Shap privacy policy

Last updated 9 November 2026.

Shap is free software for quoting, invoicing, payroll and bookkeeping, made by OpenWorks IT (Pty) Ltd. It comes in two forms: Shap Pocket, an app for iPhone and Android (and an installable web app for computers) that keeps everything on the device, and Shap, which a business runs on its own server. This policy explains what information each one handles, where it is kept and who can see it.

The short version

• Your books, clients and documents stay on your phone or computer (Shap Pocket) or on your business’s own server (Shap).
• There are no user accounts with OpenWorks IT, no adverts, no advertising identifiers and no analytics or tracking.
• Only three things ever reach OpenWorks IT: feedback you send from the app; an anonymous note of what kind of business uses Shap, if you agree to it at setup; and anonymous prices for your trade’s standard items, unless you switch that off. None of them carries your name, your clients or your books.

Who is responsible

Your business is responsible for the information it keeps in Shap about its clients, workers and employees: under the Protection of Personal Information Act (POPIA) it is the responsible party for that information. OpenWorks IT does not receive it.

Where OpenWorks IT hosts a Shap server for a business, OpenWorks IT is an operator: it handles that business’s information only on the business’s behalf, to provide the service.

OpenWorks IT is the responsible party for the feedback, usage notes and price totals described below.

Shap Pocket

What stays on your phone

Everything you enter: your business details and logo, clients, quotes, invoices, costs, payroll and the rest of your books. It is kept in the app’s own storage, with a safety copy in the app’s private files so the books survive if the phone clears the app’s storage. Your phone’s own backup (Android backup or iCloud) may include that safety copy, under your Google or Apple account’s settings.

There is no Shap Pocket login. If you turn on the phone lock, the app asks for your phone’s own fingerprint, face or PIN. That check is done by the phone; Shap Pocket never sees your fingerprint, face or PIN, and nothing about it leaves the phone.

On a computer

The Shap Pocket web app (at openworks.co.za/shap/app) works the same way: everything you enter is kept in your browser’s storage on that computer, for that app only, and never sent to us. The app’s files are delivered by GitHub Pages (GitHub, Inc.) through our website; like any web host, those services log the internet (IP) address that asks for the files, under their own privacy policies, but never see your books. Clearing the browser’s site data for openworks.co.za deletes the books on that computer, so keep backups. Backups you save go only where you save them.

What leaves your phone because you send it

What goes to OpenWorks IT

1. The anonymous usage note. At setup, Shap asks whether it may tell us what kind of business uses it. If you say yes, the app sends a short note with:

• the app (Shap Pocket or Shap), its version and the platform (Android, iPhone or web);
• a random install number, made up on your phone, so that a change of settings replaces the earlier note instead of counting you twice;
• whether the business is a company or a sole proprietor, the kind of work you chose (such as “Electrician”), which parts of the app are switched on, whether you are VAT registered, and whether you chose the casual or formal tone.

It never includes your name, your business’s name, clients, amounts or anything else from your books. It is sent again when those answers change or the app is updated, and otherwise about once a month while you use the app, so we know how many people still use Shap and how many have taken each update. With it, our server keeps when it first heard from that install number and which version it was on before its latest update. You can switch it off any time in Settings.

2. Feedback you send. When you tap the feedback button and send a report, it includes:

• what you type, and the kind of report (a compliment, a gripe or a bug);
• the screen you were on, and a short trail of recent screens, taps and app errors (which buttons were tapped and which fields were changed, not what you typed into them);
• technical details: app version, device and browser type, screen size and whether you were online;
• for a bug report, a screenshot if you leave it attached. Names, amounts and other text you have entered are hidden in the screenshot unless you turn that off.

Our server uses the internet (IP) address the report came from only to limit abuse; it doesn’t keep it. If your phone is offline, the report waits on the phone and is sent next time you’re online (without the screenshot).

3. Anonymous prices (on unless you switch it off). Once a month, Shap looks at the previous month’s issued invoices, but only at lines that are one of the standard items Shap offers for your kind of work (such as “Tiling”, per m², for a builder, or “Install plug point”, per point, for an electrician). For each such item it sends one number: the average price you charged per unit, excluding VAT. With it go your kind of work, the month, the app and its version, and the random install number.

It never includes descriptions you typed yourself, clients, invoices, totals, how many jobs or lines there were, your name or your business’s name.

Our server checks every item against Shap’s standard list (anything else is refused), then adds each price into a national total for that kind of work, item and month, rounded into 5% price bands. Only those totals are kept. The install number isn’t stored: it becomes a coded number for each item, different for every item so they can’t be put together into one business’s prices, used only so a business is counted once a month and so totals are only ever used where enough different businesses have contributed.

Why: to build up, over time, a picture of what work typically costs in South Africa, which may be published as typical price ranges, so that clients and trades can both see what a fair price looks like. It never names or points to any business, and it is never used for advertising or marketing, or sold.

You’re told about it before anything is sent: during setup, or with a note on the Home screen if you set up Shap before this was added. Switch it off any time in Settings, and nothing more is sent. Prices already added into the totals can’t be taken out again, because nothing in the totals is linked to you.

All three go to OpenWorks IT’s server at shap.openworks.co.za over an encrypted (HTTPS) connection. Feedback and usage notes are read only by the OpenWorks IT team, to improve Shap. We don’t sell any of it, share it or use it for advertising.

Notices from OpenWorks. So that important news (such as a needed update, or support ending) reaches every copy, Shap Pocket downloads a small public file from Shap’s repository on GitHub when it’s online, at most twice a day, and Shap’s server does the same. Nothing about you or your books is sent: it’s an ordinary download, which GitHub (not OpenWorks) serves, as any website would.

The terms of use. Which version of the terms of use you accepted, and when, is kept in your own books (and their audit log), not sent to us.

Shap on your own server

When a business runs Shap on its own server, its information stays on that server, under that business’s control. Staff sign in with accounts that the business creates and manages.

By default, a Shap server passes on to OpenWorks IT:

• feedback its users send from the feedback button, with the user’s role (such as “owner” or “site”) but not their name, and the screenshot only if names and amounts were hidden in it;
• the anonymous usage note described above, only if the business owner agreed at setup;
• anonymous prices as described above, unless the owner switches them off in Settings.

The person who runs the server can turn this off completely by setting COLLECTOR_URL=off.

Keeping and deleting information

• Your books are kept until you delete them. In Shap Pocket, removing the app deletes them from the phone (copies in backups you made, and in your phone’s own backup, are yours to delete).
• Feedback reports are deleted from OpenWorks IT’s server 12 months after they are received.
• Usage notes are replaced by the next one (when your answers change, after an update, or monthly), and deleted after 12 months without one.
• Price totals are kept for as long as they help show what work costs. They hold nothing about any one business.

To have feedback or a usage note deleted sooner, email us. Tell us roughly when you sent it, as the reports don’t carry your name.

Children

Shap is a business tool and is not directed at children.

Your rights

Under POPIA you can ask what personal information we hold about you, and ask for it to be corrected or deleted. For information about you in a business’s Shap (for example as a client or employee), contact that business. For feedback, usage notes and anonymous prices, contact OpenWorks IT at info@openworks.co.za. You also have the right to complain to the Information Regulator.

Open source

Shap and Shap Pocket are free software under the GNU Affero General Public License v3, so anyone can check exactly what they do: Shap on GitHub and Shap Pocket on GitHub.

Changes

If this policy changes, the new version is published at this address with a new date.

Contact

OpenWorks IT (Pty) Ltd, Gqeberha · info@openworks.co.za