This policy applies to the Tillo point-of-sale application for Android ("Tillo", "we", "us", "our"), published on Google Play by TSolutions DWC LLC under the package name com.tsolution.smartpos. Tillo lets a shop sell, take payments, print or share receipts and keep track of products and stock, all from a phone. We also run the SmartPOS back office, a cloud service for businesses with several tills or stores. The version of Tillo on Google Play cannot connect to it; section 1 explains what applies to a business that joins it by arrangement with us.
By using Tillo you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the application.
In short. Tillo has no sign-up and no account. A shop set up on the phone is kept only on that phone: your products, prices, stock, sales and staff are never sent to us. There is no advertising, no analytics and no crash reporting in the app. The only things that leave your phone are what Google Play and RevenueCat need to sell and verify a Tillo Pro subscription, and the limited diagnostic data Google's on-device barcode scanner reports. The version on Google Play has no way to send your shop's data anywhere. We do not sell your data.
1Information we collect
Your shop's data — kept on your phone
When you set up Tillo as a new shop, everything you enter is stored in a private database inside the app's own storage on your phone:
- Your shop's details: its name, phone number, address, currency, tax settings, and the receipt header and footer you write.
- Products: names, prices, cost prices, barcodes, categories, options such as sizes and colours, and stock levels and stock movements.
- Sales: the items sold, totals, tax, discounts, how each sale was paid (cash, card or wallet — recorded only; Tillo does not process card or wallet payments), and invoice numbers.
- Staff and shifts, if you use them: staff names, and sign-in PINs stored only as salted, one-way hashes. Shift records hold opening floats and cash-up counts.
We never receive this data, cannot see it, and hold no copy of it. Tillo has no server for a phone-owned shop. The app also opts out of Android's automatic cloud backup, so the system does not copy it anywhere either — the only copies are the backup files you choose to make (section 4).
Subscription information
Tillo is free to use, with an optional Tillo Pro subscription. Purchases are made through Google Play and verified through RevenueCat. RevenueCat assigns your installation a random, anonymous identifier — it is not linked to your name, email or shop — and receives the product you bought, its purchase and renewal status, and basic device information such as the app version, operating system and your IP address. We never receive your card or bank details; those stay with Google.
Your plan is remembered on the phone, so Tillo keeps working when it is offline.
Barcode scanner diagnostics
The camera scanner uses Google's ML Kit barcode scanning, with its model bundled inside the app, so codes are read entirely on your phone. Camera images are never stored and never sent to us or to Google. ML Kit may send Google limited technical data about how the scanner is performing — such as device model, operating system, app version and scan performance metrics — under Google's ML Kit terms. It does not include the images or the barcodes read.
Businesses on the SmartPOS back office (by arrangement only)
The version of Tillo on Google Play cannot connect to the SmartPOS back office: it has no activation option and never sends your shop's data to us. A business that wants the back office contacts us, and we set up its tills with it directly. For those tills only:
- Each till is linked to the business's account with a single-use activation code created by the business's administrator. A code expires after 24 hours and stops working once used.
- Sent from the till: each sale made on it — the items, prices, tax, discounts, totals, how it was paid, the invoice number, the time, and which staff member made it — and each shift, with its opening float and cash-up count. When the code is entered, the till also sends a random identifier that the app generates for this installation. It is not the device's hardware ID or advertising ID.
- Received by the till: the business's store details, products, prices and categories, its staff members' names and roles with their PINs as one-way hashes, and its till settings, colours and logo.
- The till keeps working offline and sends sales when it next has a connection. The server gives the till a private access token, and stores only a one-way hash of it.
All of this data belongs to the business. That business decides how the data is used and is your first point of contact about it; we process it on the business's behalf. Clear this phone in Settings removes the business's data from the till, and will not run while any sale is still waiting to be sent, so none is lost. Data already sent stays in the business's back office (see section 6).
If your business uses the SmartPOS back office
The back office is a separate website used by the owners and managers of those businesses; people who use Tillo from Google Play never need it. Each back-office user signs in with an email address and password, handled by our hosting provider's authentication service. Passwords are stored only in hashed form. In the back office the business enters its organization and store details, its products and prices, its staff names and roles, its till settings, and optionally a logo and brand colours. Uploaded logos are stored at a public web address so that tills can display them without signing in, so don't upload anything you would not put on a receipt. The back office has no advertising, no analytics and no tracking.
2What we do not collect
- No account, email address, phone number or password is ever asked for in the app. Only a business's back-office users sign in, on the back-office website.
- No advertising and no advertising ID.
- No analytics, usage tracking or crash reporting.
- No location. Bluetooth is used only to connect to printers you have already paired, so the app never scans for nearby devices.
