Legal
Privacy policy
Last updated 14 September 2026. This policy covers the My Shop Android
application (package com.techx.myshop) and this website.
Who we are
My Shop is operated by Tech-X, based in Dar es Salaam, Tanzania. For anything in this policy, write to support@tech-x.co.tz.
The short version
- We collect your name and email so you can sign in, and your shop's business records so the app can show them back to you.
- We do not sell your data, share it with advertisers, or use it to profile you.
- Your shop's records are visible only to you and to staff you personally add to your shop.
- You can delete your account and data at any time — from inside the app, or from this page.
What we collect
Account information
When you sign in with Google, we receive and store:
- Your email address
- Your display name
- Your Google profile picture URL
- A unique account identifier issued by Firebase Authentication
We never see or store your Google password. Sign-in is handled entirely by Google.
Business records you enter
Everything you record in the app: shop name and type, products, prices, costs, stock levels, barcodes, categories, sales, purchases, suppliers, and any customer names, phone numbers or emails you choose to save. This is the content of the app — without it there is nothing to show you.
Device and technical information
- Push notification token — an anonymous identifier from Firebase Cloud Messaging, so we can send low-stock alerts to your phone. Removed when you sign out or delete your account.
- Platform — whether the device is Android, iOS or a web browser.
- Server logs — your IP address, the time of the request and which endpoint was called. Kept for 30 days for security and debugging, then deleted.
- Language preference — English or Swahili.
Camera
The app asks for camera permission only so you can scan barcodes. Frames are processed on your device to read the code and are never recorded, stored or uploaded. Only the resulting barcode number is saved, and only if you attach it to a product. You can refuse the permission and still use every other part of the app.
SMS messages
The app does not read SMS on a shop's phone. If you run a shop, the SMS permission is never requested, no prompt is ever shown, and nothing in the app reads your messages.
The permission exists for one device: the phone that holds the My Shop merchant SIM
and receives the Vodacom Lipa Namba payment confirmations. On that phone an operator
of the service can turn on automatic payment matching, which reads confirmation messages
from the mobile-money sender IDs only — LIPA, M-PESA and
the Vodacom short code. Messages from anyone else are not read, not sent anywhere and not
stored. What is stored from a matched confirmation is the transaction reference, the
amount, the payer's mobile number and name as the network wrote them, and the message
text, so that a payment can be reconciled and disputed later.
If you have paid us by Lipa Namba, your name and number appear in that confirmation because you sent the money, and we keep it as the record of your payment — exactly as a paper receipt book would. It is used for billing and nothing else.
What we do not collect
- Your location
- Your contacts, photos or files
- Your SMS messages — other than the Lipa Namba payment confirmations that arrive on our own merchant phone, described above
- Any advertising or tracking identifier
- Anything for the purpose of advertising or analytics profiling
Why we process it
| Data | Purpose | Legal basis |
|---|---|---|
| Account information | Authenticate you and link you to your shop | Performance of a contract |
| Business records | Provide the service — store and display your inventory and sales | Performance of a contract |
| Push token | Send low-stock alerts you asked for | Consent (you can revoke it in Android settings) |
| Server logs | Detect abuse, diagnose failures | Legitimate interest in a secure service |
Who it is shared with
We use three service providers, and nobody else:
- Google (Firebase Authentication) — verifies your identity when you sign in. Google's handling of that is governed by the Google Privacy Policy.
- Google (Firebase Cloud Messaging) — delivers push notifications to your device. It receives the notification text and your device token, not your business records.
- Hostinger — hosts the database and API on our behalf, in their data centres. They act only on our instructions.
We do not sell personal data. We do not share it with advertisers or data brokers. We will disclose data if we are legally required to, and will tell you unless the law forbids it.
Where it is stored
Your shop's records are stored in a MySQL database on our hosting at Hostinger. A copy also lives on your own phone so the app works offline — that copy is inside the app's private storage, which other apps cannot read.
How long we keep it
- While your account is active — your business records are kept until you delete them or delete your account. An inventory app is useless if it forgets last year.
- Server logs — 30 days.
- After account deletion — see below.
Deleting your account and data
You can delete your account in two ways:
- In the app — Settings, then Delete account.
- On the web — use the form at /delete-account. You do not need the app installed.
When an account is deleted:
- Your name, email, profile picture and push tokens are erased immediately.
- If you are the only person in your shop, the entire shop is deleted — products, sales, purchases, customers, everything.
- If other people still work in that shop, the shop's records stay (they belong to the business, not to you alone) and you are simply removed from it. Your identity is anonymised in the transaction history.
- Requests made through the web form are actioned within 30 days.
Deleting your My Shop account does not delete your Google account. You can revoke My Shop's access to your Google account separately at myaccount.google.com/permissions.
Your rights
You can ask us to:
- Give you a copy of your data
- Correct anything inaccurate
- Delete your data
- Stop processing it
Email support@tech-x.co.tz. We will respond within 30 days. There is no charge.
Security
All traffic between the app and our servers runs over HTTPS. Sign-in tokens are verified against Google's published signing keys on every request. Access to a shop's records is checked on the server for each call, not just hidden in the interface. Database credentials and service account keys are stored outside the web root.
No system is perfectly secure. If you believe you have found a vulnerability, please write to support@tech-x.co.tz before disclosing it publicly.
Children
My Shop is a business tool and is not directed at children under 13. We do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.
Changes to this policy
If we change how we handle your data in a way that affects you, we will update the date at the top of this page and notify you in the app before the change takes effect.
Contact
Tech-X
Dar es Salaam, Tanzania
support@tech-x.co.tz
+255 000 000 000