Privacy Policy
PokePOS is a mobile point-of-sale app made by HackSonDev, LLC ("we", "us"). This policy explains what information we collect when a business and its team use PokePOS, how we use it, and the choices you have. We do not sell or share personal information (including for cross-context behavioral advertising), we do not show ads, and we do not track you across other companies' apps or websites.
Who this applies to
- Business owners who create a business in PokePOS.
- Sellers invited by an owner to sell for that business.
- Customers of those businesses, only to the extent described in "Customer information" below.
- Visitors to pokepos.com.
A business that uses PokePOS decides what it sells and who it sells to. For the sales and customer information a business records, that business is responsible for its own privacy practices, and we process that information on its behalf.
Information we collect
Account information
Your email address and your name. You can sign in with a one-time code or link sent to your email, or with Sign in with Apple or Sign in with Google. With Apple or Google we receive the name and email address you choose to share; if you use Apple's "Hide My Email", we receive a private relay address instead of your real one. For Sign in with Apple we also keep a token issued by Apple, only so that we can revoke PokePOS's access to your Apple ID when you delete your account.
Business information
Business name, sales tax rate, team members and their roles, invitations (the invited person's email address and their status), and subscription plan and status.
Catalog and inventory
Items, prices, costs, categories, SKUs and barcodes, stock levels and stock history (including notes you add to stock changes), and item photos you choose to add.
Sales
Items sold, amounts, taxes, payment method, time of sale, the seller who made it, refunds, and for cash sales the amount received. For card payments we receive only the card brand and last four digits from our payment processor; we never receive or store full card numbers.
Customer information
If a customer asks for an emailed receipt, the business may enter that customer's email address. We use it to send the receipt, store it with the sale so the business can see where the receipt was sent, and limit how many times a receipt can be emailed. We delete it from the sale after 90 days. Each receipt also has a link and QR code that open it on pokepos.com, where it can be downloaded as a PDF. That page shows the business name, items, amounts, taxes, payment method and, for cards, the card brand and last four digits. It does not show the customer's email or the seller's name. Anyone who has the link can open it, so share it only with the customer.
Invitations
When an owner invites a seller, we store the invited email address and send the invitation email. The person can accept it by signing in to PokePOS with that email, or the owner can revoke it.
Device permissions
- Camera: to scan barcodes and take item photos. We only keep photos you save to an item.
- Photos: only the photo you pick for an item, through the system photo picker.
- Location: required by our payment processor, Stripe, to accept card payments (Tap to Pay). The device's location is used by Stripe for payment security and compliance at the time of payment. We do not store your location or use it to track you.
- Bluetooth: only to connect card readers, if you use one.
Technical information
Our service providers keep standard server logs (such as IP address, device and browser type, and request times) to operate, secure and debug the service. These logs are kept for a limited time.
App usage analytics
To understand how PokePOS is used and improve it, the app sends usage events to Google Analytics for Firebase: the screens you open and actions such as signing in, creating a business, completing a sale (payment method, number of items and a price range, not the exact amount), refunds, invitations, emailed receipts and plan purchases. These events are linked to a random account identifier and your role (owner or seller), plus device and app information such as model, OS version, app version, country and language. They never include your email, name, your customers' information, item names or card details. We do not use the advertising identifier and do not use this data for advertising.
Website
pokepos.com does not use cookies or analytics. It remembers your language choice in your browser's local storage. The home page loads its font from Google Fonts, which receives your IP address and browser information when the font is downloaded.
How we use information
- To provide PokePOS: sign-in, selling, inventory, reports, team management and receipts.
- To process card payments and refunds through Stripe, and subscriptions through the App Store or Google Play.
- To send service emails, such as sign-in codes, invitations and receipts.
- To keep PokePOS secure, prevent fraud and abuse (for example, limits on how many invitations and receipts can be sent), and fix problems.
- To understand how the app is used and improve it (usage analytics).
- To comply with legal obligations.
Service providers we share information with
We share information only with providers that help us run PokePOS, under contracts that limit them to that purpose:
- Supabase — database, sign-in and file storage (hosted in the United States).
- Stripe — card payments, Tap to Pay and payouts to the business. Businesses that accept cards also agree to Stripe's terms, and Stripe processes payment data under its own privacy policy.
- Apple and Google — Sign in with Apple and Sign in with Google (if you use them), and subscription purchases through the App Store or Google Play. For purchases we receive the subscription status, not your payment details.
- RevenueCat — manages the business's subscription status. It receives a random business identifier and purchase information from the stores, not your name or email.
- Resend — delivers our emails (sign-in codes, invitations and receipts), so it receives the recipient's email address and the email content.
