LekasPOS privacy policy

Last updated: 8 October 2026

LekasPOS is a free, open-source point-of-sale app for small shops (source code, GPL-3.0). This page explains what happens to the information you put into it. In short: your data stays on your phone, and — only if you turn on sync — in your own Google Drive. The developer never receives any of it. If you allow error reports, the developer receives technical details about problems in the app, never your shop's data.

What the app stores

Everything you enter or record while running your shop: the store's details (name, address, phone, e-mail, business registration, SST and tax identification (TIN) numbers) and receipt logo; products, prices and stock, and the pictures and colours you give products; sales, refunds and payments; suppliers (with their contact details) and purchases; staff names, roles and PINs; customers (names, phone numbers, e-mail and postal addresses, tax numbers, notes and credit balances); shifts, cash movements, settings and an audit log of sensitive actions (including items taken off a bill, bills cleared and who signed in when). Each phone also keeps the Bluetooth addresses of the printer and scanner chosen in the app and, if Google Drive backup is on, the Google account's e-mail address (to show which account is in use and to connect to the same account again).

Staff PINs are stored only as salted, hashed values, never as the digits themselves. But a PIN has only 4–6 digits, so someone with a copy of the shop's data could still work it out by trying every number.

This data is kept in the app's private storage on the phone. The app warns when the phone's storage is almost full, because sales cannot be saved on a full phone. You (the shop) decide what is entered and are responsible for the customer and staff details you record.

Backup files and sync files are not encrypted by the app. Backup files (.lekasbak, including the daily copies on an SD card or USB drive) and the sync files in Google Drive hold all of the shop's data, including customers and the staff PIN records. Anyone who gets a copy can read it. Keep backup files private, share them only with people you trust, and protect the shop's Google account with a strong password and 2-Step Verification.

What leaves the phone

Nothing about your shop, by default. The app has no account with us, no analytics and no advertising. It works fully offline. The only connection it makes by itself is the update check below.
Update checks. Once a day the app asks GitHub, where LekasPOS is published, whether there is a new version, and downloads it from there when there is (change it any time in Settings → App updates). The request holds only the app version and the Android version; GitHub sees the phone's internet address, as for any website (GitHub's privacy statement). Nothing about your shop is sent. A new version is installed only when you tap Update and confirm it.
Google Drive backup (optional). If you turn on Google Drive backup (Settings → Google Drive backup) and sign in with a Google account, the app stores its sync files in that account's hidden app data folder in Google Drive, so the shop's tills share the same data. The app asks Google only for this folder (the drive.appdata permission): it cannot see or change any of your other Drive files, and other apps cannot read its folder. The files travel directly between your phones and Google over an encrypted connection (HTTPS); the files themselves are not encrypted by the app (see above). The app keeps the account's e-mail address on the phone only to show you which account is in use and to connect to the same account again. If the account already holds another shop's data, the app asks before this phone joins that shop (joining adds this phone's products, sales and customers to that shop on every till). Google's privacy policy applies to data kept in Google Drive. Sign-in uses Google Play services.
Daily sales report to Google Drive (optional). If you turn it on (Settings → Daily sales report to Google Drive) and sign in with a Google account, once a day the app writes a file of the month's daily sales totals to the folder “LekasPOS” in that account's Google Drive: for each day the number of sales and refunds, net sales, tax, total, discount, cost and gross profit, and how many bills were cleared, items taken off bills and times the drawer was opened without a sale (with their amounts) and the cash over or short — no receipts, products, customers or staff names. You see this file in Drive like any other, and so does anyone you share it with. The app asks Google only for the files it makes itself (the drive.file permission): it cannot see or change your other Drive files. It keeps the account's e-mail address on the phone to show it and to connect again. Google's privacy policy applies.
Daily copy to a folder (optional). If you pick a folder (for example on an SD card or USB drive), the app writes one backup file a day there and keeps the last 7. It stays on that card or drive; nothing is sent anywhere.
Files you choose to share. Backup files and CSV exports go only where you send or save them (for example WhatsApp, e-mail, a USB stick or your Drive).
The error log, if you send it. The app keeps a short log of errors on the phone (technical messages only: no PINs, passwords, customer or sales details). It leaves the phone only if you send it yourself from Settings → Diagnostics, to whoever you choose.
Error reports (only if you allow them). The app asks once whether it may send error reports to the LekasPOS developer (change it any time in Settings → Error reports). If you allow them, a report is sent when the app stops, freezes, logs an error or fails a check. A report holds:
- what went wrong: the kind of problem (stopped, froze, error or failed check), a short title, the technical error (its message, stack trace and thread name) and the lines of the error log just before it;
- when it happened and how many times;
- the app's version, build number and which key signed it; the Android version; the phone's make and model, its memory (RAM) and free storage; the size of the app's database; the app's language;
- a random number for this installation (a new one each time reports are turned on).
It never holds your sales, products, prices, customers, staff, PINs or Google account; e-mail addresses, long numbers and file names that appear in technical messages are removed first. Reports travel over an encrypted connection (HTTPS) through a small relay run on Cloudflare and are kept in the developer's private issue tracker on GitHub as long as they help fix the problem. Cloudflare sees the phone's internet address, as for any website; the relay uses it only to limit how many reports one address can send, and does not keep it with the report. While reports are off, nothing is kept for sending, and turning them off deletes the reports waiting to be sent (a report you send by hand still goes).
A report you send by hand. Settings → Diagnostics → "Send a report to the developer" sends the error log and the same phone details as an error report, with what you type, including a phone number or e-mail address if you choose to leave one for a reply. It is sent and kept the same way as error reports.

Permissions

Bluetooth — to print receipts and read barcode scanners you have already paired in Android settings. The app does not scan for nearby devices or use your location.
Camera (optional) — to scan barcodes, and to take a product's picture when you tap "Take photo" (Android's camera app takes it). Scanned images are processed on the phone and are not stored or sent anywhere. A product picture is made small (240 × 240 pixels) and kept with the shop's data: on the phone, in backups and, if sync is on, in the shop's Google Drive like the products themselves. "Choose picture" reads only the one picture you pick.
Internet and network state — for Google Drive sync, update checks and, if you allow them, error reports.
Install apps — to install LekasPOS's own updates. Android asks you to confirm each one; the app installs nothing else.
Keep awake — so backups and sync can finish in the background.
Run at startup — so the daily backup, sync and update checks resume after the phone restarts.

Deleting your data

Uninstalling the app, or Android Settings → Apps → LekasPOS → Clear storage, deletes the data on that phone (including the backups kept on it).
Turning off sync stops sending data; the files already in Google Drive stay there. To delete them, first turn off sync on every till (Settings → Google Drive backup → Turn off sync): a till that still syncs puts all its data back. Then open Google Drive on the web → Settings → Manage apps → LekasPOS → Options → Delete hidden app data.
Turning off the daily sales report stops it; its files stay in the “LekasPOS” folder of your Google Drive. Delete them there like any other file.
Backup files copied to a folder you picked (SD card, USB drive) are not deleted with the app; delete them in a file manager.
Backup and CSV files you saved elsewhere are yours to delete.
To have error reports deleted, contact the developer (below) with the phone model and roughly when the problem happened (reports do not say who you are).

Children

LekasPOS is a tool for businesses and is not directed at children.

Changes

If this policy changes, the new version is published on this page with a new date. The history of every change is public in the source repository.

Contact

Questions about privacy, and private requests (for example to have error reports deleted): e-mail mail@faizo.net. Public questions can also go to github.com/FaizoKen/LekasPOS/issues (issues there can be read by anyone, so leave out shop details).