Privacy

Who this policy is from

TillyFlo is an independently built app, published from Ontario, Canada. This policy covers both the app and this website. Questions, or anything you want us to explain, go to hello@tillyflo.com, which a person reads.

What we collect

Nothing. There is no sign-up, no login and no user account. TillyFlo has no server for your data to be sent to, so there is no mechanism by which we could receive it even if we wanted to.

Your items, photos, customers, balances, expenses, income, hours and notes are written to a database file on your own device and stay there.

What we can see

None of it. We cannot see your inventory, your customers, what you paid, what you sold, who owes you money, your photos or your hours. Not on request, not with a warrant, not by accident. The data is not in our possession.

Analytics and tracking

TillyFlo contains no analytics SDK, no advertising identifier, no attribution framework and no crash reporter that transmits anything off the device. We do not know how many times you open the app or what you tap.

Permissions, and what each one is for

• Camera: to photograph an item or a receipt, and to scan a barcode. Images are written to your device.
• Photo library: to attach a picture you already took. We read only what you pick.
• Microphone: only if you use voice entry, and only while you hold it. See the note below.
• Face ID / biometrics: to unlock the app, if you switch that on. The check happens on your device and we never receive the result.

Every permission is requested at the moment you use the feature that needs it, and declining one disables that feature and nothing else.

Backups

TillyFlo does not run a backup service. You have two options, and both are yours rather than ours:

• Export a CSV at any time and put it wherever you like. This is free in every version of the app and always will be.
• Your platform's own backup: Apple's iCloud backup or Android's Auto Backup. If you switch this on, your TillyFlo database and photos are copied into your iCloud or Google account under that account's own privacy terms. They still never come to us.

Voice entry

If you dictate an item, speech recognition runs on your device wherever your device supports doing so. On some Android devices the offline language pack may not be installed, in which case the system's own speech service handles it and the audio is processed by your device's operating-system vendor under their terms, not ours. If that applies to your device the app will tell you before it listens. We never receive the audio or the transcript either way.

Payments

If you buy TillyFlo Pro, the purchase is handled entirely by Apple or Google. We never see your card number, your billing address or your name. We receive only an anonymous confirmation from the store that a purchase was made.

Your customers' details

If you record a customer's name, phone number or email in TillyFlo, that information is yours and stays on your device. We are not a processor of it, because it never reaches us. Keeping that information lawfully, and telling those people about it if your local law requires it, is your responsibility as the person holding it.

This website

The website is deliberately plain. It runs no analytics, no advertising pixels, no session recording and no third-party trackers, and it sets no cookies of its own, which is why you were not shown a cookie banner. Fonts are served from this site rather than from a font network, so loading the page does not tell anybody else that you visited.

Our web host keeps standard server logs, which typically include IP address, browser type and the pages requested. That is ordinary web-server operation rather than anything we look at or build profiles from.

If you join the beta list

The one place this site collects anything is the beta signup, and it collects one thing: your email address. Leaving it is your express consent, under Canada's anti-spam legislation, to receive email from us about TillyFlo.

• What we send: an email when the beta opens and an email when the app ships. That is the whole plan. No newsletter, no drip sequence, no partner offers.
• Who sends it: TillyFlo, from Ontario, Canada, at an address you can reply to. Every message identifies the sender, gives a postal address for us, and carries a one-click unsubscribe.
• Unsubscribing: one click, or reply and ask. We stop within ten business days at the outside, and in practice immediately.
• Who else sees it: the list is held by our email provider purely to send those messages. It is never sold, rented, shared or used to target advertising.
• Getting it deleted: email us and we remove the address from the list entirely.

Under Canadian privacy law (PIPEDA) you can ask what personal information we hold about you, ask us to correct it, and ask us to delete it. For almost everyone the honest answer is "an email address, and nothing else."

Children

TillyFlo is a business record-keeping tool and is not directed at children. Since it collects nothing from anybody, it collects nothing from children either.

GDPR, CCPA and equivalents

These regimes govern what an organisation does with personal data it holds about you. We hold none. There is no data to access, correct, port, restrict or delete, because none of it was ever transmitted to us.

Your rights over the data on your own device are absolute and need no request to us: export it with CSV export, and delete all of it by deleting the app. If you had platform backup switched on, deleting the app does not remove the copy already in your iCloud or Google account. You remove that through Apple's or Google's own settings.

Changes to this policy

If TillyFlo ever gains a feature that transmits anything, this page will say so plainly and in advance, the app will ask you before it does it, and the change will be listed here with its date. A feature that quietly started sending your data somewhere would contradict the reason the app exists.