording, audio settings and keeping the phone awake during a call, and starting with the phone, which is used to restore the organisation-time notification and to restart background tasks.

The app asks for neither location, nor access to shared storage, nor contacts, nor SMS, nor the phone's call log.

If you choose it as the phone's digital assistant, the assist gesture opens Gen in the app. It does not read what is on the screen at that moment.

Gen's answers that you have read aloud go through the phone's text-to-speech engine, the one you chose in Android's settings.

⚠️ Unlocking Tokens with a passkey relies on Android's Credential Manager, which goes through Google Play services on Android 13 and below. On a device without those services, the feature is hidden and everything else, offline codes included, works normally.

What the app keeps, and where

On your device, in the app's private storage, and nowhere else, with one exception: Account lists your account among Android's accounts.

The cache exists so that the app opens on your data rather than on an error message when the network is down. It is not separately encrypted: it is protected by Android's sandboxing, like any app's data, and by your device lock.

Android's automatic backup is disabled: nothing goes to Google. Exchanges with your instance are https only; the app refuses cleartext traffic.

Notifications

Notifications go through UnifiedPush, not through Google's services. No Google Play Services, no Firebase.

You install on your phone an app called a distributor, for example ntfy. It gives you a receiving address, which Symbifox Mobile passes to your Odoo instance so that the instance knows where to push.

A notification passes through the server of the distributor you chose. With an up-to-date instance, its content travels there end-to-end encrypted (RFC 8291), with keys only your phone holds: the distributor sees an unreadable message. ⚠️ An older instance that does not encrypt pushes a title and a preview in plain text, for example the sender and the start of a message; if the distributor is a public service, it is a third party on the path. A distributor pointing at a server you or your organisation host avoids that third party.

You may install no distributor at all: the app works, it reloads its data when opened, and background tasks reload the calendar and resend what is waiting from time to time, instead of being notified.

What the app transmits, and to whom

To the Odoo instance you designated, and, for calls, to the phone server and audio relay that this instance tells it to use.

⚠️ Remote images in an email are blocked by default. If you tap "Show" on a message, they are loaded from the server that hosts them, usually the sender's, which then sees your phone's IP address, as in any email software.

There is no analytics, no telemetry, no crash reporting, no advertising, no remotely loaded code.

The call diagnostic log leaves the device only if you share it yourself, from the Phone section, with the recipient you choose.

What your instance then does with your data is up to your organisation. For example, a question asked to Gen or a recording to transcribe is processed by the services your organisation chose for its instance. If your organisation has Blue Fox host its instance, Blue Fox runs it on the organisation's behalf, as a processor, under the agreement between them; the app itself sends nothing else to Blue Fox.

You can report one of Gen's answers (flag under the answer). The report, its reason and your optional details are recorded on your organisation's instance, where its administrators can see them. If Blue Fox hosts the instance, Blue Fox is notified that an answer was reported and why; the notice itself carries neither the text of the answer nor your details. As the host that administers the instance, Blue Fox may then view the report to handle it and improve Gen's filtering. Your details are erased after 12 months; the report and its reason stay on the instance until your organisation deletes it. Archiving the conversation, from the app or elsewhere, leaves the text of the answer in it; only deleting the conversation in Symbifox, on the instance, removes that text from the report, which then keeps its reason and your details.

No password goes through the app: sign-in happens in your instance's own web page, which returns a one-time code, exchanged for an access token specific to the device.

What the app does not do

• It does not sell, rent or share any data.
• It contacts no Blue Fox service other than your instance, when Blue Fox hosts it.
• It does not watch anything you do elsewhere on the phone.

Retention and deletion

Your data lives on your Odoo instance, and its retention there is set by your organisation. On the device:

• uninstalling the app erases everything it kept, and removes Account's entry from Android's accounts;
• signing out in the app removes Mobile's token and erases what the session had left on the device, attachments included;
• from your instance, the "My devices" page (/my/appareils) lists the paired devices and lets you remove one, or all.

When a device is removed, or the Odoo account is archived, the app erases on its own what Mobile's session had left on the device as soon as it next contacts the instance. A phone that stays offline does so the first time the app is opened after the deadline set by the instance. Attachments already opened only go at sign-out or uninstall.

⚠️ Tokens and Account have their own pairing, and neither signing out of Mobile nor removing the device erases them. You remove them in their section: "Forget this instance" in Tokens (your vault stays intact on the instance), "Remove this account" in Account.

The app erases only what it put on the device, nothing else.

Your rights

Blue Fox collects no personal data through the app: there is nothing to access, correct or delete on that side. Your data stays under your control and your organisation's, on your device and on your Odoo instance. For any question: bonjour@symbifox.com.

The SMS relay, now BF SMS Relay

From version 3.0.0 to version 3.22.0, the F-Droid version of Symbifox Mobile contained the SMS relay. It is a separate app again, BF SMS Relay, with its own listing in the Symbifox F-Droid repository.

On a phone where the relay was set up, Symbifox Mobile keeps, after its update, what the relay left in its private files, not encrypted: the instance address, the device token, the device name and where the sync stopped (last text, MMS and call sent), with no content at all. It tells you that the relay no longer works and, if you install BF SMS Relay and agree in it, hands this over to it on the device, without going through the network. It deletes it as soon as BF SMS Relay has taken it over, or when you tell it you no longer relay this phone. The token stays valid in your instance until you remove the device there.

Changes

Any change to this policy will be published at this address, with its date.