Privacy Policy

Overview

FloPOS is free, open-source, self-controlled restaurant POS software. FloPOS does not operate a vendor cloud that stores your restaurant sales, customer, menu, staff, or payment records.

This policy explains what data may be handled through the FloPOS website and project, and what data remains under the control of the restaurant or operator using the software.

The short version: your installation, your database, your backups, your rules.

Self-hosted software

FloPOS is designed to run on infrastructure controlled by the operator, such as a local device, desktop environment, local network, or deployment you manage.

What this means:

• FloPOS does not receive your sales records, customer lists, menu data, inventory data, or business reports.
• FloPOS does not require a software subscription account to unlock the core POS.
• FloPOS does not operate a central cloud database for your restaurant data.
• FloPOS cannot retrieve, correct, export, or delete data inside your own installation. The operator controls that environment.

As the operator of a FloPOS installation, you are responsible for securing your own devices, users, databases, backups, and any personal data you choose to store.

Open source

FloPOS is published as free and open-source software on GitHub at github.com/FreeOpenSourcePOS/FloCafe.

The source code is public so restaurants, developers, and auditors can inspect how the software works, review changes, fork the project, and build from source.

When you use GitHub to download releases, star the project, open issues, submit pull requests, or join discussions, GitHub privacy terms apply to that activity.

Data inside the app

Depending on how you configure and use FloPOS, the following types of data may be stored inside your own installation:

• Transaction records - order history, bill amounts, payment methods, timestamps, discounts, refunds, and related service records.
• Menu and inventory data - item names, categories, prices, stock levels, variants, addons, and modifiers.
• Staff data - staff accounts, roles, permissions, and operational activity connected to service workflows.
• Customer data - any customer names, phone numbers, emails, notes, or receipt details you choose to collect.
• Device and local session data - local settings and session information needed to run the POS workflow.

This data stays in the environment you control unless you export it, back it up, sync it through your own tools, or connect third-party services yourself.

Cloud connection and store registration

FloCafe can optionally connect to a FloPOS-operated cloud service. It is what lets you pair the RevFlo mobile app with your till, receive release announcements, and raise a support ticket from inside the app. It does not change what is said above: your sales, orders, menu, customers, staff and payment records stay in your own installation and are not uploaded to us.

When a till connects, the following is sent to identify the installation and reach you about it:

• Business contact details - business name, contact name, email address, phone number, and business address, as entered in your own settings. Used for support and service notices. This is not an account and there is nothing to log into.
• Installation details - a random installation identifier, app version, operating system and processor type.
• Locale settings - the country, currency, timezone and operating-system region of the till.
• IP address - see below.

IP address, and why we look at it

Your IP address reaches our servers whenever the till connects, as it does with any internet request. We use it for one additional purpose beyond ordinary operation and abuse prevention: to work out which country an installation is in.

We need that because FloPOS is free software used in over sixty countries, and tax rules, receipt and printing formats, and language support all have to be built country by country. Knowing where FloPOS is actually being used is what tells us which country to build for next. The country a till reports for itself is not reliable enough on its own - it carries a default that many merchants never change, which put installations in the wrong country entirely.

We keep the country, not the address. The address is converted to a two-letter country code, and that code is what is stored against the installation. To do the conversion we send the address to ipwho.is, a geolocation lookup service. It gives a country, not a street, a person, or a household.

Raw IP addresses are deleted automatically after 30 days. This runs on a schedule, without anyone having to ask for it:

• Connection records containing an address are deleted once they are 30 days old.
• The address held against a paired device is erased once that device has been idle for 30 days.
• If an installation does not come online for 30 days, every IP address associated with it is erased, whatever its age.

The derived country code is kept, because it is the reason the lookup happened and because a country on its own does not identify anyone. You can disconnect an installation from the cloud at any time in FloCafe under Settings › Cloud Sync, and request deletion of what we hold for it from the same screen.

Usage telemetry, diagnostics, and product analytics

FloCafe and RevFlo can optionally send anonymous usage telemetry, aggregated operational diagnostics, and scrubbed product analytics. These transmissions help maintain software stability, identify regressions, and understand adoption patterns across global jurisdictions, entirely separate from any cloud sync you configure for store operations.

1. Anonymous usage telemetry

In FloCafe, anonymous usage telemetry is enabled by default for new installations. First-run setup presents a disclosure panel explaining what is transmitted. You can disable telemetry at any time in Settings › Privacy, and your refusal is permanently preserved across app updates and database migrations. In RevFlo, telemetry is opt-in via an unchecked consent box on the terms screen. Installations predating this capability remain off unless explicitly enabled.

When enabled, telemetry transmits only minimal, high-level operational signals:

• A randomized local identifier generated on your device upon initial install - never your personal name, store name, phone number, email address, or business account identifier.
• Application version, packaging mode (packaged release vs. local development), install source (such as Microsoft Store, Mac App Store, Snap, Flatpak, or Debian package), and device operating platform (macOS, Windows, or Linux).
• Configured store currency and user-confirmed country code (to identify localized tax and fiscal requirements).
• High-level heartbeat events: application launch, feature engagement counts, and a daily operational ping sent at most once every 24 hours.

