GemClockPrivacy policy
Last updated 12 November 2026
GemClock ("we", "us") provides the GemClock mobile app and the website gemclock.lk. This policy explains what personal data we collect, why, and the choices you have. It is written to meet the Personal Data Protection Act, No. 9 of 2022, of Sri Lanka.
What we collect
| Data | Why we need it |
|---|---|
| Your phone number, first and last name | To create your account and sign you in with a one-time SMS code. |
| Names and phone numbers of people you trade with, which you enter | To record your deals and to send payment reminders to them on your behalf. |
| Deal details: gem descriptions, amounts, due dates, payments, cheque numbers and banks | This is the credit book itself. |
| Photos of gems and cheques you add | Shown on your deals and, for gem photos, in reminders. |
| Device notification token (when notifications are on) | To send you reminders and alerts on your phone. |
| Basic technical logs (IP address, time, errors) | To keep the service secure and fix problems. Kept for a short time. |
We do not use your data for advertising, we do not sell it, and we do not track you across other apps or websites. The app's PIN and fingerprint/Face ID lock work only on your phone; we never receive them.
People you trade with
When you add someone to a deal, you confirm that you have a business relationship with them and that they expect to hear from you about it. Reminders to them contain only the payment facts (who, how much, which stone, when). Anyone can reply STOP to stop reminders, and can ask us to delete their details by contacting us (see below).
Who processes your data for us
- Hostinger – hosts our servers and database.
- Cloudflare (R2) – stores photos. Photos are private and shown only through short-lived links.
- Text.lk – sends sign-in codes and SMS messages in Sri Lanka.
- Meta (WhatsApp) – sends reminder messages, when WhatsApp reminders are enabled.
- Google (Firebase) – delivers push notifications, when enabled.
- PayHere – processes subscription payments on gemclock.lk. We never see or store your full card number.
Some of these providers store data outside Sri Lanka. We use them only for the purposes above, over encrypted connections.
How long we keep it
We keep your account and deals for as long as your account exists. When you delete your account, we delete your account, deals, people, payments, reminders and photos straight away. Records of subscription payments are kept as long as the law requires for accounting. If another trader accepted a shared deal from you, their own copy stays in their account.
Your rights
You can see and correct your data in the app at any time. You can delete your account in the app (Settings → Delete account) or as described on our account deletion page. You can also ask us for a copy of your data, or object to how we use it, by contacting us.
Security
All connections use HTTPS. Sign-in uses one-time codes and short-lived tokens; stored refresh tokens are hashed. Photos are kept in a private store.
Children
GemClock is a business tool for adults and is not meant for anyone under 18.
Changes
If we change this policy, we will update the date above and, for important changes, tell you in the app.
Contact
Email support@gemclock.lk for any privacy question or request.