Privacy Policy — Offline POS
Last updated: 12 October 2026
Offline POS (offline.pos) is a point-of-sale app for small shops. This policy explains what the app stores, what it does not, and the few occasions on which anything you have entered can leave your phone.
It is written to describe what the software actually does. Where something could be read two ways, the stricter reading is the one meant.
The short version
- The app has no accounts and no sign-in. You never give us an identity.
- It contains no analytics, no advertising and no crash reporting. There is no code in it that reports anything about you or your shop to us.
- We operate no server. There is nowhere for your data to be sent to us, and we could not read it if you tried.
- Everything you enter — products, sales, customers, invoices, photos — stays in the app's private storage on your phone.
- Data leaves your phone only when you press something that sends it, and then only to where you chose.
What the app keeps on your phone
All of it is held in the app's own private storage, which other apps cannot read:
| What | Examples |
|---|
| Shop details | shop name, owner name, address, phone, email, PAN/VAT, logo, owner photo, signature, stamp |
| Products | names, prices, cost, stock, categories, barcodes, photos |
| Customers | names, phone numbers, addresses, balances owed |
| Sales and purchases | invoices, line items, discounts, taxes, payments |
| Settings | language, currency, printing and scanning preferences |
| Security | your PIN, stored only as a salted PBKDF2-SHA256 hash, and your Shop Key |
| Activity log | a record of what was done in the app, so an owner can review a worker's shift |
None of this is transmitted anywhere by the app on its own.
When data can leave your phone
There are five, and each one happens only because you chose it.
1. Wi-Fi share (local network)
The app can start a small web server so another device on the same Wi-Fi can download a backup, an invoice or a product list. The data travels over your own network and does not reach the internet. The server stops when you stop it, when the app closes, or after the expiry you set.
2. Share over the internet (Cloudflare Tunnel)
If, and only if, you turn on Share over the internet, the app opens a temporary tunnel using Cloudflare's service so a device not on your Wi-Fi can reach that same page. While the tunnel is open the data you are sharing passes through Cloudflare's network, which is a third party with its own privacy policy (https://www.cloudflare.com/privacypolicy/). The link is temporary and one-use, and the tunnel closes when you close it.
If you never use this feature, the app never contacts the internet for it.
3. Cloud backup
If you fill in a cloud server of your own — your WebDAV, Nextcloud or similar — the app can upload a backup file to that server. It is your server; we have no access to it and never see the address or the password. The backup is encrypted before it is uploaded (see Security below).
4. Bluetooth
The app sends receipts to a thermal printer you have paired, and can send a single invoice to another phone running the companion Invoice app. Both are direct device-to-device transfers. Nothing is relayed through any server.
5. Whatever you share yourself
Saving a PDF, sharing a receipt to WhatsApp, saving a backup file to your Downloads folder, or showing an invoice as a QR code on screen all hand the data to whatever you chose. Once it leaves the app it is governed by the policy of wherever it went.
Permissions, and why each one exists
| Permission | Why |
|---|
| Camera | To read barcodes and QR codes. Frames are decoded in memory and dropped. No photo is taken, stored or sent. |
| Bluetooth | To find and connect to your receipt printer, and to send an invoice to the companion app on another phone. |
| Internet / network state | For the Wi-Fi share, the optional internet tunnel and the optional cloud backup. Nothing uses it otherwise. |
| Vibrate | Feedback when a barcode scans. |
| Storage (Android 9 and older only) | To save backup files where you can find them. Newer versions of Android do not need it and it is not requested. |
You can refuse any of them. The app will tell you which feature stops working and the rest carries on.
The camera and barcode reading
Scanning runs entirely on your device, using an on-device barcode library bundled inside the app. Camera frames are never uploaded and never written to storage. The app does not use face recognition and does not identify people.
The companion app
Invoice for Offline POS is a separate app that receives and stores invoices. It holds no internet permission at all. Invoices reach it over Bluetooth, by scanning a QR code off the till's screen, or through a direct hand-off between the two apps on one phone, protected so only our own signed apps can send. Everything it receives stays on that phone.
Security
- Your PIN is never stored. Only a salted PBKDF2-HMAC-SHA256 hash is kept, and wrong attempts are rate-limited — 3 wrong attempts means a wait, 5 means a longer one, 10 requires the Shop Key.
- Backups are encrypted with AES-256-GCM using a key derived from your Shop Key, so a backup file on a cloud server or a memory card is unreadable without it. Backup files made by older versions of the app are not encrypted; replace them if they matter.
- We cannot recover your Shop Key. We do not have it. Lose it and an encrypted backup cannot be opened by anyone, including us.
- App data is held in Android's private app storage and is not readable by other apps on the phone.
Keeping and deleting your data
The app keeps your data until you delete it. You are in control of all of it:
- Delete individual records inside the app.
- Uninstalling the app erases everything it holds.
- Backup files you created yourself live wherever you put them — your Downloads folder, a memory card, your cloud server — and are not removed by uninstalling. Delete those yourself if you want them gone.
Because we hold nothing, there is nothing for us to delete on your behalf and no request you need to make to us.
Children
The app is a tool for running a shop and is not directed at children. It does not knowingly collect anything from anyone, of any age.
Changes to this policy
If the app gains a feature that changes any of the above, this policy is updated before that version is released, and the date at the top changes with it.
Contact
Questions about this policy, or about anything the app does with your data:
0.epicproject@gmail.com
Offline POS is published by Epic Project, a non-profit open-source initiative building practical Android and Windows apps for everyday life.