Privacy Policy for ShamGPS

This policy describes the ShamGPS application on Android and the ShamGPS application on iOS. One policy covers both. ShamGPS is separate from GPSDome and GPSDome Fleets. Useful Systems IT (US IT) is the data controller responsible for personal information processed through ShamGPS.

Effective date: 4 November 2026 · Privacy contact: info@usit.sy

USIT creates and administers the customer accounts and issues the username and password. A customer does not register or create an account in the application. ShamGPS on Android and ShamGPS on iOS sign in to gpsgate.sy. USIT administers ShamGPS accounts on that server, separately from GPSDome accounts.

1. Information collected

1.1 Sign-in details

The username or email entered on the sign-in screen, and the password, are sent to gpsgate.sy. After sign-in, the application stores a session value on the phone. If the user chooses to be remembered, that session value remains on the phone. The password is not stored in that local record.

1.2 Vehicle information

The application receives the signed-in account's vehicle and fleet records from gpsgate.sy, including vehicle identity, status, position, history, events, and geofences returned for that account.

1.3 Phone location

When the user taps My Location, the application reads the phone's position while the application is in use and shows it on the map. The phone position is not sent to gpsgate.sy.

1.4 Push token

If the user allows notifications, the application uses Firebase Cloud Messaging to obtain a push token and sends that token to gpsgate.sy for the signed-in account.

1.5 Information kept on the phone

The application stores the session value, the notification token, and the user's language, appearance, and map settings on the device.

2. Location and GPS tracking

Vehicle positions, history, and events shown in ShamGPS come from gpsgate.sy.

The phone's own location is read when the user taps My Location. The read is used to show that position on the map while the application is in use. Android requests approximate and precise location for that use. iOS requests location in order to show My Location. The iOS background modes included in the application are background fetch and remote notifications. The phone position is not sent to gpsgate.sy.

3. Maps and address lookup

The user can view the fleet on Google Maps or on OpenStreetMap. When OpenStreetMap is selected, the application requests map tiles from the OpenStreetMap tile service. To show an address for a vehicle, the application sends that vehicle's latitude and longitude to nominatim.openstreetmap.org. The user may open a vehicle coordinate in Google Maps. The user may also share a vehicle name and a Google Maps link through the phone's share sheet. The user chooses the destination of that share.

4. Firebase Cloud Messaging and push notifications

If the user allows notifications, ShamGPS uses Firebase Cloud Messaging to obtain a push token. The application sends that token to gpsgate.sy for the signed-in account. Android also requests permission to show notifications. Signing out deletes the push token stored on that phone. The application does not send a removal request for a token stored on the server.

The reviewed application dependencies do not include an advertising SDK, a crash-reporting SDK, or an analytics SDK. In the iOS Firebase configuration file, the advertising and analytics flags are turned off.

5. Third-party services and data processing

gpsgate.sy receives the sign-in details, fleet requests, and push token. It is the tracking service this application is built to use.

When the related feature is used, the application also contacts:

• Firebase Cloud Messaging, to obtain the push token.
• Google Maps, when that map is selected, when a vehicle coordinate is opened in Google Maps, and for the map link offered through the share sheet.
• OpenStreetMap tile servers, when that map is selected.
• nominatim.openstreetmap.org, to turn a vehicle coordinate into an address.
• Google Play on Android, to check for an application update.

A share-sheet destination receives a vehicle name and map link only when the user chooses that destination.

6. Data retention and security

While the user remains signed in, the application keeps the session value, notification token, and selected settings on the phone. Signing out removes the session value and the push token stored on that phone. Removing the application from the phone removes the information stored by the application on that phone.

The application connects to gpsgate.sy over HTTPS.

7. Account deletion and data removal requests

ShamGPS does not contain an account-deletion control.

A customer, or a person authorized to act for the customer, may email info@usit.sy to ask USIT to review an account. The message should include:

• ShamGPS
• the username
• whether the request concerns one login or the company account
• the name of the requester and the company represented

USIT receives the request, verifies the requester's identity and authority, and reviews the request. A request about one login and a request about a company account are reviewed separately. USIT confirms the outcome of that review to the requester.

Signing out ends the session on that phone and deletes the push token stored on that phone. The account remains on gpsgate.sy. Removing the application from the phone also leaves the account on that server. The application displays vehicle records and GPS history from that server and does not delete them.

8. Contact

Sham GPS (USIT)
info@usit.sy