Privacy Policy
Tillwise is a Shopify app for point-of-sale cash management. This policy describes exactly what data the app handles, why, who it is shared with, how long it is kept and how to have it erased. It is written against what the app actually does rather than against a template.
1. Who we are
Tillwise is built and operated by Pokit Apps, based in Canada. For the data described here we act as the controller where we decide how the app works, and as a processor acting on a merchant’s instructions for the store data the app handles on their behalf.
Privacy contact: support@pokitapps.com. We answer privacy requests at that address.
2. What Tillwise does
Tillwise sits on top of Shopify POS cash tracking. Cashiers count the drawer blind, log drops to the safe, payouts and paid-ins, and the merchant gets variance reporting and an audit log in the Shopify admin. Everything the app stores exists to serve that.
3. Data we read through the Shopify API
The app requests three access scopes and nothing else: read_cash_tracking, write_cash_tracking and read_locations. Through them we read:
- Cash tracking sessions and the native cash ledger for your registers, including opening and closing amounts and expected totals.
- Your store’s locations and register names.
- Your shop’s name, time zone, contact email address and currency, used to time the daily summary correctly and to label printed shift reports.
Cash tracking sessions and Shopify’s own cash ledger are read live each time a screen is loaded and are never copied into our database. The shop name, time zone, contact address and currency are held only in server memory for up to one hour and are not written to disk.
With write_cash_tracking the app writes counts and cash movements back into Shopify’s own ledger. That is a write to your Shopify data, not a collection of new data by us.
4. Account and staff data we store
- Installation records. Your
.myshopify.comdomain and the API access tokens issued to the app when it is installed. Tokens are held server-side and are never exposed to a browser or to a POS device. - Staff who open the embedded app. When a staff member opens Tillwise inside the Shopify admin, Shopify’s token includes their user ID, first name, last name, email address, locale and whether they are the account owner or a collaborator. We store those so the app can put a name next to a cash count instead of a bare numeric ID.
- Staff names you enter. Shopify does not make its staff list available to apps like ours (the
read_usersscope is not available to us), so we never fetch a staff roster. Merchants can type a display name against a staff ID in the app, and that label is stored.
5. Data merchants enter in the app
- Settings: the variance limit, whether counts are blind, which events require a written note, and whether a manager PIN is required for a no-sale drawer open or for closing a shift.
- The manager PIN is never stored. We store only a scrypt hash of it together with a per-shop random salt, plus a failed-attempt counter used to lock out brute-force guessing. The PIN itself cannot be recovered from what we hold.
- Daily summary recipients. If a merchant turns on the daily summary email, the email addresses they enter are stored. These are often a bookkeeper or accountant rather than the store’s own contact address, so they are personal data of a third party that the merchant is responsible for having a basis to provide.
6. Data captured at the till
Each drawer event recorded from Shopify POS is stored with: the kind of event (count, drop to safe, payout, paid-in, no-sale drawer open), the location, the device ID and register name, the amount and currency, the expected amount and the resulting variance, the per-denomination tally where one was entered, the reason code, any free-text note the cashier typed, how the action was authorised, and the time.
Two staff identifiers are stored with each event: the Shopify account authenticated on the device, taken from the verified session token Shopify issues, and the staff member pinned into POS at that moment, which POS reports from the device. Both exist so a variance can be traced to a person, which is the point of the product.
7. Customer data: none
Tillwise does not collect, store or process any personal data about your buyers or customers. It does not read orders, customer records or payment card data, and it does not have the access scopes to do so. Shopify’s mandatory customer data request and customer erasure webhooks are implemented, and both report that there is no customer data to return or erase, because there is none.
8. How we use the data
- To run the app: opening and closing shifts, recording counts.
- To produce variance reporting, per-staff and per-register breakdowns, the audit log, CSV export and printable shift reports.
- To send the daily summary email, when a merchant enables it.
- To answer support requests you send us.
- For security: the manager PIN lockout counter, and detecting misuse of the app’s API endpoints.
We do not sell personal data, do not share it for cross-context behavioural advertising, do not use it for advertising or profiling, and do not use it to train machine learning models. Where the GDPR applies, our lawful bases are performance of the contract with the merchant and our legitimate interest in keeping the service secure.
9. Who else the data reaches
We use a small number of service providers. Each processes data only to provide their service to us.
- Shopify
- The platform itself. All store and POS data reaches us through Shopify’s APIs, and cash counts are written back to Shopify’s own ledger.
- Fly.io
- Application hosting. The app runs in Fly’s Toronto, Canada region.
- Aiven
- Managed PostgreSQL database hosting for the data described above.
- Brevo
- Email delivery, reached through our own internal mail service. This is used only for the daily summary email, which is off by default. Nothing is sent to it unless a merchant turns the summary on, and then only the recipient addresses and the summary figures.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
10. Where the data is held
The application and its database are hosted in Canada, which the European Commission recognises as providing an adequate level of data protection. Where any transfer out of the EEA or the UK is not covered by that, we rely on standard contractual clauses with the provider concerned.
11. How long we keep it, and deletion
- Data is retained while the app is installed, so that historic shifts stay auditable.
- When the app is uninstalled, access tokens and session records are deleted immediately.
- Roughly 48 hours after uninstall Shopify sends us a shop erasure request. On receiving it we delete everything we hold for that shop: settings, staff names and emails, and every drawer event, including the counts, notes and denomination tallies.
- A merchant can ask us to erase their data sooner by emailing support@pokitapps.com.
- Server logs record request and error information for a short period for operational troubleshooting. They record webhook topics and error conditions, not drawer amounts or note text.
12. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how it is processed, to receive a copy in a portable form, and to withdraw consent where processing relies on it. You also have the right to complain to your data protection authority.
To exercise any of these, email support@pokitapps.com. We respond within 30 days. If you are a member of staff at a store that uses Tillwise, the store is the controller of the cash records that name you, so we will normally act on their instructions and will put you in touch with them. We also honour Shopify’s mandatory compliance webhooks for data requests and erasure automatically.
13. Security
- All traffic to the app is encrypted in transit over HTTPS.
- API access tokens and the hashed manager PIN are held server-side only and are never sent to a browser or a POS device.
- Requests from POS are authenticated with the session token Shopify issues, verified on our server, so a drawer event cannot be attributed to a staff account by a modified client.
- The database is access-controlled and reachable only by the application.
No system is perfectly secure, but if a breach affecting your data occurs we will notify affected merchants and the relevant authorities as required by law.
14. Cookies and tracking
Tillwise sets only the strictly necessary cookies used by Shopify’s authentication library to keep you signed in during installation and use. There are no analytics cookies, no advertising cookies and no third-party tracking or session-recording scripts anywhere in the app or its POS extension.
We do record a small number of product milestones for the shop as a whole - that the app was installed, that a first cash count was taken, that a plan changed, that the app was uninstalled. These are stored in our own database and are never sent to any third party. They record the store, never a member of your staff: no individual person, no cash amount and no drawer event is included, and this data is separate from the drawer audit log described above, which belongs to you. When your data is erased after uninstall, these records are stripped of anything identifying your store and kept only as anonymous counts.
15. Children
Tillwise is a business tool sold to merchants. It is not directed at children and we do not knowingly collect data from anyone under 16.
16. Changes to this policy
If this policy changes we will update the date at the top of this page, and where the change materially affects how we handle merchant data we will contact affected merchants directly.
17. Contact
Pokit Apps, Canada. support@pokitapps.com.