# Mobile apps and product identity

Use this guide for WS-owned products such as Talkyto and CHRIS, and for correctly attributing client applications. The [HTML examples](../examples/mobile.html) are placement concepts, not screenshots of the current native apps. They use kit colors for illustration; retain each product's own approved identity in production.

## Where each detail belongs

| Surface | Content | Placement recommendation |
| --- | --- | --- |
| App icon / launch screen | Product name and product icon | Keep the product primary. A small agency sign is optional. Never delay launch to show a credit. |
| Settings | About, Help, Privacy, Terms; account controls when relevant | Keep support and legal information easy to find. Make essential policies accessible before sign-in too. |
| About | Product name, actual installed version/build, agency credit, operator name | Use “Made with ♥ by” + sign. Link the entire credit to https://ws.agency/. |
| Company / Legal | Legal name, address, OIB, registry and other applicable disclosures | Read shared fields from [company.json](../data/company.json). Link to the complete company notice; keep an offline copy of core operator details. |
| Help | Product support contact, help center and relevant diagnostics | Use product contacts, not an unrelated agency inbox. Explain what diagnostics will be sent and let the user review them. |
| Account | Deletion, export and subscription management as applicable | Use working native flows; explain retained records and billing consequences. Keep deletion separate from canceling a subscription. |
| Store listing | Actual publisher/trader details, support and product privacy URLs | Match the real publisher account. Complete store data disclosures from the actual app and SDKs. |
| Open-source licenses | Notices for distributed dependencies and assets | Include licenses required by the app's dependencies. An agency badge does not replace them. |

These positions are design recommendations. Platform policies and legal obligations below are separate requirements. Do not put company addresses in every toolbar or splash screen.

## Shared records and product links

[company.json](../data/company.json) holds the public company facts with field-level sources and pending confirmations. [products.json](../data/products.json) holds product-specific URLs and contact channels. Read these at build time or copy a pinned snapshot into the app; do not call a private Gitea URL from a public app. Update downstream copies when company information changes.

- **Talkyto:** use its [app privacy policy](https://talkyto.com/privacy-policy-app), not the separate marketing website policy. The listed owner contact is hello@ws.agency. Dedicated support and account-deletion routes are still unverified.
- **CHRIS:** [help](https://chris.hr/pomoc/), [privacy](https://chris.hr/privatnost/), [terms](https://chris.hr/uvjeti/), [DPA](https://chris.hr/dpa/) and [deletion guide](https://chris.hr/brisanje-racuna/). Its privacy policy distinguishes WS's processor role for employee records from other processing contexts. Do not label WS the controller of all customer data automatically.

Keep the registered Croatian company name in English interfaces too; an English translation may accompany it. Replace the examples' “Version from app build” with installed package metadata. Never hardcode this kit's version as the product version.

## Platform requirements

Apple expects working support and privacy links. Apps supporting account creation must allow users to initiate deletion in the app; merely deactivating an account is insufficient. A generic email support flow is normally insufficient for deletion. See [App Review](https://developer.apple.com/app-store/review/) and [account deletion guidance](https://developer.apple.com/help/app-review/guideline-reference/5-1-1-account-deletion).

Google Play requires an in-app privacy policy and a policy URL in Play Console. For apps within its account-deletion requirement, provide an in-app route and an external web route, and accurately declare retention. See [User Data policy](https://support.google.com/googleplay/android-developer/answer/10144311?hl=en) and [account deletion requirements](https://support.google.com/googleplay/android-developer/answer/13327111?hl=en).

The examples link to CHRIS's public deletion instructions, not a destructive action. Before release, exercise the actual flow with a test account. Likewise, test policies in a signed-out browser, email routing, large text, screen-reader labels, light/dark modes and small devices. Keep an accessible label on the heart/sign credit and at least a 44 px touch area as a kit recommendation.

## Owned product versus client app

For a WS-owned product, identify WEB rješenja d.o.o. as operator where applicable. For a client-owned app, name the client's actual legal entity as operator, seller and/or controller as appropriate. A WS development credit is optional and must be accurate. Do not replace a client's legal details with this kit's company record.

For Croatian web disclosures and online sales, use the [legal implementation guide](croatian-web-disclosures.md). A credit badge alone is not a company notice.