Privacy policy

UG-Access · updated 8 October 2026

UG-Access is a phone app for a Radio-Sim / Sim-WiFi gate controller. The operator of the app and of the server at ug.sim-radio.com is Dmytro Oleksiienko, d.prog.comp@gmail.com.

TODO (operator). A postal address and the legal form of the business are not in the software. Add them here when you decide they should be published.

What is stored in the cloud

The server keeps a SQLite database on the VPS, normally /opt/ug-cloud/data/ug_cloud.db, and person photos as JPEG files under data/photos/ next to that database. The program does not sell data and does not send it to an advertising network.

Account: email, a display name if you typed one, and the password as a PBKDF2-HMAC-SHA256 hash. The password itself is not stored.
A signed-in session is an HMAC token kept on the phone. The server checks its expiry (14 days). It is not a separate database row.
Each controller: serial number, name, a device token, who the owner is, and the role of each invited account (owner, admin, operator, viewer).
People programmed on the controller: names, phone numbers, schedules, whether access is on, and an optional end date. The controller sends a copy of this state to the server. The access journal (who was allowed or refused, with name and phone when the controller has them) is stored in an append-only table. The code has no job that deletes old journal rows.
A SIM balance check runs a USSD query on the controller. The text the modem returns can be saved with that command on the server. The USSD code can be saved on the controller.
The controller’s last local network address and the public address it used to open its TCP connection to the server.
A device PIN, if you set one, as a salt and a SHA-256 hash, plus a failure count and a lock time. A separate setup PIN for first configuration can also be stored on the device row.
Photos you attach to a person: a JPEG on the phone and a copy on the server. The server stores the file and does not analyse the picture.

The home Wi-Fi password is sent to the controller and saved there and, so the setup form can be filled again, in the phone’s local storage. The cloud database does not store that password.

What stays on the phone

Bluetooth, to find the controller nearby and talk to it.
Local network, to reach the controller at 192.168.4.1 while it is in setup mode.
On Android, location (and nearby-Wi-Fi permission) so the system will show Wi-Fi names during setup. The iPhone app does not request location and does not read the phone’s current Wi-Fi name; you join the setup network yourself.
Camera and photo library, only when you take or choose a person’s photo.
The account email, session token, saved controllers, a BLE owner secret, a device PIN you entered, a copy of the journal, person photos, and the home Wi-Fi name and password from setup.

There is no advertising SDK and no analytics SDK. The app does not use data for tracking across other companies’ apps or websites.

Email

If mail is configured on the server, a password reset and a device-PIN reset send a 6-digit code to the account email. The code is stored only as a hash and expires after 15 minutes. Delivery uses the SMTP host named in the server environment (UG_CLOUD_SMTP_HOST). The source code does not name a mail company.

TODO (operator). If you want the mail company named in this policy, write it here. It is only in the server environment file, not in the program.

Who else sees it

People you invite to a controller see that controller according to their role. A backup file or a share from the phone goes where you send it, through the system share sheet. Nobody else receives a copy from the server except the SMTP delivery of a reset code to your own email.

The server log can include the controller’s TCP address. A fail2ban jail in the deploy files watches those logs and can block an address that opens too many TCP connections to port 8788 (ban of 300 seconds). The database does not store the phone’s IP address. The published Caddy config does not turn on its own access log.

How long it is kept

There is no automatic deletion of accounts or of the journal. A password-reset code and a claim code expire after 15 minutes. When the owner removes a controller in the app, the server asks the controller to reset itself. After the controller confirms, that controller’s database row is deleted, and the journal and command rows tied to it go with it. The photo files on disk are not deleted by that step.

Deleting your account

While you are signed in, open Settings, then Device (in the app: «Устройство»), and tap Delete account at the bottom of that screen, below Reset settings. In the app that button is labeled «Удалить аккаунт». The dialog says this account and this person’s access are deleted, and that controllers stay in the cloud and on the board. Enter the current password. The server then deletes the account, the password hash, this account’s memberships, claim codes this account created, and password-reset codes. The sign-in token stops working because the account row is gone.

If this account is the only owner of a controller, the cloud row stays: the serial, the people, the journal, the commands, and the photo files. The owner field is cleared so the controller is unclaimed, and the next Bluetooth claim reuses that same row. Other members keep their access. The server does not ask the controller to reset, and it does not change the people, journal, PIN, or Wi-Fi stored on the controller. If another owner remains, only this account’s access is removed. Removing a controller from the device list is a different action: that one does ask the controller to reset itself.

If you cannot sign in, email d.prog.comp@gmail.com from the address you registered.

TODO (operator). The software does not set how quickly that email is answered. Write that here when you decide.

Children

The app does not ask for a date of birth and has no children’s account. It is a companion for a physical gate controller and is not directed at children.

Contact

Dmytro Oleksiienko, d.prog.comp@gmail.com.