1. About this policy
This policy describes how E. Haq, Pakistan, handles information through Shai POS and this website. Shai POS is for adults authorised to operate a retail business. It uses a sign-in account, while shop records are stored on the Android device. Google Drive backup is not included in this release.
2. Account and sign-in information
We use Google Firebase Authentication for Google sign-in and email/password accounts. Firebase processes your email address, unique account identifier, sign-in provider, verification status and authentication credentials. Google sign-in may supply your name and profile-image URL along with your email and provider identifier. We use account information to identify the shop owner, restrict access to local records, link supported sign-in methods, and provide verification, password recovery and account deletion.
Email/password credentials are sent securely to Firebase. Shai POS does not save passwords in its shop database or screen-restoration state. Google sign-in does not provide your Google password to Shai POS. Firebase also processes IP addresses, user-agent and app information for service operation, security and abuse prevention. See Firebase privacy information and its Android SDK disclosures.
3. Shop records and printing
Shop details, products, barcodes, buying prices, inventory movements, sales, taxes, receipts and printer settings remain locally on your device. Signing in does not upload, synchronise or back up these records. Each device keeps a separate local shop. Temporary held tickets are lost when the app process ends.
Receipt and report content is sent to the printer you select. Copies you print or export remain outside the account-deletion service. Manual cash/card recording does not process a customer payment or collect their payment-card credentials.
4. Google Play subscriptions
Google Play processes subscription payments and maintains its billing records. Shai POS receives purchase receipts, purchase tokens, signatures, product identifiers, purchase status and an obfuscated account identifier to check selling access, restore purchases and acknowledge purchases. A SHA-256 hash derived from your Firebase account ID is sent to Play to associate the purchase with your Shai POS account. This identifier is pseudonymous, not anonymous.
The app encrypts its purchase/access cache and acknowledgement queue using Android Keystore and excludes them from backups. It checks purchases in the app; there is no separate Shai POS subscription verification server or Firestore purchase-binding database in this release. We do not receive full payment-card details from Google Play. The Play account paying for the subscription may differ from your Shai POS sign-in account.
5. Camera, images and printers
- Camera: optional permission for on-device barcode scanning. Manual entry remains available.
- Receipt image: a selected image is used locally and included in your printer output.
- Nearby devices / Bluetooth: connects to your chosen Bluetooth Classic printer.
- USB: Android requests permission for the selected printer.
- Local network: connects to your configured network printer address and port.
Google ML Kit processes barcode images on-device. ML Kit can send device/app information, installation identifiers and performance/usage metrics to Google. See ML Kit data disclosures. Internet access is used for authentication, account checks, Google Play, and applicable SDK services.
6. Providers and website
Our providers include Google Firebase Authentication, Google Play, Google ML Kit, and Cloudflare Pages for website delivery. These services can process information internationally, including outside your country. Their applicable contractual and transfer safeguards govern processing; see Firebase data processing terms, Google Privacy Policy, and Cloudflare Privacy Policy.
The marketing pages contain no advertising or analytics scripts. The account-deletion page provides an email request route. It does not collect passwords, load Google sign-in or authenticate you in the browser. If you email us, your email provider and our mailbox provider process the message and its metadata. We verify ownership before acting on a deletion request. Hosting providers process technical request and security information.
7. Support and use of information
Contact ahteshamshani618@gmail.com for support or privacy requests. We receive your email and information or attachments you choose to send. Use only the details necessary for the request; never email passwords, complete card numbers or purchase tokens.
We use information to deliver the service, manage accounts and subscriptions, respond to requests, protect against misuse and meet legal obligations. Where applicable, processing relies on providing the service you request, legitimate interests in security and support, legal obligations, or consent where required. We do not sell personal information or use it for advertising. Disclosure may be necessary to service providers, to comply with law or to protect legal rights.
8. Security
Authentication uses HTTPS, and the local subscription cache is encrypted. These protections do not mean all shop data or printer traffic is encrypted. Printer protocols may send receipt content without encryption: use a trusted network and secure your device. No storage or transmission method guarantees absolute security.
9. Retention and deletion
Firebase account: kept until you request deletion. Firebase states that logged IP addresses are retained for a few weeks and other authentication information is removed from live and backup systems within 180 days after deletion is initiated. This provider retention period is separate from removing your active sign-in account.
Local records: retained until you delete them, clear app storage or uninstall. In-app account deletion removes this device's local records only when that account owns them. Website deletion cannot remotely wipe an offline device. You can remove remaining records through Android app-storage settings; an app that detects unavailable account access also offers explicit local cleanup. Printed or exported copies are not remotely erased.
Billing: Google Play manages its transaction records under its own policies. The app keeps its encrypted purchase and access cache locally until app data is cleared. Signing out does not delete that cache.
Support: Support messages and deletion-request records are kept only as long as needed to resolve the request, handle disputes and meet applicable legal obligations. We review resolved requests for deletion or minimisation; legally required records are retained only for the applicable requirement.
Infrastructure: Hosting and authentication providers may retain technical and security logs under their published policies. We do not maintain a separate subscription verification server.
When a legal or security reason requires retaining information, we limit retention to that purpose and explain the reason and applicable period where permitted. Account deletion does not delete your Google account, cancel a Google Play subscription or erase Google's own transaction records. Delete your Shai POS account or request help.
10. Your rights and requests
Depending on your location, you may request access, correction, deletion, restriction or portability, object to processing, withdraw applicable consent, or complain to your local data protection authority. Contact ahteshamshani618@gmail.com. We verify requests proportionately and respond within applicable legal deadlines. We cannot retrieve or restore records that exist only on your device. Our data-request page explains how to contact us.
11. Policy changes
We will update this page and its effective date when our practices change and provide notice when required. Any future cloud-backup feature requires updated disclosures before introduction.