Facing: Privacy Policy · Qiksy

Last updated: 25 October 2026

Who we are

Facing (in the stores: Facing: Shelf Audit) is an app for merchandisers and their office: shelf photos, the brand’s share of the shelf, store visits, tasks and paid places. It is operated by Dmytro Liesniak, sole proprietor (ФОП), Ukraine, registered in the Ukrainian state register (ЄДР) as Liesniak Dmytro Volodymyrovych, D-U-N-S 66-768-5166, trading as Qiksy. Contact: [email protected], in any language the app speaks.

This policy covers the Facing app for Android and iPhone, its web version at qiksy.app/facing, and its server at facing-api.qiksy.app.

Your company decides, we do the work

You cannot sign up to Facing on your own as a merchandiser. A company (a supplier, a distributor or an agency) creates its account and adds its people. That company decides what it records about its staff: whether visit time is counted, how long photos are kept, which chains allow photos, who in the office sees what. In data protection terms the company is the controller and we are its processor. If you work for such a company, ask it first about your data; you can also write to us.

We do not use a company’s data for anything but running Facing for that company. We do not look into it unless the company asks us to help, or the law requires it. We sell nothing to anyone.

What the app asks your phone for

• Camera: to take photos of store shelves.
• Location, only while you use the app. The app does not ask for location in the background, and it does not track you when it is closed. Without location you mark the store with a button, and the visit counts all the same.

Signing in

• An invite link or a short code from your manager. The link works for 7 days and is used up once you sign in.
• A code by e-mail, sent through Cloudflare Email Service. It stops working after 10 minutes.
• A code by text message. No SMS provider is connected yet. When one is, this page will name it before it starts; it will receive your phone number and the code.
• A password, if you set one. We keep only a salted hash of it (PBKDF2), never the password.
• Google or Apple. We check the sign-in’s signature and take only the e-mail address they confirm (with Apple it can be a private relay address). We keep nothing else from them.

To find your company when you sign in, we keep your phone number and e-mail address in a shared directory as keyed one-way tags, not as themselves. Sign-in codes are kept only as hashes. To stop abuse we count sign-in attempts per day, per address and per network, also as one-way tags; the counters are cleared every day.

What the company’s account holds

Each company has its own database on our server. It holds:

• the team: each person’s name, role, phone number and e-mail address (as the manager entered them), which chains and stores they serve, whose work they lead, and their visit schedule;
• stores and goods: chains, store names, addresses and places on the map, categories, brands, products, shelf norms, prices, promotions, deliveries and paid places;
• visits: who visited which store, on which day, the time in and out, the location fix taken when the visit opened (with its accuracy), and how it opened (by the phone, by a tap with location, or by a tap without). It may carry notes such as «far from the store». If the admin switches on visit time, it also notes a late start, a short visit or a visit without a report;
• shelf readings: for each shelf photo, the numbers read from it (share of the shelf, packs, prices), who took it, when and in which store, and where it came from (the app’s camera or not, the phone’s and the server’s time, the model that read it, the app version);
• tasks and marks: what the office asked, what was done or could not be done and why, and the notes people typed;
• a change log of who changed what in the company’s setup.

These numbers are kept while the company’s account exists. People in the office see them within the rights the admin gave them, and can export them to a spreadsheet.

Location and the live map

Visits. When you walk into a store on your list, the phone opens the visit, and closes it when you leave. The fix taken at the visit’s start is kept with the visit, as described above. Two visits that agree also set a store’s place on the map, if it had none.

The live map. While your working day is open and the app is in front, the phone sends your current place to the office: at the start and end of a visit, and about every five minutes in between. Our server keeps only your last place, one row per person, replaced by the next one. It is never a track. The office’s map shows only today’s place. The line «route» on the map is the list of stores you visited today, not the path you walked.

• Outside the company’s shift (widened by two hours on each side), no place is kept unless a visit is open.
• When you end your working day, the phone says so at once and the server stops keeping your place.
• If you deny location or choose to mark stores yourself, the map shows that in words, not an old dot.