- No contacts, photos, files, microphone or SMS. Backup files are read and written only through the Android file picker, one file at a time, when you choose.
- No personal information about your customers. Tillo does not ask for a customer's name, phone number or email to make a sale.
- We do not sell, rent or trade any information.
3Permissions and why Tillo needs them
| Permission | Why |
|---|---|
| Camera | To scan product barcodes. Asked for the first time you open the scanner; if you decline, you can still type codes or use a USB or Bluetooth scanner. Images are processed on the phone and never saved. |
| Nearby devices (Bluetooth connect) | To print receipts on a Bluetooth receipt printer you have paired in your phone's settings. Not used to scan for devices, and not used for location. |
| Internet and network state | To buy, restore and check a Tillo Pro subscription, and — only on tills we set up for a business's back office — to sync with it. Selling never requires a connection. |
| Google Play billing | To offer the optional Tillo Pro subscription. |
4Backups, receipts and printing
These features move your data only where you send it:
- Backup. Tillo can save your whole shop to a single file, in a place you choose with the Android file picker — your phone's storage, Google Drive, or any other provider you have installed. The file is not encrypted, so that a forgotten password can never make your only copy unrecoverable; it holds your shop's details, products, stock and sales, and staff PINs only as hashes. Treat it like any business record and keep it somewhere private. Restoring reads a file you pick in the same way. We never receive a copy.
- Sharing a receipt. When you share a receipt, Tillo hands its text to the Android share sheet and the app you choose (for example WhatsApp or email) sends it. That app's own privacy policy then applies.
- Printing. Receipts are sent directly over Bluetooth to your printer. The printer's name, address and paper width are remembered on the phone only.
5Who we share information with
We do not share your shop's data with anyone, because we do not have it. The services below receive only what is described in section 1:
| Provider | Purpose |
|---|---|
| Google Play | Distributing the app and processing Tillo Pro payments. Google Privacy Policy. |
| RevenueCat | Verifying and restoring your Tillo Pro subscription, using an anonymous identifier. RevenueCat Privacy Policy. |
| Google ML Kit | On-device barcode reading; may report scanner performance diagnostics as described above. |
| Supabase | Hosting the SmartPOS cloud service and back-office sign-in — only for businesses on the SmartPOS back office and the tills we set up for them. The version of Tillo on Google Play never contacts it. Supabase Privacy Policy. |
We may also disclose information if required to by law, though for a phone-owned shop there is nothing on our side to disclose.
6How long data is kept, and how to delete it
- Your shop's data stays on your phone until you delete it. You can edit or remove products at any time. Uninstalling Tillo, or clearing its storage in Android Settings, permanently erases everything — we cannot recover it, so make a backup first if you want to keep it. Because we never hold a copy, there is nothing you need to ask us to delete.
- Backup files stay wherever you saved them until you delete them there.
- Subscription records are kept by Google Play and RevenueCat for as long as needed to honour and restore your purchase and to meet tax and accounting obligations. You can manage or cancel the subscription in Google Play under Payments & subscriptions.
- Data held for a business (the SmartPOS back office and the tills set up for it) is kept for as long as that business keeps its SmartPOS account, because sales records are business and tax records. The business can ask us to delete its account and all of its data. If you are a staff member, ask the business first, or contact us. Clearing a till removes the data from that till only.
- Back-office sign-in details are kept while the user has access to the business's account. To have a back-office login deleted, contact us at the address below.
7Your rights
Depending on where you live, you may have the right to access, correct, delete or object to the processing of personal data about you. For data on your phone, you can exercise all of these directly in the app. For anything else described here, contact us at the address below and we will respond within a reasonable time. You may also complain to your local data-protection authority.
8Security
Your shop's data is held in Tillo's private storage area, which Android keeps separate from other apps. Staff PINs are stored only as salted hashes, never as the PINs themselves. Everything Tillo sends over the internet is encrypted with TLS. For back-office businesses, each business's data in the SmartPOS cloud service is kept separate from every other business's by access rules enforced in the database. Activation codes are single-use and expire after 24 hours.
Because your shop lives on your phone, the phone is what protects it. Use a screen lock, and keep regular backups somewhere safe — if the phone is lost or broken, a backup file is the only way to get your shop back.
9Children
Tillo is a business tool and is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
10Changes to this policy
We may update this policy as Tillo changes — for example, if optional cloud features are added. The new version will be posted on this page with a new "Last updated" date, and material changes will be noted in the app where appropriate. Continuing to use Tillo after a change means you accept the revised policy.
11Contact
Questions about this policy or your data:
TSolutions DWC LLC
Email: info@tsolutions-dwc.com