Your client book — the people you serve, their phone numbers, your notes, your history and prices with them — lives only on your phone, in an encrypted database. It is not sent to us, and we cannot read it. If your phone is pulled apart, the file is unreadable without your device's key. When you send a message or a payment request, MyOcto prepares the text and hands it to your own WhatsApp, SMS, email or payment app — we are never in the middle of it, and none of it reaches us.
Everything below is about the far smaller set of things the server does hold, which exists only so you can have an account, publish a public page if you choose, and (later) pay for a subscription.
MyOcto is operated by TechNexus LLC, with offices in Bucharest, Romania and Las Vegas, Nevada, USA. For anything about your data — a question, a request, or a complaint — contact us at privacy@technexusllc.com. TechNexus LLC decides what personal data the MyOcto service holds and why, which under EU law makes it the "controller" of that data.
The sign-up form on our website works in one of two ways. Normally it sends what you typed (your name, email address, phone number, what you do and your city) to our server, which passes it on as one email to our own mailbox and keeps no copy of what you typed: it is not written to a database or a file, and it does not appear in our application's log. If the form cannot be completed that way, the page instead prepares the same message in your own mail app; nothing reaches us unless you send it, and it then travels through your own email service. The first way passes through our email sender. An email that arrives in our mailbox by either way is kept as described under "Email you sent us" below. We do not send you an automatic reply.
To limit misuse, the part of our server that receives the form remembers, for about a day and in memory only, the network address a form came from and how many it sent. Separately, like any request to our servers, sending the form leaves a line in the request logs described under "Ordinary technical records" below (network address, time and the address requested); the form never puts your details in that address.
We hold these to provide the account you asked for (the lawful basis is performance of a contract with you). We keep them until you delete your account.
Publishing a storefront is optional and something you do deliberately. When you publish, the page you build — your name, the services you offer, your area, your prices, your own payment handles, and any photos you add — is stored on our server and served publicly at your chosen address, so anyone with the link can see it. That is the point of a public page. The lawful basis is your decision to publish (a mix of your consent and the contract to host the page). Unpublishing stops us serving the page to new visitors at once; a copy already held in a browser or network cache can linger briefly (about a minute for the page, up to a day for photos). The stored copy stays on our server until you delete your account, which removes it from our live systems — backups age out about two weeks later (see Delete my data).
MyOcto lets you connect with other providers and, when you choose to go online, share your live location with a group. Your client book, your notes, and your messages stay on your phone — not with us. To make a group work, our server does hold a small set of technical records tied to public keys: a key mailbox carrying the group's encryption key sealed to your device — that key is ciphertext we cannot read — alongside the readable technical parts a group needs (public keys, a membership credential with its validity dates, a per-group counter, and signatures), a revocation list so a removed member can be cut off, and the group owner's "Members see each other" setting (an on/off value, a counter and the owner's signature). These records reveal that certain public keys belong to a group; they do not contain your clients, your notes, or your messages. Your live location is never stored: while you are online, each encrypted position is passed to the members allowed to receive it (see "Who sees you in a group") and immediately forgotten — it is never written to our database. The lawful basis is the contract to run this feature and our legitimate interest in a secure group. Leaving a group removes it from your phone; the server records are cleared when you delete your account, except a few circle-wide technical markers listed under "Deleting everything".
The person who created a group (its owner) decides whether its members see each other. With Members see each other off — the default — a member's position goes only to the owner, and members see only the owner (the owner's own position goes to every member). With it on, members can also see each other — but only those who agreed to show their name to the group (below), or whose contact card they already hold. Only the owner can change the setting: that takes the group's owner key, which is kept on the owner's phone (and on any phone the owner restores it to). Our server passes positions on according to this setting; it still cannot read them. Some limits we cannot remove: anything someone already saw before the setting was turned off cannot be taken back; if someone took control of our running server, they could pass positions to the wrong member of the group, who could open them; and if we ever restore our database from a backup, the setting may go back to an earlier choice of the owner — we then ask owners to check it.
A member your position reaches (see above) shows you on their map only if their phone can tell who you are: either they hold your contact card from connecting with you directly, or you chose to show your name to the group. The second is up to you. If you turn on Show my name to my groups, the name and services from your profile travel alongside your position — encrypted, to members of that group only, and never stored by us — so that people in the same group can recognise each other without having connected directly. It is off until you say yes: you are asked once, the first time you go online in a group, and you can turn it off again at any time under Me → Settings & privacy. MyOcto never sends your phone number or your email address — there is no field for them in what goes out, and we refuse a name or a service that reads like a number, an address or a link. What we cannot do is stop someone writing one out in words inside their own name, so what you see of another member is whatever they typed in their own profile. To actually exchange contact details you still have to connect directly. It travels only while you are online on the map, and stops when you go offline or turn it off.
