Timastra POS privacy

Updated 6 November 2026 · Android package com.timastra.pos · release 0.1.0

Timastra LLC provides Timastra POS, a standalone point of sale. This notice covers the independent Android app, not the separate Commerce service. Local selling requires no Timastra or Commerce account. Core POS remains free and works without the licensing service. Optional Advanced subscriptions are purchased through Google Play and verified by Timastra for the original store and register.

Local shop records

Products, SKUs, barcodes, photos, stock, customers, suppliers, sales, receipts, payments recorded by your shop, returns, cash movements, staff names, access roles, PIN credentials, timecards and business reports are stored on your device. Timastra does not automatically receive these business records. The shop operator controls which information is entered and who may access it. Use fictional data during testing. Local database storage is protected by Android's app sandbox; it is not represented as an independently encrypted database.

Optional sharing and connections

Exports, printing, customer displays, file pickers and sharing send selected information to the printer, app, display, file location or recipient you choose. Legacy JSON exports and CSV files are not password-encrypted. Protect and delete those copies at their destinations.

If you start the local register hub, authorized connected registers or browsers can read or change records within the permissions you grant. Network sharing requires HTTPS and your certificate configuration. A persistent Android notification identifies the running hub and lets you stop it. Stopping connections revokes its temporary credentials. Offline-register pairing and synchronization exchange the shop records and allocations you select; protect pairing files and keys.

Optional Xendit payment and QuickBooks accounting connections require your own provider setup. When you explicitly use them, the configured provider receives the transaction, amount, currency, merchant/account identifiers and other selected business information needed for that operation, plus ordinary network metadata. Provider credentials are held in the app process and excluded from business backups. These services have their own privacy and retention practices. They are not required for local selling; live provider acceptance has not been verified for this testing release. See Xendit's privacy notice and Intuit's privacy statement.

Optional Advanced subscriptions

When you buy or restore Advanced, the app sends its Google Play purchase token, app/package identifier and randomly generated store and installation identifiers over HTTPS to Timastra's dedicated licensing service at pos-license.timastra.com. Google Play supplies subscription status, product, trial and expiry information so we can verify ownership, restore access, prevent reuse across independent shops and process cancellation, payment recovery or revocation notifications. Local products, customer records, sales receipts, staff details and shop names are not sent to this licensing service. Google Play handles payments; payment card details are not stored in the POS licensing database.

The service runs on Cloudflare Workers and D1 and communicates with the Google Play Developer API. It stores token hashes and store bindings, verification/subscription state and encrypted purchase tokens used to check current entitlement. Store/installation identifiers also bind signed access grants. Short-lived hashed network identifiers limit abusive requests; service monitoring records notification delivery and failures without raw purchase tokens. Signed access is cached on the register or optional hub for up to 72 hours, never beyond the subscription expiry. Core selling, existing records, returns, exports and recovery remain available without an active subscription.

Encrypted tokens for terminal expired/cancelled-pending subscriptions are removed after 60 days; hashed ownership bindings and verification/incident records may remain to prevent misuse and support access recovery. Processed notification history is retained for 30 days and replay history for seven days. Required recovery backups and unresolved incidents may be retained longer for service continuity and resolution. Contact support@timastra.com to request access, correction or deletion of licensing information; some records may need to remain for fraud prevention or applicable obligations. Uninstalling clears local data but does not automatically cancel a Google Play subscription or delete server licensing records. Manage or cancel subscriptions in Google Play. Google controls its own payment/order history. See Google's privacy policy and Cloudflare's privacy policy.

Barcode scanning and permissions

The optional Google code scanner processes barcode camera input on the device through Google Play services. The app receives the scanned barcode, not a stored camera recording. Google may download scanner components. Google ML Kit collects device and app versions, device or installation identifiers, performance metrics, configuration, input/output sizes, feature events and error codes for diagnostics and usage analytics. Auto-zoom also generates scanning-session identifiers, zoom events and possible barcode coordinates. Google encrypts those metrics in transit using HTTPS. There is no separate app switch for SDK metrics; you may use manual entry or a keyboard scanner instead. See Google's ML Kit disclosure and Google's privacy policy.

Android photo/file pickers provide access to selected product photos, CSV imports, backup destinations and certificate files. Bluetooth access is used for compatible paired receipt printers. Internet/network and connected-device foreground-service permissions support optional connections; notification permission supports visible hub status. The app does not request contacts, microphone or location access. No advertising or standalone-app analytics service is initialized by this release's default entrypoint.

Backups, retention and deletion

Password-encrypted backups use AES-256-GCM with a password-derived key. Save them to a destination you choose; Android document providers may themselves be cloud services. Automatic backups run only after you configure them and retain a device-protected recovery password. Timastra cannot recover a forgotten password. Android automatic app backup is disabled. Restore works only on an empty installation and does not overwrite existing shop records.

Records remain locally until you remove them using supported app actions or remove the installation. Completed business records may be retained for audit history. Clearing Android app storage or uninstalling removes private local records and can permanently lose them; export anything you need first. Backups, exported files, paired registers, shared copies and provider-side records must be managed separately. The shop operator is responsible for its business retention obligations and customer/staff requests. Timastra cannot remotely delete records it does not hold.

Support and privacy requests

Email support@timastra.com for support, access, correction or deletion of support correspondence or optional licensing information. Include the app name and version, device model and a description; never send PINs, passwords, provider keys or private backups. We receive your email, message and chosen attachments and retain them as needed to resolve the request, protect rights and meet legal obligations. The Timastra website privacy notice covers support and this page's hosting. Provider-held information is handled under the applicable provider's policy.

Timastra POS is a business tool for adults, not an app designed for children. We do not sell your personal information or use shop data for advertising. This notice will be updated when the app's data practices change. Timastra LLC, 5830 E 2nd St, Ste 7000 #38687, Casper, WY 82609, United States.