Privacy Policy

1. Quick Summary

ShopPilot is an offline-first business management app. Most business data is stored on your device in app storage. If you choose to sign in and enable cloud backup or team sync, selected app data may be backed up or synchronized through your Google account and Google Drive. Configured release builds also use Firebase Authentication for verified identity, Cloud Firestore for premium entitlement and optional encrypted near-live sync, Firebase Crashlytics for diagnostics, Firebase Remote Config for operational settings, and Google Play Billing for Android subscriptions.

2. Scope

This Privacy Policy applies to the ShopPilot mobile and desktop application, related Google Drive and Firebase services, subscription verification, and any support interactions connected to the app. It does not apply to third-party websites, services, or integrations that are governed by their own privacy policies.

The business owner generally controls the customer, staff, transaction, and operational records entered into its workspace. The Publisher provides the app and separately controls developer-operated Firebase identity, entitlement, verification, diagnostics, and support records described here. Exact legal roles can depend on local law and how a business deploys ShopPilot.

3. Information We Handle

ShopPilot is a business operations tool. The exact information handled by the app depends on what you enter and which features you enable.

4. How We Use Information

We use information handled by ShopPilot to:

• create and manage business workspaces, branches, customers, orders, jobs, invoices, inventory, staff, expenses, reports, and reminders;
• show accurate records to the correct owner, staff member, shop, and branch;
• generate invoices, reports, PDFs, exports, backups, and business summaries;
• support optional Google Drive backup, restore, and team sync;
• authenticate Google identities with Firebase and verify that premium or staff access belongs to the correct account;
• relay optional premium sync updates as encrypted envelopes through Cloud Firestore and process delivery acknowledgements;
• process and verify Android subscriptions through Google Play Billing and the ShopPilot verification backend;
• send local app notifications about backup, sync, restore, reminders, or important status changes;
• protect the app with local security features such as PIN settings;
• store a local acknowledgement receipt so material policy updates can be presented again;
• retrieve operational configuration through Firebase Remote Config;
• diagnose release-build crashes through Firebase Crashlytics and respond to support requests.

Where privacy law requires a legal basis, processing may rely on providing the requested app/service, consent for optional account, cloud, support, or device features, legitimate interests in security and reliability, and compliance with legal obligations. A business using ShopPilot is responsible for its own lawful collection and use of customer and staff information.

5. Local Storage, Backup, and Sync

Local device storage

ShopPilot is designed to work offline. Business records are stored locally in app-controlled storage on your device. Anyone who has access to your unlocked device or unlocked app may be able to view the records stored in the app.

Google Sign-In and Google Drive

If you sign in with Google or enable backup, restore, or team sync, ShopPilot may use Google services to authenticate your account and store or exchange app backup files, attachments, and sync data in Google Drive. The app requests email/profile identity plus Drive application-data and file access used for files ShopPilot creates, opens, or the user selects. Visible collaboration files may be shared with staff accounts chosen by the business owner. Hidden application-data objects are not shown in the normal Drive file list. Google processes service and account information under its own terms and privacy policy.

Team and branch sync

If you use owner/staff or branch sync features, records may be exchanged between authorized workspace members so the business can operate across branches and devices. ShopPilot uses workspace, shop, branch, and membership metadata to route data to the correct workspace and reduce accidental cross-branch visibility.

Firebase Authentication and Cloud Firestore

When configured premium, subscription, or near-live sync features are used, ShopPilot bridges the verified Google identity into Firebase Authentication. Firebase may store a user ID, email address, identity-provider information, and authentication metadata. Cloud Firestore stores premium entitlement records and access-routing metadata such as owner/staff email addresses, shop and branch IDs, membership status, timestamps, hashes, and delivery acknowledgements. Near-live business changes are encrypted by ShopPilot before the encrypted envelope is uploaded; routing metadata is not inside that encrypted envelope. Near-live sync is a premium, release-configured feature and may be disabled in some builds.

Google Play Billing and subscription verification

On supported Android release builds, purchases are handled by Google Play Billing. ShopPilot receives product and purchase-status information and sends the opaque purchase token, product ID, authenticated Firebase identity, and workspace/account identifiers over HTTPS to the ShopPilot verification backend. The backend checks the purchase with Google Play and stores entitlement status, expiry, product ID, owner identity, and a one-way hash of the purchase token in Cloud Firestore. Your payment method and full card details are collected by Google Play, not ShopPilot.

Firebase diagnostics and remote configuration

On Android, iOS, and macOS release builds where Firebase is configured, Crashlytics starts disabled before Dart runs and ShopPilot enables collection at runtime for non-debug builds. Crashlytics may receive crash stack traces, app/device details, installation identifiers, and technical error context. Firebase Remote Config may receive technical request, app, device, and installation metadata needed to return configuration values. Crashlytics is off in debug builds, and Firebase Analytics is disabled in the current app policy. Google processes this data as a service provider under its Firebase terms. Consent-based support diagnostic exports are generated locally, exclude database content, credentials, encryption keys, and raw Drive payloads, and are shared only when you choose to send them.

