Privacy

What is stored

Your account

When you sign in with Apple or Google, the server keeps the identifier Apple or Google gives it for you. It is a string of letters and digits, not your name and not your e-mail address. With Apple it also keeps one token Apple issues, sealed, for a single use: telling Apple the account is gone when you delete it.

Beside that: when the account was made and last used, whether it has been approved, and your phone's time zone offset.

KeptUntil you delete the account.

Your sign-ins

For each phone or tablet that is signed in: a fingerprint of its sign-in token (never the token itself), an identifier the app made up for that device, and when it signed in and was last used.

Signing in on this website sets one cookie, which holds your sign-in. The server keeps only its fingerprint, the same way. While you sign in, a second cookie ties the sign-in to your browser for up to ten minutes; it is removed when you come back.

Whoever holds one of these sign-ins can read and change everything below until it ends. If a phone is lost, ask the operator to sign it out.

KeptA device's: until it signs in again, which replaces it, or the account is deleted. Signing out, or 400 days without use, ends the sign-in but leaves the row. The website's ends when you sign out, or after 30 days without use.

Your loads, pay and scans

What you keep in Franklin: your loads, stops, pay records, settings, ESOP statement, and the scans on your loads and stops. Each is stored sealed, under the id the app gave it, so that every phone you sign in on gets the same copy.

Not sealed: that id, whether it is a load, a stop, a scan, a setting or a deletion, the name of each setting, when it was made, changed or deleted, and for a scan a SHA-256 hash of its bytes (which is also the name of its file) and its size.

KeptUntil you delete it or the account. A record you delete is kept 30 days, so a mistake can be undone; after that only its id, kind and times stay, until the account is deleted. A scan you replace or remove is erased 15 days after.

Samsara link

Your Samsara username and password, your driver id and name as Samsara gives them, and the sessions Samsara issues to the server. All sealed.

The password is kept so the server can sign in again for you when Samsara ends a session. It does that only while you are using Franklin: when you open the app, refresh, link on this website, or send a filing. Never on a timer.

KeptUntil you unlink Samsara or delete the account. The password is also deleted the moment Samsara refuses it, and with the sessions when no device of yours has used the account for 90 days.

TransFlo link

What you type to enrol: e-mail address, first and last name, phone number and driver code. And the token TransFlo issues for you. All sealed.

KeptUntil you unlink TransFlo or delete the account. The token is also deleted when no device of yours has used the account for 90 days.

Your routes from dispatch

One copy, sealed, of the routes dispatch lists for you in Samsara: load numbers, stops and their addresses and map positions, appointment times, freight bill details and notes. Your phone makes your loads from it. It is replaced each time it is fetched: when you open the app or refresh, and about twice a day while a device of yours has been used in the last 14 days.

Samsara's reply as it arrived, before the server reads it, is kept (sealed) only for an account where the operator has switched that on to fix a reading problem. Switching it off deletes it.

KeptUntil you unlink Samsara or delete the account. Your loads stay when you unlink.

Pages

The scans and paperwork pages you send with a filing are stored sealed, passed on to Samsara or TransFlo as that filing, and then removed.

Beside each page, not sealed: a SHA-256 hash of its bytes (which is also the name of its file), its size, whether it is a JPEG or a TIFF, when it arrived and which filing named it. The hash is also in the log line of the page's upload.

KeptOne day after the filing ended. One week if the server could not tell whether the filing arrived. One day if no filing used them.

Filing records

For each filing: its kind, the app's own id for the stop or load, when it was received, how it ended, the confirmation number, any message the provider gave, and for a filing that was not sent the lines that say why (they can quote the form's labels). This record is what stops the same paperwork being filed twice, and what this website's Recent Filings shows.

What was sent (the load number, the form's answers, your phone's model and system version) and the provider's ids for it are sealed beside the record.

KeptThe record: until you delete the account. What was sent: 30 days after the filing was accepted or not sent. A filing whose outcome is unknown keeps it until you mark it as arrived in the app (then 30 days), or else until you delete the account.

History

One row each time the server signed in to Samsara for you, enrolled you at TransFlo, or was told by a provider to wait: the time, a one-word result and a status number. Nothing you typed and nothing the provider said.

KeptUntil you delete the account.

Fingerprints

For checks that must work without opening anything sealed, the server keeps keyed fingerprints that cannot be turned back into the value: of your Samsara driver id, so one driver cannot be linked to two accounts; of the stop or load a filing was for, so it is not filed twice; and of a username Samsara has just refused, to slow down guessing.

KeptWith the link or the filing record they belong to. A refused username's: one day.

