Privacy

Your data stays with you.

Kamdoo opens your company's ERP on your phone, and nothing more. It talks to it directly: Kamka IT, which publishes the app, has no access to any of your data. Only your notifications go through a server of ours, in an envelope we cannot open. Here is exactly how.

Last updated: 28 October 2026

0analytics, ads or crash reports

0passwords kept by the app

0notifications our relay can read

0accounts to create with Kamka IT

The notification relay

For a message from your ERP to reach your phone, it has to go through Apple or Google. Our relay makes the link. The message travels encrypted for your phone alone: a sealed envelope that neither the relay, nor Apple, nor Google can open.

01
Your phone

Creates a key pair for each company. The private key never leaves it; it gives the public key to your ERP.
The only one with the key
02
Your company's ERP

Encrypts the message for your phone, with its public key, then signs the request.
The message is its own
03
Our relay

Checks that the request really comes from your ERP, then passes the envelope on as it is.
A sealed envelope
04
Apple or Google

Deliver the envelope to your phone, as they do for every app.
A sealed envelope
05
Your phone

Opens the envelope with its private key and shows the message.
The only one to read it

Who sees what

The relay is hosted by Kamka IT on a server rented from OVHcloud in Gravelines (France), at push.kamdoo.app. Its code is public: kamka-ai/kamdoo-relais.

Who	Sees	Does not see	Keeps
Our relay	Your phone's notification identifier (for the time of one delivery), a 16-character label that tells the phone which key to use, the IP address of the sending server (and the phone's when it registers), the time and the size of the envelope.	The text of the message, its sender, the record it is about, your name.	Nothing: no database, no file (details just below).
Apple or Google	Your phone's identifier, the encrypted envelope, the label, the time. On iPhone, the only plain text is “Kamdoo” and “…”, replaced on the phone by the real message.	The text of the message, its sender, your ERP.	The envelope for at most one hour if your phone is off, then it is dropped. Under their own rules.
Your company's ERP	The message, since it is its own, your phone's public key and the delivery address given by the relay.	The phone's private key, nor its Apple or Google identifier: it is sealed inside the delivery address.	The delivery address and the public key, while the phone is registered. They are governed by your company.
Kamka IT	Apart from the relay, nothing: the app sends nothing else to Kamka IT, no statistics, no reports.	Your messages, your records, your login details, your ERP's address.	Nothing.

What the relay keeps, exactly

The relay has no database. It holds only what is strictly needed, in memory, and forgets it straight away.

No database
Nothing is written to disk: not your phone, not your messages, not your company.
At your ERP
Your phone's notification identifier is not stored by us: it is sealed (encrypted with a key only the relay knows) inside the delivery address. Your ERP keeps that address; the relay opens it for the time of one delivery, then forgets it.
10 minutes at most
A message too long to fit in a notification waits in memory for your phone to fetch it. It is handed over once, then erased; if nobody asks for it, it is erased after 10 minutes.
2 minutes at most
The IP address of whoever calls the relay is counted in memory to block abuse (too many requests per minute), then erased. It is never written down.
No logs
The relay only writes when it starts and, if Google refuses a delivery, the error code. Never an identifier, an address or any content. The server hosting it does not log the relay's requests.

For engineers: standards and details

The code is public, under the LGPL-3 licence: the relay at github.com/kamka-ai/kamdoo-relais, the kamdoo_connect Odoo module at github.com/kamka-ai/kamdoo-odoo. Anyone can check what this page says.
End-to-end encryption following the Web Push standard used by browsers: RFC 8030, RFC 8291 (ECDH key agreement on the P-256 curve, HKDF-SHA-256 derivation, AES-128-GCM encryption, aes128gcm encoding) and RFC 8292 (VAPID signature, ES256).
The phone's keys (P-256 private key and authentication secret) are stored in the iOS keychain, shared only with Kamdoo's notification extension, and in Android's encrypted storage.
Odoo 17 to 20 encrypts and signs on its own (native Web Push). On Odoo 14, 15 and 16, the free kamdoo_connect module, installed on the ERP, adds the same process.
The delivery address contains, sealed with AES-256-GCM under a key only the relay knows: the platform, the phone's Apple or Google identifier, a fingerprint of the ERP's signing key and the label. The relay refuses any request whose VAPID signature does not match that fingerprint: only the ERP your phone registered with can write to it.
The label is a fingerprint (SHA-256) of the ERP's address, the database and your user number: it contains none of the three.
Apple (APNs) receives a notification with neutral, mutable content: Kamdoo's extension decrypts it on the iPhone before it is shown. Google (FCM) receives a data-only message, decrypted by the app on the phone. Validity: one hour.
App uninstalled: Apple or Google report it, the relay answers 410 to the ERP, which forgets the device.