- Google (Google Analytics for Firebase) — app usage analytics, as described above, under Google's privacy policy.
- Cloudflare — hosts pokepos.com and routes emails sent to support@pokepos.com.
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or acquisition, in which case this policy will continue to apply.
Who can see what inside a business
The owner can see the business's catalog, inventory, team, invitations and all sales. Sellers can see the catalog, their own profile, and only their own sales and stock changes. People outside a business cannot see its data, except a receipt opened from its link as described above.
Retention and deletion
We keep information while the business account is active, and delete it when the account is deleted, as described below. Customer email addresses used for receipts are deleted from sales after 90 days, and invitations are deleted 90 days after they are accepted, revoked or expire. Usage analytics events are kept for no longer than 14 months.
You can delete your account in the app at any time from More → Delete account:
- Seller: we delete your account and profile. Sales you made stay with the business as part of its records, without your name.
- Owner: we delete your account and the business with all of its data: items, photos, stock history, sales, receipts, team memberships and invitations. We also ask RevenueCat to delete the business's subscription record.
- Invitations sent to your email address are deleted, and if you used Sign in with Apple, we revoke PokePOS's access to your Apple ID.
Some records are kept by other companies under their own rules: Stripe keeps payment records it is required to keep by law (a business's Stripe account belongs to the owner and stays under their control); Apple and Google keep store purchase records; and analytics events stay in Google Analytics until they expire (they are not linked to your name or email). A store subscription must be canceled by the owner in App Store or Google Play settings; deleting the account does not cancel it.
You can also email support@pokepos.com from the email address you use in PokePOS (steps: pokepos.com/delete-account). Deletions made in the app happen right away; requests by email are completed within 30 days, except for records we must keep by law (for example, payment and tax records), which we keep only as long as required.
Your rights
You can ask to access, correct, download or delete your personal information by emailing support@pokepos.com. We will not treat you differently for using your rights. If you are a customer of a business that uses PokePOS, you can also contact that business directly; for information we process on a business's behalf, we may refer your request to that business.
- Verification: to protect your account, we answer requests sent from the email address on the account, or we may ask you to sign in to the app to confirm it is you.
- Authorized agents: someone you authorize can make a request for you. We will ask for your signed permission and may ask you to confirm your identity directly with us.
- Appeals: if we decline your request, you can appeal by replying to our answer with "Appeal" in the subject. We will respond within 45 days. If you are not satisfied, you can contact your state's attorney general.
California and other U.S. state privacy rights
If you live in California or another state with a consumer privacy law, you have the right to know what personal information we collect and how we use and disclose it; to access, correct and delete it; and to opt out of its sale or sharing and limit the use of sensitive information. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it, so there is nothing to opt out of. In the last 12 months we collected the following categories:
| Category | Examples | Source | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email address, account ID, IP address | You; Apple or Google sign-in; your device | Account, sign-in, service emails, security | Supabase, Resend, Cloudflare, Apple, Google |
| Commercial information | Sales, refunds, catalog, inventory, subscription status and purchases | You and your team; Stripe; App Store and Google Play | Providing PokePOS, payments, subscriptions | Supabase, Stripe, RevenueCat |
| Customer contact information | Email address for a receipt | The business | Sending the receipt | Supabase, Resend |
| Internet or other electronic activity | App usage events, server logs | Your device | Improving the app, security, debugging | Google Analytics for Firebase, Supabase, Cloudflare |
| Photos | Item photos you add | You | Showing items in the catalog | Supabase |
| Account credentials (sensitive) | Sign-in codes and links, Apple token | You; Apple | Signing in, revoking Apple access on deletion | Supabase, Resend |
We keep each category for the periods described in "Retention and deletion". Precise location is used by Stripe at the time of a card payment; we do not collect or store it.
Security
Information is encrypted in transit, access inside a business is limited by role, and card data is handled by Stripe, not by us. Starting with app version 1.0.1, your sign-in session is stored encrypted on your phone, with its key kept in the device's secure storage (Keychain on iPhone, Keystore on Android), and sign-in links only work on the device that requested them. No system is perfectly secure, so please keep your email account safe, since it is used to sign in.
Children
PokePOS is a business tool and is not directed to children under 13. We do not knowingly collect information from children under 13.
Changes
We may update this policy. If we make significant changes, we will notify owners in the app or by email before they take effect. The date at the top shows the latest version.
Contact
HackSonDev, LLC — 131 Continental Dr, Ste 305, Newark, DE 19713 — support@pokepos.com · WhatsApp: +1 849 570 7280