Privacy Policy

    Last updated: 2 October 2026

    Our Privacy Commitment

    DefiPOS is built on the principle of minimal data collection. We do not sell or rent your information, and we share it only with the service providers we need to run DefiPOS, as described below. Our website uses Google Analytics to understand how it is used.

    What We Collect (Minimal)

    Account Information

    Your email address, used to sign you in and recover your account, plus an optional display name and an optional business name (shown to your customers at checkout). If you sign up with a password, we store only a bcrypt hash of it. No identity verification. We also store what you set up in the app, such as locations, products and preferences.

    If you sign in with Google, Google shares your email address, name, profile picture and Google account ID with us, and we store them with your account.

    Wallet Addresses

    The public wallet addresses you add for each coin. We use them only to direct customer payments to your wallets and to detect those payments.

    We never have access to your private keys or funds. Payments go directly to your addresses.

    Optional Transaction History

    Transaction records are optional and configurable. You can disable transaction logging entirely in settings.

    When disabled, we confirm payment via blockchain verification and immediately discard the record. Only on-chain data persists.

    What We Don't Collect

    • ✗ No home address or phone number
    • ✗ No KYC (Know Your Customer) verification
    • ✗ No government-issued ID documents
    • ✗ No payment card information
    • ✗ No advertising, remarketing or social-media tracking tags
    • ✗ No device fingerprinting
    • ✗ No advertising or marketing cookies

    IP Address Handling

    We do not store IP addresses in our application database or link them to your account. Our hosting provider's server logs record IP addresses; we use them only for security and troubleshooting, and they are kept for a limited time. Google Analytics also receives your IP address when you visit our website (see Cookies and Analytics below); Google states that Google Analytics 4 does not log or store IP addresses.

    How We Use Your Information

    We use the data we collect only for the following purposes (website analytics is covered under Cookies and Analytics below):

    • Authentication: Email for login and account recovery
    • Payment Routing: Wallet addresses to direct customer payments
    • Optional Record-Keeping: Transaction history (if enabled by you)
    • Service Emails: Sign-up codes, password resets, a welcome email and important notices about the service (no marketing)

    Who We Share Data With

    We do not sell or rent your data. We share it only with service providers that run parts of DefiPOS for us: our hosting and database providers, our email delivery provider (for sign-up codes and password resets), Google (when you use Google sign-in, and for Google Analytics) and the blockchain data providers described below.

    • ✓ Google Analytics is our only analytics service (see Cookies and Analytics)
    • ✓ No advertising networks
    • ✓ No data brokers
    • ✓ No marketing partners
    • ✓ No government agencies (except when legally compelled by valid court order)

    Non-Custodial Architecture

    DefiPOS operates as a non-custodial payment monitor. This means:

    • We never hold, control, or have access to your cryptocurrency funds
    • Payments go directly from customer wallets to your wallet addresses
    • We cannot freeze, reverse, or confiscate transactions
    • Your private keys remain exclusively in your possession
    • Payments are confirmed from public blockchain data, which we cannot alter

    Third-Party Blockchain Infrastructure

    DefiPOS uses third-party blockchain RPC providers (NowNodes, TronGrid, and public nodes) to monitor and verify cryptocurrency transactions.

    Important Note

    While we do not share your account data with blockchain RPC providers, these nodes see public on-chain interactions as part of normal blockchain operation.

    • • RPC nodes can observe wallet addresses and transaction amounts (public blockchain data)
    • • We do not send your email, business name, or any identifying information to these providers
    • • Blockchain data is inherently public and visible to anyone running a node
    • • We use multiple providers to avoid single-point dependency

    Data Retention

    Account Data

    We keep your account data (email address, profile details, wallet addresses and settings) while your account is open. To delete your account and its data, email us at [email protected].

    Transaction History (Optional)

    If transaction logging is on, records of your sales are stored on our servers so you can see them in the app. You can turn logging off in settings at any time; while it is off, new sales are not recorded. To delete past records, email us at [email protected].

    Session Data

    Sign-in cookies are removed when you sign out and expire automatically after a limited period.

    Data Security

    • HTTPS (TLS) encryption for all data in transit
    • Data is stored with our database hosting provider, and access is restricted to the people who run DefiPOS
    • We store only public wallet addresses, never private keys or seed phrases
    • No plaintext password storage (bcrypt hashing)
    • Sign-in cookies are httpOnly, so scripts running on the page cannot read them
    • Minimal attack surface due to minimal data collection

    Your Rights

    • Access: Ask us for a copy of the data we hold about you
    • Deletion: Email us at [email protected] to delete your account and associated data
    • Export: Ask us for a copy of your transaction history (if logging is on)
    • Opt-Out: Disable transaction logging at any time
    • Portability: Ask us for your data in a standard, machine-readable format

    Cookies and Analytics

    We use essential cookies to keep you signed in; blocking them will prevent you from signing in. Our website and web app also use Google Analytics 4, a service provided by Google, to understand how DefiPOS is used so we can improve it. It records things like the pages you view (including the page address), how you arrived, your device and browser type, and your approximate location (country and city). It sets cookies named _ga and _ga_XMSF7ZEJJN, which last up to 2 years. Google processes this data, including your IP address; see Google's privacy policy (policies.google.com/privacy). You can block these cookies in your browser settings or install Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout). We do not use advertising, remarketing or social-media cookies.

    Legal Compliance

    We will only disclose user data when:

    • Required by valid legal process (court order, subpoena)
    • Necessary to prevent imminent harm or illegal activity
    • You explicitly consent to disclosure

    We will notify affected users of legal requests unless prohibited by law.

    Children's Privacy

    DefiPOS is not intended for users under 18 years of age. We do not knowingly collect information from children.

    Changes to This Policy

    We may update this privacy policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email. Continued use of the service after changes constitutes acceptance.

    Contact Us

    DefiPOS is run by Crypto Enthusiasts based in Essex, England. Questions about privacy, or a request about your data? Contact us at [email protected]. If you write to us through our contact form, we store your name, email address and message so we can reply.