To stop notifications: Settings › Notifications in Kamdoo, or your phone's settings. Removing a company unregisters the phone from its ERP and erases its key. The morning reminder (your activities for the day) is prepared on the phone itself, without any server.

What Kamdoo keeps on your phone

the address of your company's ERP, the database name, your name and your login;
your company's name, logo and colour;
the session open with your ERP (like a browser), so you do not have to sign in again;
your settings (language, Face ID or fingerprint lock, shortcuts, tracked figures);
the records you opened last, and a copy of some screens (your day, your apps, your messages) to show them offline;
for widgets, Siri and Gemini: your active company, your activities for the day and your shortcuts, shared only between Kamdoo and its extensions on the phone.

This data stays on the phone. Removing a company (Settings › Remove this company from the phone) closes its session and erases what Kamdoo kept about it. Uninstalling the app erases everything. Kamdoo never keeps your password.

What is exchanged, and with whom

Kamdoo only exchanges data with your company's ERP, at the address you typed or scanned: what you view, create or change. This data is governed by your company and by its ERP's policy. The “Connect my phone” QR code contains a one-time token, valid for five minutes, never a password or a login.

The only exception: notifications, which go through our relay as described above.

Photos, receipts and documents

When you photograph or scan a receipt for an expense, the text (amount, date, merchant) is read on the phone (Apple's Vision, Google's ML Kit running on the device). The photo is attached to the expense in your company's ERP; nothing is sent to Kamka IT. Files shared to Kamdoo from another app are kept on the phone only until they are sent to your ERP, then erased.

Phone permissions

Camera: read your company's QR code, scan barcodes, receipts and documents, attach photos to your records.
Location (optional): attached to your check-in or check-out, if you accept. It is read only when you check in or out and is sent only to your company's ERP. You can turn it off in Settings › Notifications › Location when checking in.
Contacts: only to save a customer's or colleague's record to your phone, when you ask. Kamdoo does not read your contacts.
Face ID / fingerprint: lock access to Kamdoo, if you turn it on. The check happens on the phone; Kamdoo receives no biometric data.
Notifications: private messages and mentions, morning reminder, timer of a running task.
Local network: reach your company's ERP when it is installed on the company network.

Assistants (Siri, Apple Intelligence, Gemini)

If you use Kamdoo with your phone's assistant, your request is handled by that assistant under Apple's or Google's rules. Kamdoo answers from your ERP, and any change asked by voice waits for your confirmation.

Children

Kamdoo is a business tool; it is not intended for children.

This website

kamdoo.app sets no cookies, measures no audience and calls no outside service. It only remembers, in your browser, the light or dark mode you chose. If you filled in the “Notify me” form, removed since the App Store release, your email address is saved in Kamka IT's management software, only to write to you on the day Kamdoo is released. To have it erased: contact@kamka-it.com.

Deleting your data

Kamdoo, the app by Kamka IT, creates no account with us: there is no account to close. Here is how to erase what exists.

Everything Kamdoo keeps about a company: in Kamdoo, Settings › Remove this company from the phone. The app closes the session, asks the company's ERP to forget this phone for notifications, and erases the encryption key and everything it kept about that company. Uninstalling Kamdoo erases the rest.
Notifications only: in Kamdoo, Settings › Notifications › Messages and mentions, switched off. The phone is removed from the notifications of every ERP and its key is erased. Apple or Google invalidate the phone's notification identifier when the app is uninstalled.
Your data in your company's ERP (records, messages, attachments, attendance): it belongs to your company. Ask its administrator to access, correct or delete it.
The address you gave the former “Notify me” form on this website: write to contact@kamka-it.com, it is erased within 30 days.

What remains afterwards: nothing at Kamka IT. The notification relay keeps no identifier and no message (see above). What your company keeps in its ERP is governed by its own policy.

Your rights

Your company's data is managed by your company in its ERP: ask it to access, correct or delete it. Kamdoo creates no account: there is nothing to delete at Kamka IT. Kamdoo is published by Kamka IT; for any question: contact@kamka-it.com.

Changes

This policy may change with the app; the date at the top of the page shows the latest version.

A question?

Write to us: the team that makes Kamdoo answers you.

contact@kamka-it.com