Usage telemetry never includes sales numbers, order contents, menu items, customer details, employee information, or payment transactions.

2. Operational diagnostics and error telemetry (Diagnostics v2)

FloCafe v2 diagnostics capture structured failure codes from a closed operational registry to help developers isolate defects and hardware failures without inspecting restaurant transactions.

What is collected in diagnostic reports:

• Standardized operational classifications: reason codes (such as print queue failure or persistence errors), operation names, subsystem stages, and classification types (distinguishing expected cashier validation rejections from unexpected application errors).
• Hourly aggregate event counts, window timestamps, application version and build identifiers, operating system, and bounded technical facts (such as printer connection type).
• Randomized correlation UUIDs for tracing related errors within the same session.

What is strictly excluded:

• No database queries, SQL statements, or stack traces.
• No customer identities, customer phone numbers, table names, or cashier notes.
• No monetary amounts, itemized receipt lines, payment card numbers, or transaction references.

Transmission routing and controls:

• Connected stores: When FloCafe is paired with a FloAdmin back office account via Cloud Sync, diagnostic reports are delivered directly to the store's private problem inbox in FloAdmin.
• Unlinked stores: When Cloud Sync is not configured, diagnostic reports are stripped of all store identifiers and delivered as anonymous aggregate counts to https://telemetry.flopos.com/collect, provided anonymous telemetry remains enabled.
• Merchant controls: Automatic diagnostic transmission requires both diagnostics consent and transmission enabled. You can toggle diagnostic transmission at any time in Settings › Privacy. Offline devices queue at most 200 bounded aggregate records in a local SQLite outbox; no reports are transmitted while offline or during automated test executions.

3. Product analytics and exception reporting (PostHog)

Official release packages of FloCafe incorporate privacy-scrubbed product analytics and crash reporting powered by PostHog, hosted in PostHog's European Union cloud infrastructure (https://eu.i.posthog.com). Community builds, local development runs, automated test suites, and third-party forks do not contain project API tokens and never transmit data to PostHog.

Merchants choose their preferred analytics level during onboarding or in Settings › Privacy:

• Link my email (Full): Generates an account identifier from a SHA-256 hash of your registered store email. This links usage patterns to your support account so our team can proactively assist when your store encounters operational difficulties.
• Keep it anonymous (Anonymous): Generates a random device identifier (inst_...). Only general store parameters (such as country, currency, UI language, and service model) are transmitted. Store email and staff identities are strictly stripped before transmission.
• Don't share usage data (Off): Disables all product analytics, screen views, and usage pings entirely.

Crash and exception reports: When diagnostic transmission is enabled, unhandled application errors and local API 5xx failures transmit scrubbed error metadata (error name, sanitized first line with email addresses, URLs, and numeric identifiers redacted, and relative stack frames). When diagnostic transmission is disabled, exception reporting is completely deactivated.

This website

The FloPOS website is a public information site. Standard hosting logs may include IP address, browser type, referring URL, requested pages, and timestamps. These logs are used for security, troubleshooting, and basic site operation.

If analytics, forms, tracking scripts, advertising pixels, or additional third-party services are added in the future, this policy should be updated to disclose the provider and purpose.

If you email support@codify.tech, the message and email address you send are used to respond to your enquiry. They are not sold as a mailing list.

Third parties

FloPOS does not sell or rent personal data for marketing purposes.

The project and website may link to external services such as GitHub, app stores, payment providers, delivery platforms, WhatsApp, or documentation tools. Those services operate under their own privacy policies.

The following third-party infrastructure providers are utilized in connection with cloud and telemetry services:

• ipwho.is - Geolocation service used to determine country code from IP addresses when connecting to cloud services, as described under "Cloud connection and store registration". Raw IP addresses are purged automatically after 30 days. No business, customer, or sales data is sent to it.
• PostHog Inc. (EU Cloud) - Provides product analytics and scrubbed error tracking for official packaged releases of FloCafe. Data is hosted within the European Union (eu.i.posthog.com) under strict allowlist scrubbing and data minimization controls.

If you enable integrations inside your own FloPOS setup (such as Google Drive backup or WhatsApp receipt delivery), the data shared with those providers is governed by the provider you choose and the configuration you control.

Children

FloPOS is intended for businesses and their staff. The website and software are not directed at children, and FloPOS does not knowingly collect personal information from children.

Your rights

For data stored inside your own FloPOS installation, you exercise control directly through your own database, devices, backups, and administrative process.

For personal data you have shared directly with the FloPOS project, such as by email or GitHub participation, you may request access, correction, or deletion by contacting the relevant platform or emailing support@codify.tech.

Changes to this policy

This policy may be updated from time to time. When it changes, the date at the top of the page should be updated.

Because FloPOS is open source, material software changes are also visible in the public repository history.

No warranty and liability

FloPOS is free and open-source software provided by Codify Apps Private Limited as is, without warranty of any kind. Operators are responsible for testing, backups, access control, legal compliance, hardware compatibility, and production use.

Read the No Warranty Disclaimer before using FloPOS in a live restaurant environment.

Contact

For privacy-related questions, contact:

• Email: support@codify.tech
• Website: flopos.com
• Source: GitHub repository