6. Sharing and Disclosure

We do not sell your personal data, customer data, business records, or staff data. Information may be shared only in the following situations:

• With workspace members: business records may be visible to owners or staff members who are authorized for the relevant workspace or branch.
• With service providers: Google Sign-In, Google Drive, Firebase Authentication, Cloud Firestore, Crashlytics, Remote Config, Google Play Billing, Android Publisher services, and the ShopPilot purchase-verification backend process data only for the functions described above.
• When you export or share: you may choose to create PDFs, reports, invoices, or files and share them outside the app.
• For legal or safety reasons: information may be disclosed if required by law, valid legal process, or to protect rights, safety, and security.
• With your consent: we may share information when you direct us to do so, such as during support.

7. App Permissions

Depending on your device and the features you use, ShopPilot may request access to the following capabilities:

• Internet: used for Google Sign-In, Google Drive backup/sync, Firebase identity and encrypted near-live sync, Remote Config, Crashlytics, subscription verification, support links, and external links.
• Notifications: used for local reminders, backup status, sync status, restore status, or operational alerts.
• Camera and photos: used when you choose to attach or capture product, order, job, or invoice images.
• Files and storage picker: used when you choose files for import, export, backup, restore, or attachments.
• Phone and external apps: used to open your dialer, WhatsApp, browser, email client, or sharing sheet when you choose those actions.

You can control permissions in your device settings. Some features may not work if the required permission is denied.

8. Retention, Export, and Deletion

Business records remain in the app until you edit, delete, reset, or uninstall the app, or until you remove related backups from your Google Drive account. Owner workspace deletion attempts to remove ShopPilot's visible Drive folder and hidden application-data objects for that shop. A network, authorization, ownership, or service failure can prevent verification, so you must follow the public deletion instructions and check other devices and user-exported or shared files separately.

Firestore near-live delta envelopes and acknowledgements are assigned a 30-day expiry and the backend code is designed to run scheduled cleanup. Premium entitlement records remain while needed to verify, restore, secure, and administer a subscription. Subscription event deduplication records are assigned a 90-day expiry. Firebase Authentication records remain until the Developer initiates deletion following a verified request. Firebase states that authentication data is removed from live and backup systems within 180 days after deletion is initiated. Signing out or deleting only a local workspace does not by itself delete Firebase identity, entitlement, or collaboration metadata.

Firebase states that Crashlytics keeps crash stack traces and associated identifiers for 90 days before beginning removal from live and backup systems. Firebase and Google may retain other service data according to their published retention schedules. Support messages are retained only as long as reasonably needed to answer the request, maintain security records, or meet legal duties.

The policy acknowledgement receipt remains in protected local device storage until that storage is cleared or a later policy acknowledgement replaces it. The receipt is not uploaded by ShopPilot.

You may export available invoices, reports, or backup files. To remove local app data, use the app's reset/delete controls where available or uninstall the app. To remove cloud data, delete the ShopPilot files and folders from your Google Drive and disconnect ShopPilot in your Google Account permissions. To request deletion of Firebase Authentication, Firestore identity/membership or entitlement records, diagnostic data, or support data controlled by the Developer, email baishalya1999@gmail.com with the subject "ShopPilot data deletion request". Include the Google email used with ShopPilot and the scope you want deleted; do not send customer records, passwords, PINs, OAuth tokens, or database files by email. Step-by-step public instructions are available on the ShopPilot data export and deletion page.

A business owner controls the customer, staff, and transaction records entered into that business's workspace. Customers and staff should normally ask that business to access, correct, export, or delete those records. The Developer may retain limited records when required for security, fraud prevention, legal compliance, or dispute handling and will explain the applicable reason.

Deleting ShopPilot data does not automatically cancel a Google Play subscription. Manage or cancel subscriptions separately in Google Play. Google may retain purchase and payment records under its own legal, fraud-prevention, tax, and accounting requirements.

9. Security

We use reasonable technical and organizational safeguards designed to protect information handled by ShopPilot. These include SQLCipher-encrypted SQLite workspace databases, authenticated encrypted portable backups and sync payloads, encryption of near-live business delta envelopes before Firestore upload, app-controlled local storage, role and branch separation, operating system protected credential storage where supported, HTTPS to Google services, and Google account authorization for Drive features. Files shared with workspace members are governed by Google Drive permissions; authorized collaborators may be able to access shared sync files using Drive outside ShopPilot. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

10. Children's Privacy

ShopPilot is intended for business use and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, please contact us so we can take appropriate action.

11. Your Choices and Rights

Depending on your location, you may have rights to access, correct, export, restrict, or delete personal information. Many records can be managed directly inside ShopPilot. You can also revoke Google account access through your Google account settings and remove app backups from Google Drive.

If you are a customer or staff member of a business that uses ShopPilot, contact that business first because it controls the records entered into its workspace.

You may also object to or restrict processing where local law provides that right, and you may complain to your local data-protection authority. Identity verification may be required before a request is completed.

Google account access can be revoked from your Google Account. Android subscriptions must be managed separately through Google Play; revoking Google Sign-In or deleting local app data does not automatically cancel billing.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the effective date above. Material changes may also be communicated in the app or through the store listing where appropriate.