Data Protection and the new Tapestry Journal iOS app

[Tom]

Data Protection and the next generation Tapestry Journal iOS app

The next generation Tapestry Journal iOS app, which is now available in beta, has different implications for data protection from the old iOS app. This note explains those differences.

They relate to:

1. Caching of data on the device
2. Push notifications
3. Adding observations when offline

Local copies of data

Copies of pictures or videos taken within the app

This is unchanged.

As with the ‘classic’ Tapestry app, if a relative takes a picture or video using the app, a copy of that picture or video is also stored in their device’s gallery. For staff, whether this is done depends on the setting in the Tapestry control panel.

Login details

The default is unchanged.

As with the ‘classic’ Tapestry app, once you’ve logged in once, the app stores a special ‘key’ that allows you to login using just a PIN for up to ten days.

Optionally, in the next generation Tapestry app, if the device has TouchID or FaceID, then you can store the email, password and PIN you use to log into Tapestry which will allow you to log in using TouchID or FaceID. The password and PIN are encrypted and stored securely, but it means that anyone with a TouchID fingerprint or FaceID face registered on the device will be able to log into your Tapestry account. You should therefore take care to only enable this on devices which are used by a single person.

Temporary copies of downloaded data

This has changed.

The ‘classic’ Tapestry app would always download fresh copies of all the data it needed, every time it needed it. It would only store small amounts of that data locally.

This meant that the classic app required a very strong internet connection at all times, which was difficult for many of our customers.

The next generation app is designed to work with much less reliable internet connections. To do that, it stores copies of data it has already downloaded locally, and only checks it against the server intermittently.

The data is encrypted and, unless your device has been ‘jailbroken’, inaccessible outside of the app. Therefore if the device is stolen, the data remains safe and should be inaccessible.

The app deletes any downloaded data that hasn’t been used in 4 days (for staff) or 10 days (for relatives), in which case it will re-download it from the server. If you would like the app to store less (or more) data than that, then please contact us and we will change the setting for your school.

It also means that changes to data on the server may not appear immediately in the app, though it will check for changes each time a user logs in, so long as it can get an internet connection, or if you choose to manually trigger a refresh.

Temporary copies of uploading data

This has changed slightly.

The ‘classic’ Tapestry app would store copies of data relating to a new observation while you were creating the observation and while it was uploading. Once the upload was complete the data was deleted.

The next generation Tapestry app does the same.

However, the next generation Tapestry app has two new features which may, in certain circumstances, increase the number of new observations that are temporarily held, or hold them for longer:

1. Users can save draft / unfinished observations for up to 10 days (staff) or 30 days (relatives).
2. Users can queue up uploads — they don’t have to wait for an observation to finish uploading before they can leave the app or do other things in the app). This queue is under control of iOS and so, if the device’s battery is low or the internet connection is weak, iOS may decide to delay the upload until the device is put on charge or the network connection gets better. If an upload does not complete within 10 days (staff) or 30 days (relatives) it will be deleted.

Push Notifications

This is optional and did not exist in the 'classic' iOS app.

You can enable ‘push’ notifications for your setting using the Tapestry Control Panel. Once you do, the end user will also need to enable push notifications in the ‘You’ section of the Tapestry app on their specific device before they will start working.

If they are enabled, then the notification message will need to go via Apple’s servers, which may be outside of the EU. The message may also, depending on how the user has set up their device, appear on the lock screen of their device for anyone to see.

Because of this, the default is for the push notifications to say that 'Tapestry has 1 notification' without describing what the notification is. To include a description of what the notification is about, the setting will need to go to the Tapestry Control Panel and change the option for ‘Include names in push notifications’ AND the end user will need to enable it when they enable notifications on their iPhone or iPad in the 'You' section of the Tapestry app.

Adding observations when offline

This is optional and did not exist in the 'classic' iOS app.

You can enable ‘Logging into the Tapestry app with no internet connection’ for your setting. Once you do, the end user will also need to enable offline logins in the ‘You’ section of the Tapestry app on their specific device before the feature will start working.

This allows new observations to be added without an internet connection, and then the observations uploaded once the device is back online. It can also make the app feel faster, particularly at login, if the internet connection is slow or intermittent. Once the user has logged in, they will be able to see their data that has been stored locally on the device while the device is offline. When the device goes online it will check that the user is still allowed to login and that their login details are correct. If they are not, they will be logged out.

If you enable this, then it has two implications:

1. Even after you make a user inactive, they will still be able to log into the app and view whatever observations are stored locally on the device until the device next goes online with the app open. They will not be able to get new observations, or upload anything.
2. An attacker with access to the device will have a few more opportunities to guess a user’s PIN before being locked out. This is a particular issue if your PIN codes are easy to guess or shared.