Explained for a board, not for an engineer.
What travels in the QR, who can see what, what we keep and for how long, and what happens when something fails. Nobody on the market writes it down. We do.
22 characters. No name, no unit, no email.
A photo of your code is not your code.
What gets drawn is 22 characters for a visitor, 18 for a resident. Nothing a screen reader could turn into a name.
- Format prefix. Says whether it is a visitor pass or a resident's credential.
- Opaque identifier. A meaningless code that cannot be turned into a person or a unit without our database.
- Number of the minute. Eight digits your phone generates every 60 seconds, offline, from a key that never leaves it. A screenshot forwarded on WhatsApp dies in two minutes.
Nobody gets access to a unit without a responsible person approving it by name.
A condominium does not self-register: we set it up with its first administrator. A new resident requests to be linked with their real name, email and phone, and the administration approves or rejects. The decision is audited.
- Revoking cascades: when someone moves out, their active passes and credentials are cancelled in the same operation.
- Isolation per condominium in two layers: in the database and in the server. A failure in one does not open the other. Nobody sees another condominium's data, even by tampering with the request.
- Permissions per person: 16 switches, with rules that prevent anyone from granting themselves more permissions than they have.
- The Amber team's access is logged too. Every action of ours on your data is recorded with who, what and when, and the condominium can consult it.
| Data | Resident | Gatehouse | Admin |
|---|---|---|---|
| Entries to my unit | Yes | Today's | Yes |
| Account statement | Mine | No | Yes |
| Who booked the gazebo | Yes | No, only "taken" | Yes |
| Household members and minors | Mine | No | Yes, read only |
| Who opened an announcement | No | No | Yes |
| Another condominium's data | No | No | No |
Degrade, never hang. And say so in writing.
Every message in the app says what happened and what to do. A read failure is never disguised as a zero: saying "you have no packages" when they could not be read is lying.
Your phone has no internet
Your access code and your passes are generated anyway: the key lives on your phone. The app shows you the last thing it saw, marked as such, and never an invented zero.
You are out of the country
You generate the pass, send it on WhatsApp and get the notice that your visitor entered. There is no restriction by location, because the app does not know it.
The gatehouse loses signal
The scanner shows "Not verified" in amber, with the written code, and the guard decides. Whatever they record syncs when the network returns. A device that validates offline is coming soon, as an option.
Someone forwards a screenshot of a pass
The screenshot dies in two minutes, and the same code is not accepted twice. What is copyable is the pass link: that is why delivery passes are single-use and validity periods are short by default.
You lose your phone
You sign in from another device and revoke that credential in Settings › Security. It stops opening instantly. Important actions can require fingerprint or Face ID, if you turn it on.
The resident does not answer the intercom
The request goes to the gatehouse with a notice. It is never left hanging in silence.
The board or the administrator changes
The information stays with the condominium: entries, payments, expenses, minutes. A new administrator is appointed and the outgoing one loses access. Everything is exportable.
An update breaks something
Every failure reaches our team with the phone model and the exact point, without your password or the content of your screens, and we know how many people are affected before they call.
Encrypted in transit, photos without a public address, and a password we never see.
- Everything travels encrypted between your phone and our servers.
- Photos have no public link. They live in a private store and each time someone authorized views them, a temporary link is issued that expires in minutes.
- Your password is not stored: only an irreversible fingerprint of it.
- The key for your QR is stored encrypted with a key that is not in the database. A stolen copy of the database, by itself, cannot forge valid codes.
- Backups verified for real: restored and compared table by table, not just "scheduled".
- Your rights under Law 172-13 of the Dominican Republic: access, rectify, cancel and object. And delete your account from the app, without writing to us.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and photo storage |
| Render | Application server |
| Vercel | Website |
| Google Firebase | Push notifications and crash reports |
| Expo | App update distribution |
| Resend | System emails |
| Sentry | Technical error logging, without passwords or sessions |
Written in the privacy policy, not in a speech.
- 01
We do not use advertising.
No advertising component in the app.
- 02
We do not track you or sell your data.
Not across other apps, not across other sites, not to third parties for commercial purposes.
- 03
We do not collect your location.
The app does not request that permission. What it records is passage through an access point, reported by the gatehouse.
- 04
We do not access your contacts, messages, calls or files.
We only receive the photo you choose to attach.
- 05
No facial recognition and no recording.
If a condominium connects its cameras, it is a window to see who is outside before opening. Not surveillance.
- 06
We do not profile you or decide for you.
No automated decision about a person based on their movements.
Have a question that is not here? Ask it.
We answer in writing, so you can take it to the assembly.