IIB-SHA — Privacy policy
Last updated: 28 October 2026
IIB-SHA is a private app used by the shareholders and staff of the IIB-SHA project to record the money it receives (budget top-ups) and spends (purchases and payments). It is not open to the public: accounts are created only by the project's Super admin.
What the app stores
- For each person with an account: name, email address, role, and whether the account is active.
- Money records: top-ups and purchases with their amounts, dates, notes, categories, suppliers and who entered them, plus a permanent history of every change.
- Evidence files that people choose to attach: invoices, receipts, and proofs of transfer (for example a bank slip or a screenshot of a mobile-money confirmation).
Where it is stored
- Accounts and money records are stored in the project's Supabase database.
- Evidence files are stored in a private folder of the project's own Google Drive account. The folder is not shared, and files are never available through a public link.
- The app itself is served by Cloudflare. The sign-in page uses Cloudflare Turnstile to block automated sign-in attempts.
Google Drive access
The project's own Google account allowed the app to use Google Drive with the narrowest
permission Google offers (drive.file). With it, the app can see and manage only
the files it created itself. It cannot see any other file in that Drive, and it has no
access to Gmail or to any other Google service. People using the app never sign in with
Google; all access to Drive happens on the project's server.
IIB-SHA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who can see the information
- The Super admin and shareholders can see all money records and evidence files.
- Staff can see only the purchases they entered themselves, and their attached files.
- Nothing is sold, shared with advertisers, or used for any purpose other than keeping the project's accounts.
How long it is kept
Money records and evidence files are kept permanently, because they are the project's financial records. Mistakes are corrected by a recorded reversal, not by deleting. An account that is no longer needed is disabled, after which that person can no longer sign in.
Security
All traffic is encrypted (HTTPS). Every request is checked against the person's role on the server, and people are signed out automatically after a period without activity.
Questions
For questions about this policy, or to ask what information is held about you, contact the IIB-SHA project's Super admin.