About
Tolar is an Android app for loyalty cards and a shared shopping list. It is built the way it is because a wallet full of shop cards is a fairly complete record of where you go and when — and that record should not need to be handed to anybody, us included.
Who makes it
Tolar is written and published by an independent developer, reachable at the
address below and as vStaric on GitHub. There is no company behind
it, no investor, and no advertising business that would rather the data flowed
the other way. The shop coverage is aimed at Slovenia first, because that is
where the cards in the author's own wallet come from.
Contact
vidstaric@gmail.com — for privacy questions, bug reports, a shop whose card the app does not recognise, or a data request under the privacy policy.
The recovery phrase
This is the single thing worth understanding before anything goes wrong, so it is here rather than buried in the policy.
Tolar has no accounts. There is no email address to reset, no password, and no support desk that can look you up — because a support desk that could look you up would be a support desk that could read your cards. Instead, the first time you switch sync on, the app generates a key on the phone and shows you twelve words. Those words are the key. Everything else — your identity on the sync server, the encryption that makes your data unreadable to it, your connections with other people — is derived from them.
What that means in practice
- Write them down, off the phone. On paper is fine. The point is that they survive the device.
- A new phone needs only the phrase. Type the twelve words in and the new device becomes the same identity, with the same cards and the same connections.
- Anyone holding the phrase holds the data. Treat it the way you would treat the cards themselves, not the way you would treat a username.
- Lose the phrase and every device, and the data is gone. Not “gone pending a support ticket” — gone. We hold ciphertext and no key, so there is nothing on our side to recover it from.
The honest trade: no account to be breached, and no account to fall back on.
This only applies once you turn sync on. With sync off, nothing has left the phone in the first place, and the cards are simply on the device like any other app's data.
How the sync works, briefly
Cards and list items are encrypted on your device before they are sent. The server stores the ciphertext plus the public keys and identifiers needed to route it to the right devices, and it is our own server rather than a third-party cloud. When you share with someone, the data is encrypted to their key, so the server is no more able to read a shared card than one of your own. Each connection carries a safety number that both phones display, so two people who are in the same room can check they are connected to each other and not to somebody in the middle.
Push notifications are how a device learns something changed. That part uses Google's messaging service, and so it is switched on only when you switch sync on. What the notification carries — which list moved, and who moved it — is sealed with the same end-to-end encryption as everything else, so what Google forwards is a string it cannot read. Section 4 of the privacy policy spells out what turning sync on registers with Google, and what turning it off deletes.
The source
The app's source is not public today. If it is opened, it will be at
github.com/vStaric/loyaltyCard, and this page will say so rather
than making you go and check. Two things are true of the build regardless of
whether you can read it: no third-party brand artwork is bundled with the app
(shop marks are our own lettering in our own palette), and the fonts are
vendored from Google Fonts under the SIL Open Font Licence.
This page
Static HTML, one stylesheet, six font files, all served from this domain. No analytics, no tag manager, no cookies, no CDN, no JavaScript. An app that claims the server cannot read your data should not have a website that phones a third party to tell them you read the claim.