The server's log

One line per request: the time, the first eight characters of your account id, the method and the address asked for (for a filing, that address holds the app's id for the stop or load), the status and how long it took. For each call to a provider: its name, the status and how long it took, and for a scan the name of the host Samsara had it sent to.

KeptThe server keeps no log file of its own. Its lines go to the log of the machine it runs on, and are deleted once the server has been updated twice.

What sealed means

Sealed means encrypted (AES-256-GCM) with a key that is handed to the server when it starts. The key is kept in a file of its own that only the operator can read, and is never in the database, in a backup or in the log. A copy of the database, of a scan or of a backup cannot be read without that key.

The operator of this server holds the key and can therefore read what is sealed: your loads, pay, scans and Samsara password included. So could anyone who took control of the running server or of the machine it runs on. Ids, kinds, states, times, hashes, sizes and the fingerprints above are not sealed.

Never stored or logged

• Your name, e-mail address or password at Apple or Google.
• Your Franklin sign-in token or cookie. Only its fingerprint is kept.
• Your phone's location. Franklin sends none.
• Your network address. It is counted in memory to slow down repeated sign-in attempts and is not written to the database or the log.
• In the log: the content of any request or reply, a password, a token, a cookie, or anything a provider answered.

Your Samsara password is never sent back to any device or page, yours included. This website sets one cookie to keep you signed in, and one for the few minutes a sign-in takes. It runs no scripts and loads nothing from any other site.

Who it is sent to

• Samsara: your username and password, to sign in as you; and each document you file, with its scans.
• TransFlo: your enrolment details when you link; and each paperwork batch you file, with its load number and your phone's model, system version and time zone offset.
• Apple or Google: what is needed to check your sign-in, and with Apple to cancel it when you delete the account.

Nobody else. Your loads, pay and scans go to no provider except as a filing you send. Nothing is sold, and nothing is used for advertising or analytics.

Unlinking a provider

On this website: Connections › Dispatch Updates › Unlink. The server deletes your Samsara username, password and sessions and its copy of your routes from dispatch, at once. Your loads stay in Franklin; they simply stop updating.

Connections › Document Sending › Unlink deletes your enrolment details and your TransFlo token, at once.

Your filing records stay until you delete the account. Neither provider offers a way to sign out from here, so a Samsara session ends on Samsara's own schedule, and your enrolment stays valid at TransFlo. Unlinking is refused for a moment while a filing of yours is being sent.

Deleting your account

In Franklin: Settings › Account › Delete Account. Or on this website: Account › Delete Account. The server deletes the account and everything listed above that belongs to it, in one step: your sign-ins, your devices, your loads, stops, pay records, settings and scans, both links, your routes from dispatch, your pages, your filing records and your history. It then asks Apple to cancel the token it held. An account that is still waiting for approval can be deleted the same way.

Your phone keeps its own copy of your loads, which then go nowhere. Deleting is refused for a moment while a filing of yours is being sent.

Deleting the app from your phone does neither: it does not sign you out and does not delete the account. The phone's keychain keeps the sign-in, and the server takes it until it has gone 400 days without use. Sign out, or delete the account, before you delete the app.

What deleting cannot reach at once: documents already filed with Samsara and TransFlo, your enrolment at TransFlo, and the backups below, which expire within 14 days on this server and within 30 days at the operator's home server.

The operator can also delete an account by hand. Ask at the address at the foot of this page.

Backups

The server copies its database, which holds your records, every day and keeps each copy for 14 days, on the same machine. Scans are files beside it and are not copied there: a scan is kept 15 days after it is replaced or removed, longer than any copy, so a copy put back finds its scans.

Once it is set up, the operator's own home server also takes, every night, the newest of those copies and the scan files, sealed as they are, and keeps each night's for 30 days. The key that opens them is not kept there.

Something you deleted is still inside those copies, sealed where it was sealed, until they expire.

If a copy is ever put back, the server first erases every stored password, session and token, its copies of your routes from dispatch and every page waiting to be filed, and signs every device out, so every driver signs in and links again. Your loads, stops, pay records, settings and scans in the copy are kept, and your phone sends back anything newer than the copy. An account deleted after the copy was taken comes back with it: you would have to delete it once more.

The operator

Franklin's server is run by its developer. New accounts are switched on by hand. The operator can approve an account, sign it out everywhere, unlink a provider, bring back a record deleted in the last 30 days, delete the account, and pause all filing.

If the key is ever thought to be exposed, the operator can order every stored Samsara password, session and TransFlo token deleted and every device signed out.

Contact

[Contact address: to be filled in by the operator before this page is published]