Privacy policy

Effective date: 11 October 2026.

Your store records

Sales, stock, customer and supplier entries, staff records, payroll, reports, and backup files are stored on the device where you use TandemPOS. TandemPOS does not automatically upload these records to its account service or share them with other registers. A backup that you export or restore may contain personal and financial information. Keep its password and file secure. Device storage is protected by your device login; local POS storage is not encrypted at rest.

Account and device information

Supabase handles account sign-in and email confirmation. We use your email address, optional account name, and account identifier to operate your account. Cloudflare hosts the website and stores subscription status, renewal dates, PayPal subscription references, and authorized device metadata. Device metadata includes a device identifier, public verification key, name, activation time, last check time, revocation status, and a record of device management actions. The device's private key stays on that device.

Device approval

Approval requests expire after 15 minutes. Temporary request records and expired security challenges are removed during subsequent service activity. Device approval links should be shared only with your owner account. Each authorized device follows the same account subscription end date.

Payments

PayPal processes TandemPOS subscription payments. We do not store your card details. Store sales in the POS are payment records; any bank, card, wallet, or QR payment must be completed separately with your payment provider.

Contact and support

When you contact us, we store your name, reply email, subject, message, source platform, and optional app version so we can answer and manage your request. Authorized support access may add private notes and status changes. Messages are eligible for deletion after 12 months; cleanup runs when the support service is used. Rate limiting uses short-lived hashes derived from an IP address. Hosting providers may process normal security and request logs. Please do not send passwords, card numbers, employee records, or customer transaction files through the contact form.

Service providers and your choices

Cloudflare, Supabase, PayPal, and a configured email delivery provider process information needed for their services. These providers may process information in other countries. We do not sell your POS records. Optional product email consent is separate from account and support messages. To request access, correction, deletion, or help with your account data, use Contact us. Some payment or security records may need to be retained for legal or operational reasons. Local store records are controlled by the store operator; deleting an account does not erase data or backups already stored on your devices.

Updates

We will update this page when our data practices change and show the new effective date.