If you turn on wake-ups — so a colleague's question can reach you while the app is closed — we store one entry for each of your groups: your phone's push token, your membership details for that group (public keys and your proof of membership), whether you own the group, and a random reference. We do not store whether you are free, and we do not store where you are. When a colleague asks, we pass Google the token, that reference and one fixed sentence; the notification never contains a name, a client or a place. You can turn wake-ups off in the app at any time, for every group at once. Turning them off takes effect when your phone has told our server; if it cannot reach us at that moment the app says so and keeps trying, and until then — or for a notification already on its way — one may still arrive. We also delete the entry when you are removed from a group, and in a nightly clean-up once it has gone 60 days without the app renewing it.
Each time we send a wake-up, our server log gets one line: whether it worked, a shortened one-way hash of the push token, and the first characters of the random reference — no name, no position, no group. These log lines are not part of the entry above and are not removed with it; the log is capped by size and overwrites its oldest lines.
When you type an address into the map's search, that text is sent to our own address look-up server so it can place a pin. When the map is open, your phone asks our own map server for the pictures of the area you are looking at. Both run on our infrastructure in Germany, not at a third party, and both are set up to keep no log of what you search for or which area you view. An address you search for is not saved to your account, and it is not attached to a client on our side — we hold no clients.
Photos you add to your public page are public. Before we store one, your phone strips the hidden location and camera data out of it, so publishing a photo does not reveal where it was taken. But we cannot know who or what is in a picture. Please do not publish a photo of a client's face, home, vehicle or documents without their permission. Photos should be of your own work and yourself. You can take any photo — or the whole page — down at any time (see "Deleting"). If someone believes a page or photo is theirs or should not be public, they can report it from the page, and we can take it down.
Like every website, our servers keep request logs — including the IP address of visitors to a public page and of the app talking to the server — to keep the service up, stop abuse, and enforce rate limits. An IP address can be personal data, so we name it here. The lawful basis is our legitimate interest in a secure, working service. These logs are limited by size, not by age: when a log file is full it is set aside, and only a few such files are kept, the oldest being deleted.
Abuse reports about a public page record the category and the page, and no identity of the reporter.
MyOcto does not yet charge for anything. When subscriptions launch, payment will be handled by Stripe — your card details go to Stripe, not to us. We will store only opaque Stripe identifiers and the status of your subscription, which we are also required to keep for tax and accounting records. This section will be updated before any charge is ever made.
The server runs on infrastructure in Germany (the EU). TechNexus LLC is a US company, so US staff may access the service to operate it. We do not sell your data, and we do not share it with anyone except the service providers we need to run MyOcto (our hosting provider; our email sender, for sign-in codes, for a once-a-day internal report to our operator that holds only counts — how many accounts, how many plans end soon — and names no account, and for passing on what you typed into the website's sign-up form; an error-tracking service, Sentry, on EU (German) infrastructure, which receives only scrubbed diagnostic reports — no IP address and no personal data; and — later — Stripe), each only to the extent needed. Because a US company is involved, some access may amount to an international transfer; we will put the appropriate safeguards in place, and a data-protection lawyer is reviewing this arrangement.
Three outside services get data straight from your phone, not through us. The app's notifications use Google's Firebase Cloud Messaging: to deliver them, Google receives an ID for this installation of the app and a push address (a "token") for it. The app's QR-code scanner uses Google ML Kit. It sends Google technical data: your phone's make, model and system version; the app's name and version; an ID for this installation of the app (Google says it is not meant to identify you or your phone); scanner settings such as image size; and how the scanner ran, such as its speed, events and error codes. Google uses it for diagnostics and usage analytics. If you add your own flight-status key, the flight number and date you look up go to AeroDataBox (through RapidAPI), under your own account with them.
If you are in the EU/EEA or the UK, you have the right to: get a copy of the data we hold about you; correct it; delete it; restrict or object to how we use it; take it elsewhere in a portable form; and withdraw any consent you gave. To use any of these, contact privacy@technexusllc.com. You also have the right to complain to your data-protection authority — in Romania that is the ANSPDCP (dataprotection.ro); in other EU countries, your national authority.
In the app, Me → Account & help → Delete my account removes your account and the data tied to it: your licence, your published page and its photos, your address reservation, and any reports about your page. A few technical markers necessarily remain — they are listed just below. Your client book was never on our server — it is on your phone, and uninstalling the app or using your device's own delete removes that. You can also ask us to delete your data by emailing privacy@technexusllc.com, and there is a web deletion page at /delete.
A few things necessarily outlast a deletion. None of them is your client book, your messages or your private notes — those were never on our server. Here is the full list of what can remain:
None of what remains is your client book, and none of it is used to build a profile of you.
MyOcto is a tool for people running a business and is not intended for anyone under 16.
If we change how we handle data, we will update this page and its date. For a change that materially affects you, we will make a reasonable effort to tell you in the app.
TechNexus LLC, with offices in Bucharest, Romania and Las Vegas, Nevada, USA. Email privacy@technexusllc.com. An EU representative will be named here if one is required.
Last updated: 13 October 2026. This is a plain-language summary of how MyOcto handles data; it is not legal advice.