Qardbox for public bodies and enterprise
Anyone who has to approve software for staff asks two things first: where does the data go, and who has seen the code. This page answers both, with statements that can be checked against the build that ships.
What an audit will find
The points below are not statements of intent but properties of the build that is in the App Store. Each can be shown in the source or in the binary.
- Not a single third-party packageThe project file contains no external package dependency. Every component linked in is an Apple framework. There is therefore no third party whose code runs along and whose behaviour could change with an update.
- No analytics and no ad networkNo measurement library, no third-party crash service, no advertising identifier. The app's privacy manifest lists no collected data type, and tracking is explicitly declared as absent.
- Network traffic to Apple onlyThe app talks to no vendor server, because there is none. The only network path is iCloud sync over CloudKit, and that is off by default.
- No accountsThere is no sign-in, no user management and no identifier that recognises anybody. A device is ready to use the moment it is installed.
- Data stays with the userCards and progress live on the device. Anyone who switches sync on puts them in the private iCloud database of their own account, not in somebody else's.
- Fully usable offlineWithout a network nothing about the work changes, because nothing is fetched. For isolated networks and for use in the field this is the decisive point.
Access to the complete source code
We are glad to work closely with public bodies. Where an approval requires it, we make the complete source code of the app available for analysis, in some circumstances free of charge. That covers the app code, the watch app, the widgets and the shared parts, so everything that goes into the shipped product.
This is expressly not a publication: there is no public repository and no free licence. It is provision to a reviewing body, under the arrangements such a review requires.
In practice the effort is modest, because there is nothing external to trace: no third-party packages, no servers, no interfaces other than Apple's.
Distribution through MDM
Qardbox is a free App Store app. It can therefore be acquired in volume through Apple Business Manager or Apple School Manager and assigned through your existing device management, like any other store app.
Because there is no sign-in, the part that usually causes most of the work with learning software falls away: no user account per member of staff, no licence list, no mapping of people to logins.
What it is good for in service
Flashcards are the plainest method for keeping knowledge available that has to be there without looking it up. Typical material:
- Powers of intervention, legal deadlines and thresholds
- Standing orders and service regulations
- Technical terms, abbreviations and markings
- Hazardous goods, symbols and map signs
- Language building blocks for deployments abroad
- Initial and continuing training, preparation for promotion examinations
The card stock is usually written in the unit itself: imported as a file or created in the app. Ready-made sets are included, among them constitutional law in twelve languages.
Documents for approval
For the review there is a record of processing activities under Article 30 GDPR and a description of the technical and organisational measures. Both are working documents of the provider and not certificates; they describe the current state and are discussed on request.
The complete privacy policy of the app is available in twelve languages at Privacy policy, the explanatory version with diagrams at Privacy. Which seven accessibility features the app supports is set out at Accessibility.
Contact
For questions of approval, for source code access and for everything a procurement office needs to know: governance@qardbox.com.
Enquiries from administration, armed forces, security authorities and their supply industry are expressly welcome, including the awkward ones.