Privacy Policy

1. Who we are

Free POS Online operates the website and web application available at https://freeposonline.com (the “Service”). The Service provides a browser-based point of sale workspace for retailers, including product management, billing, invoices, refunds, optional cloud sync, and related features.

If you have questions about this policy, contact us through our Contact Us page at https://freeposonline.com/auth/contact-us.

2. Scope

This policy applies to information processed when you visit our marketing pages, create or use an account, use the POS workspace, enable optional Google Drive sync or encryption, or submit a contact message. It does not cover third-party websites or services that we do not control, including Google’s own products and policies when you interact with Google directly.

3. Information we collect

Depending on how you use the Service, we may process the following categories of information:

• Account information: When you register or sign in, we process authentication data through Firebase Authentication, which may include your email address, display name, user ID, and sign-in provider details (for example email/password or Google sign-in).
• Local POS business data: Products, prices, discounts, images you upload, current bills, held bills, invoices, refunds, shop profile details (such as store name, phone, address, logo, and receipt settings), and related operational metadata are stored primarily in your browser using IndexedDB (via Dexie) on your device.
• Optional Google Drive sync data: If you enable Google Cloud Sync, the Service stores sync files (such as JSON shard files, a sync manifest, and encryption metadata when applicable) in your Google Drive using the limited drive.file scope, which is intended to access only files created or opened by this app—not your entire Drive.
• Optional encryption settings: If you enable encryption, we store encryption configuration on your device (and, when sync is enabled, related wrapped-key metadata in your Drive). We do not receive or store your passphrase or recovery key on our servers. Those secrets remain under your control.
• Contact messages: If you use Contact Us, we collect the information you submit (such as name, email address, and message content) and process it through our backend Cloud Function so we can respond.
• Technical and usage data: Like most web services, our hosting and security providers may process standard technical data such as IP address, browser type, device information, timestamps, and request logs needed to deliver and protect the Service.
• Security verification: On certain authentication flows we use Cloudflare Turnstile to help reduce abuse. Turnstile may process technical signals as described in Cloudflare’s documentation and privacy materials.

4. How we use information

We use information to:

• Create and manage accounts, authenticate users, and protect account access.
• Provide the POS workspace features you request, including billing, products, invoices, refunds, settings, and dashboards.
• Provide optional multi-device sync through Google Drive when you enable and authorize it.
• Respond to support and contact requests.
• Maintain security, prevent abuse, debug issues, and operate hosting infrastructure.
• Improve reliability and user experience of the Service.

5. Google Drive access

Google Drive sync is optional. When you choose to connect Drive, you grant the Service permission to create and manage app-related sync files in your Drive using Google’s OAuth consent flow and the drive.file scope.

Sync files contain POS business data needed to keep devices aligned. If encryption is enabled, transferable payloads are encrypted before upload as described in the encryption section below. Encryption metadata needed to unlock with your passphrase or recovery key may also be synced.

You can disconnect sync in the app settings and revoke the app’s Google access at any time in your Google Account permissions (https://myaccount.google.com/permissions). Revoking access stops future Drive access by the app; existing files already in your Drive remain in your Drive until you delete them.

6. Optional encryption

You may optionally encrypt local POS data and Drive sync payloads with a passphrase you choose. A one-time recovery key is shown at setup so you can unlock later if you forget the passphrase. Encryption keys are derived and unwrapped on your device. We cannot reset a lost passphrase or recovery key.

If you lose both your passphrase and recovery key, encrypted data may be permanently unrecoverable. The same passphrase or recovery key is required on each device that unlocks encrypted data or encrypted Drive sync files.

7. How we share information

We do not sell your personal information. We share information only as needed to operate the Service with processors and providers, including:

• Google: Firebase Authentication, Firebase Hosting, Firebase Cloud Functions, Google APIs / OAuth, and Google Drive when you enable sync.
• Cloudflare: Turnstile challenge processing on applicable auth flows.

We may also disclose information if required by law, to protect rights and safety, or in connection with a business transfer of the Service, subject to applicable law.

8. Advertising

The Service is designed to support optional advertising placements, but advertising is not currently enabled in our production configuration. If we enable ads in the future, we will update this policy to describe any additional advertising technologies or partners before or when they are turned on.

9. Retention

Account authentication data is retained while your account remains active in Firebase Authentication and for a reasonable period afterward as needed for security, abuse prevention, and legal compliance.

Local POS data remains on your device until you clear site data, uninstall/clear the browser profile, or otherwise delete it. Drive sync files remain in your Google Drive until you delete them or until Google’s retention rules for your account apply.

Contact messages are retained as needed to handle your request and maintain basic support records.

10. Your choices and requests

Depending on where you live, you may have rights to access, correct, delete, or restrict certain personal data, or to object to certain processing. You can take many actions yourself:

• Clear or remove local POS data from your browser/device storage.
• Disconnect Google Drive sync in settings and revoke app access in your Google Account; delete sync files from Drive if desired.
• Contact us via the Contact Us page to request account-related assistance. We may need to verify your request before acting.

11. Security

We use industry-standard protections appropriate to a hosted web application, including HTTPS transport and provider-managed infrastructure security. No method of transmission or storage is completely secure. You are responsible for protecting your account credentials, device access, and—if enabled—your encryption passphrase and recovery key.

12. Children’s privacy

The Service is intended for business and adult users. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will take appropriate steps.

13. International processing

We use global cloud providers (including Google). Your information may be processed in countries other than where you live. Those countries may have different data-protection laws. Where required, providers offer contractual and technical safeguards for cross-border transfers.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will change the “Last updated” date at the top of this page and, when changes are material, take additional steps as appropriate. Continued use of the Service after an update means you acknowledge the revised policy.

15. Contact

For privacy questions or requests, use our Contact Us page: https://freeposonline.com/auth/contact-us.

You may also review our Terms of Service at https://freeposonline.com/terms.