The map is drawn from OpenFreeMap tiles (tiles.openfreemap.org). Your phone loads them directly, so OpenFreeMap sees your internet address and which part of the map is on screen, and nothing about you or the company. When the office searches for a store’s address, our server asks OpenStreetMap’s Nominatim with the address text only.

Shelf photos and how long they are kept

The photos you take are sent to our server, read, and then kept for the company only for a short time: 7 days by default. The admin can choose 0, 7, 14 or 30 days; with 0 a photo is used only to be read and is not kept at all. After that the photo is deleted and only its numbers stay. In a chain that does not allow photos to be kept, no photo is kept; in a chain that bans photos, you count by hand and no photo is taken.

So that an old picture cannot be sent again as a new one, we keep a fingerprint of each photo for 60 days: the SHA-256 hash of the file, a short hash of its picture and a tiny grey thumbnail (48 by 36 dots). Where photos are not kept, the thumbnail is not kept either.

The company may also keep pictures of its own packs and products, which it uploads itself. They are kept until the company removes them.

Reading a shelf with AI

Each shelf photo is sent from our server to Google’s Gemini API, together with the company’s brand names and pictures of its packs. Gemini returns what it sees: packs of each brand, price tags, the names on the packs. The photo carries no name, phone or e-mail, but it may show whatever was in front of the camera. If the main model is busy, the same request may go to a second Gemini model at Google. We use Gemini as a paid service, under Google’s terms for which the content is not used to improve Google’s products; Google may keep it for a limited time to detect abuse.

Our code can also ask a backup model at OpenAI when Google keeps failing. That backup is not switched on. If we switch it on, this page will say so first.

A store that sends a photo by link

The office can send a store a link to photograph its own shelf. The store needs no account and no app. What it sends is the shelf photo and, if the phone allows it, its location; it is read and kept like any other shelf photo. The link works once.

The pilot request on our website

If you ask for a pilot on qiksy.app/get-facing, we keep what you typed (company, name, e-mail, and the phone, country, team size and wishes if you gave them) and e-mail it to our own inbox, so that we can answer you. We use it for nothing else.

What stays on your phone

• Your sign-in, in the app’s own storage, until you sign out.
• Work made without signal: visits and photos wait on the phone and leave by themselves when the network is back. Each one is sent only with the sign-in of the person who made it.

Analytics and advertising

Facing contains no analytics, no advertising and no tracking, and no chat widget. We build no profile of you.

Who processes data for us

• Cloudflare runs our server (Cloudflare Workers) and stores each company’s data in Cloudflare Durable Objects. It also sends our e-mails (Cloudflare Email Service). Resend is a backup sender, used only if Cloudflare refuses a letter and only once we connect it.
• Google reads shelf photos (Gemini API) and handles Sign in with Google.
• Apple handles Sign in with Apple.
• OpenStreetMap’s Nominatim finds store addresses, and OpenFreeMap serves the map, as described above.

Cloudflare runs our server in its global network, so data may be processed outside Ukraine and the European Union. These providers process data only to provide these services.

Deleting your account

In the app: the Me tab, then Delete account. In the office, the same button is in the side menu. Your sign-in, phone number and e-mail address are deleted at once, every session of yours stops working, your invite links stop working, and your last place on the live map is erased. Your name and the visits and photos you made stay in the company’s reports, because they are the company’s work records; photos are still deleted after the company’s keeping days.

If you are the company’s only admin, the app warns you first. If you confirm, the whole company is deleted: its people, stores, visits, photos, reports and everyone’s sign-in. Nobody, us included, can restore it.

You can also write to [email protected] from the address you sign in with, and we delete the account within 30 days, or ask your company’s admin.

Children

Facing is a work tool for companies and is not meant for children.

Changes to this policy

A change moves the date at the top. If the app ever starts sending something new, this page says so before the update ships.