01Who this covers
This policy is from Tabworthy and covers the Tabworthy app and this website. It speaks to two different groups of people, and the difference matters.
- Merchants and their staff — the people who sign in and use the till. For your account details, we decide what is held and why, so we are responsible for them.
- The customers of those shops — people whose name or number a merchant writes down to run a tab or a loyalty card. For those records, the merchant decides what is kept; we only hold it on their behalf. If you are one of those customers and want your details changed or removed, ask the shop first — they can do it in the app in a few seconds. If you cannot reach them, write to us and we will help.
02What we hold
Your account
An email address and a password, your first and last name, a phone number, and the country the business trades in. The password is never stored as you typed it.
The business
Its name, an optional logo, the country, currency and time zone, what kind of shop it is, an optional phone number and email, and each branch you open — its name and, if you add them, an address and a phone number.
The people who work there
For each member of staff: a name, a phone number, their role, which branch they belong to, and a till PIN. PINs are stored only as an argon2id hash — a one-way scramble. Neither we nor anyone with the database can read a PIN back out of it.
The tills
Each device signed in to a business: the name it was given, its platform, the app version, which branch it stands in, and when it was last seen. This is what lets an owner see the tills on their counter and revoke one that has gone missing.
Trade
Everything a till is for: products and their prices, stock counts, orders and the lines on them, payments and how they were taken, shifts and cash drawer counts, and the reports drawn from all of it.
Support
If you message us on WhatsApp, we hold that conversation. The app prefills the shop's name in the first line so support knows who is asking.
How the app is getting on
The app keeps a short diary of its own running, from the first time it is opened — before you have an account — and sends it to us. It counts things and times them: which screens were opened and for how long, how many taps, which question of the first-run setup was answered or gone back from, how a sale was paid (cash, mobile money, card), how long the app took to start, what kind of error happened and where in the app, and how a backup went.
It never records what anybody types — no names, no shop names, no phone numbers, no email addresses, no codes, no passwords, no prices and no amounts of money. Before an account exists, it is tied only to a random number the app makes on your device, which says nothing about who you are. We read it to see where the app is hard to use and what breaks, and we keep it for ninety days.
There is no analytics SDK, no advertising SDK, and no crash-reporting SDK in the app. The diary above is our own, it goes to our own database and nowhere else, and nothing in it is used to build a profile of you or to advertise to you.
03Your customers
A merchant can save a regular against a tab. When they do, the app holds a name, a phone number, a WhatsApp number and a mobile money number if given, a free-text note, how many times that person has been in, and when they last came.
None of that is required to take a sale. The field is free text, and plenty of merchants use it for Table 4 rather than a person's name. What goes in there is the merchant's decision, and so is taking it out again — removing a regular in the app removes them everywhere the app has put them.
We do not market to your customers, sell their details, or use them for anything other than showing them back to the shop that wrote them down.
04Where it lives
Tabworthy is offline-first, which means there are two copies of a shop's data and both are protected.
- On the device. The whole database is encrypted on the phone or tablet with SQLCipher (AES-256). The key is held in the device's own secure store — the iOS Keychain or the Android Keystore — not in the app's files.
- In the cloud. A synced copy is held on Supabase, on servers in the European Union (Frankfurt), encrypted in transit and at rest. Row-level security in the database is what keeps one business's rows unreadable to another, and it is enforced by the server rather than by the app asking nicely.
If you are in Ghana or elsewhere outside the EU, this means your data is stored outside your country. We use Supabase's European region because of the protections that come with it.
05What we use it for
- Running the till — taking sales, tracking stock, showing a shop its own numbers.
- Keeping every device in a business in step, so a sale taken on the counter tablet shows on the phone behind the bar.
- Backing a shop's trading record up, so a lost or broken device is not a lost shop.
- Signing you in, and keeping people who should not be in the till out of it.
- Taking and settling payments, where a shop uses that part of the app.
- Answering you when you ask for help.
- Seeing where the app is hard to use and what goes wrong in it, from its diary — counts and times, never what anybody typed.
We do not use any of it to advertise to you, and we do not sell it. Ever, to anyone.
06Payments
Where a shop takes mobile money or card payments through Tabworthy, those payments run through Paystack, a licensed payment processor. Paystack handles the payment itself and is responsible for the details a payment needs.
We never see or store full card numbers. What Tabworthy keeps is the record a shop needs afterwards: the amount, the method, the reference the provider gave it, whether it succeeded, and — for a mobile money charge — the number it was charged to, because that is the number the merchant will be asked about when something goes wrong.
To pay a shop out we also hold its settlement destination: the bank or mobile money account an owner nominates, and the payouts made to it.
07Who else sees it
Three companies, each doing one job, and no one else:
- Supabase — the database, authentication and file storage.
- Paystack — taking payments and paying merchants out.
- Vercel — hosting this website. It does not touch app data.
Beyond those, we share a shop's data only where the law requires it of us, or where you ask us to. We do not sell data, we do not trade it, and we do not hand it to advertisers.
08Photos and permissions
The app asks for access to your photo library so you can put a picture on the things you sell. It is used for exactly that: you pick an image, it becomes a product photo, and it is stored on the device and synced with the rest of the shop's data.
The app does not read your library in the background, does not scan it, and takes nothing you have not picked. If you refuse the permission, everything else in the app works — items without a photograph are drawn as a coloured tile with their initials.
09Keeping and deleting
We keep a shop's data for as long as the account is open, because a till that forgets last year is not much use to a business that has to account for it.
You can delete your account from inside the app, under Settings. Doing so removes the business and everything attached to it — staff, products, customers, orders and photographs — from our systems. Some records may be kept longer where we are legally required to keep them, such as records of payments processed, and backups roll off on their own schedule rather than instantly.
Without the app — if you no longer have it, or cannot sign in — write to hello@tabworthy.app from the email address the account uses, with "Delete my Tabworthy account" as the subject. We will confirm it is you, delete the account and everything listed above within 30 days, and write back when it is done.
Deleting the app from a device does not delete the account. The device's own encrypted copy goes with the app; the cloud copy stays until the account is deleted, which is what lets you sign in on a new phone and find your shop where you left it.
10Your rights
Under Ghana's Data Protection Act, 2012 (Act 843) — and under the GDPR where it applies to you — you can ask to see what we hold about you, have it corrected, have it deleted, object to how we use it, or ask for a copy to take elsewhere.
Most of this you can do yourself, immediately, without asking us: the app lets you edit your details, remove a customer, delete your account, and export your whole trading record as CSV files from Settings. For anything else, write to hello@tabworthy.app and we will answer within 30 days.
If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to Ghana's Data Protection Commission, or to your local supervisory authority if you are in the EU.
11Security
- The database on your device is encrypted, and its key lives in the device's secure store.
- Everything between the app and the cloud travels over TLS.
- Passwords and till PINs are stored only as one-way hashes.
- Row-level security in the database means one business cannot read another's rows even if the app asked it to.
- An owner can see every device signed in to their business and revoke any one of them.
No system is perfect, and we will not pretend otherwise. If something goes wrong that affects your data, we will tell you, and we will tell you what actually happened.
12Changes and contact
If this policy changes in a way that matters, we will say so in the app rather than quietly updating the date at the top of this page. The date at the top is when it last changed.
Questions, requests, or something you think we have got wrong:hello@tabworthy.app, or WhatsApp+233 59 240 2005.