Privacy policy
Last updated 17 September 2026 (camera scanning)
In short: Chachi POS keeps a store's sales, stock, prices, customers and staff on the store's own computer, phone or tablet. If a store also uses Chachi POS on the web, or keeps its devices in step with each other, a copy of those records is kept for that store on our server, and is used only to run that store. We never sell data, show ads or track anyone.
This policy covers the Chachi POS apps for Windows and Android (Google Play package
store.chachisoftware.pharmacypos), the web version of Chachi POS, and this website,
pos.chachisoftware.store.
Who we are
Chachi POS is made by Chachi's Software Development Service, Koronadal City, South Cotabato, Philippines. Write to us at ChachiSoftware@gmail.com about anything in this policy.
What the store keeps
Chachi POS is a point-of-sale system that a business runs. It keeps the records the store enters on the store's own device:
- sales, receipts, returns and voids;
- products, prices, stock and product photos;
- customers the store chooses to record, with their contact details and credit balances;
- suppliers and deliveries;
- staff user names, with their passwords and PINs stored only as one-way hashes;
- shifts, cash counts and an audit trail of who did what.
The store decides what to record about its customers and staff. For that information the store is the personal information controller, and it is responsible to the people it records.
Backups are saved on the device, or in a folder the store chooses. The Android app turns off Android's automatic cloud backup, so the store's records are not copied to anyone's Google account.
Stores on the web, and devices kept in step
A store can choose to use Chachi POS on the web, at an address such as pos.chachisoftware.store/s/yourstore. A web store can also keep its phones and computers in step with it. When a store does either:
- We keep the store's records, as listed above, and its backups on our server, in a space of its own that no other store can reach.
- Records travel between the store's devices and our server over an encrypted (HTTPS) connection.
- We use those records only to run that store's POS. We look at them only when the store asks us for help, or when the law requires it.
- We act on the store's behalf, as its personal information processor. We do not use the records for anything of our own.
A store that uses neither sends none of these records to us.
The Android app
The app asks Android for the following access, and uses it only as described:
| Access | What it is used for |
|---|---|
| Internet and the local network | The app runs its own POS server on the device and talks to it. It prints receipts to a printer on the store's network. It checks the store's licence with this website. If the store chooses, it keeps the device in step with the store's web copy. |
| Storage | To save the store's backups in Documents/ChachiPOS Backups, outside the app, so they survive the app being removed. On Android 11 and later this needs no permission; on Android 10 and older the app asks for the ordinary storage permission. The app reads and writes only its own backup files there. A backup is restored through Android's own file picker, which opens only the file the user chooses. |
| The camera, for a product's photo | Only when someone taps the button to add a product's picture. The first time, the app asks for camera permission; if it is refused, a photo can still be chosen from the gallery. The photo is taken by the phone's camera app and saved with the product. |
| Scanning barcodes with the camera | Only while someone is scanning. Where the phone has Google Play services, Google's code scanner shows the camera and hands the app only the barcode's number; the app sees no picture. On a phone without Play services, the app asks for camera permission the first time and reads the barcode itself. Either way, camera images are read on the phone, never stored and never sent anywhere. |
| Network state | Added by Google's code scanner, to fetch its scanning module when the phone is online. |
The web version and the Windows app use the same camera scanning in the browser, with the browser's or Windows' own permission prompt, and keep no images either.
The app does not collect location, contacts, call logs, SMS, microphone audio, the advertising ID or a list of other apps. It contains no advertising and no analytics or tracking code.
What this website keeps to run licences
| What | When | Why |
|---|---|---|
| The store owner's Google account ID, email address and name | When the owner signs in with Google at /link or Your stores, or when we set up a store for the owner's email address | To know who owns the store. Only the owner signs in with Google. The name is kept only for the one-hour sign-in and is not stored with the store. |
| The store's name, its plan (monthly or one-time), and the date it is paid until | When a store is created or its plan changes | To run the licence |
For each linked device:
|
When a device is linked, and at each licence check | To list the store's devices and renew each one's licence. The device's renewal secret is stored only as a one-way hash. |
| Payments and changes to the plan: the amount, a reference and a note. For Google Play, the purchase token, the product and its expiry. | When a payment is made or recorded | To give the store what it paid for, and to answer questions about a payment |
| Standard web server logs: IP address, time and the page requested | On every visit | To keep the service secure and working |
The licence check sends only the store's name, the app version, the device ID, its renewal secret and, for a web copy, its address. It never sends sales, stock or customer data.
Payments
A subscription bought in the Android app is paid through Google Play. Google handles the card or wallet details, and we never see them; we receive only the purchase token, which we confirm with Google. Payments by GCash or bank transfer are recorded by us with their amount and reference.
Cookies
The public pages of this website set no cookies. Signing in as a store owner sets one sign-in cookie that expires after an hour. A web store keeps its own sign-in on the device while someone is signed in. There are no analytics, advertising or tracking cookies, and no third-party scripts.
Who else is involved
- Google, when the owner signs in with Google, and to confirm Google Play purchases.
- Our server, which we run ourselves, holds this website and the stores that use Chachi POS on the web.
We do not sell, rent or share anyone's information with anyone else, except when the law requires it.
How we protect it
- Connections to this website and to web stores are encrypted (HTTPS).
- Every staff member signs in with their own account. Passwords, PINs and device secrets are stored only as one-way hashes.
- Each web store runs separately from every other.
- Licences are digitally signed, so they cannot be forged.
How long we keep it, and deleting it
- On a store's own device. Records stay until the store deletes them or uninstalls the app. Uninstalling removes the app's records from the device, but not backups the store saved elsewhere.
- On our server. A store's licence record, and a web store's records and backups, are kept for as long as the store has an account with us. A device the store removes stops being able to renew.
- Deleting an account. To have a store's account and everything we hold for it deleted, email ChachiSoftware@gmail.com from the owner's email address. We delete it within 30 days, and first send the store an export of its records if it asks.
- A customer or staff member of a store. Ask the store first, because the store controls those records. You can also write to us and we will pass the request on.
Children
Chachi POS is a business tool for store owners and their staff. It is not meant for children, and we do not knowingly collect information from children.
Your rights
Under the Data Privacy Act of 2012 (Republic Act No. 10173), you can:
- ask to see the information we keep about you;
- have it corrected or deleted;
- object to how it is used;
- complain to the National Privacy Commission.
Email ChachiSoftware@gmail.com and we will answer.
Changes
If this policy changes, the new version will be posted here with a new date.