TillCaptainTillCaptain is a point-of-sale, stock and accounts app for shops. You use it in a web browser at tillcaptain.marlysoft.com or as a Windows app. Both are clients of an online service run by MarlySoft (operated by Zakarya Atef, Egypt; “MarlySoft”, “we”, “us”). What you enter in the app is sent to that service and stored on our servers. This policy explains what is stored, why, who else can receive it, and how to have it deleted.
In short
- What your shop enters is stored on servers operated by MarlySoft.
- The connection is encrypted (HTTPS) and reaches our servers through Cloudflare, our network provider.
- No advertising, no third-party analytics or tracking, and we never sell personal data.
- You can delete your account in the app, or ask us to delete your data at support@marlysoft.com.
Where the data is kept
The data is stored on servers operated by MarlySoft: in a SQL Server database and, for photos and documents, in files on the same servers.
The web app and the Windows app reach these servers at https://tillcaptain.marlysoft.com over an encrypted HTTPS connection. We use Cloudflare as our network provider: it runs the DNS of marlysoft.com, your device's encrypted connection ends at Cloudflare's network, and Cloudflare forwards it to our servers through an encrypted Cloudflare Tunnel. Cloudflare therefore processes this traffic, including your device's IP address, as our network provider. How Cloudflare handles data is described in Cloudflare's privacy policy.
The web app loads its code, fonts and images from that address. Only when it has to show a character its own fonts lack (an emoji, for example) does your browser download a font file from Google Fonts (fonts.gstatic.com); Google then receives your device's IP address, but nothing you type in the app.
The app can also be connected to another server (Change server on the sign-in screen), for example one a business runs for itself. Data on such a server is controlled by whoever runs it; this policy covers only our service.
Your account
When you sign up, or a shop administrator adds you, the service stores:
- Your name, and the email address or mobile number you sign in with.
- Your password, only as a salted one-way hash (PBKDF2, the ASP.NET Core Identity password hasher). Nobody can read it back, including us.
- Whether you have confirmed your email address or mobile number. One-time codes sent to you are stored only as hashes and expire.
- If you turn on two-step sign-in: the authenticator secret, stored encrypted (AES-256-GCM), and your recovery codes, stored as hashes.
- The language your app uses, so messages the server sends you are in your language.
- When the account was created. Each sign-in to a shop is recorded in that shop's activity log (which user, when).
Signing in gives the app a signed token that expires after 12 hours. Changing your password or signing out on all other devices ends your other sessions. Your device's IP address is used only in memory, to limit sign-in attempts against password guessing; it is not stored with your account.
What the shop enters
A shop uses TillCaptain to run its business, so the service stores what the shop's staff enter, for example:
- Products, prices, barcodes, stock in each branch, stock transfers and counts.
- Sales and purchase invoices, returns, payments, the cash box, expenses and cashier shifts.
- Customers and suppliers: names, phone numbers, addresses, email addresses, balances, credit limits and instalment plans, and the tax details of business customers for e-invoices.
- Staff: the shop's users, with their roles, permissions and branches.
- An activity log of who did what, kept for as long as the shop chooses.
The shop decides what it enters, and it is responsible for having its customers' consent where the law requires it. We process this data only to run the service for that shop: to store it, show it to the shop's own users, back it up and send the messages the shop asks for. We do not use it for anything else. Each shop's data is kept apart from every other shop's.
Stored on your device
- Settings: the server address, language, theme and printers, the email address or mobile number you last signed in with, and the last shop and branch you used.
- Your session token, so you stay signed in until you sign out.
- An offline copy, so the till keeps working without the internet: the branch's products and customers, and the sales, purchases, payments, expenses and quick-added customers made while offline, until they are sent to the server.
- Files you save yourself (PDF invoices and reports, spreadsheets, backup files) stay where you save them.
In the web app, the same things are kept in your browser's storage for tillcaptain.marlysoft.com. Uninstalling the Windows app removes its settings and offline copy from your computer; in a browser, clearing the site's data does the same.
Backups
The server makes an automatic backup of each shop every night and keeps the last 14. A backup holds the shop's data and files and its users' sign-in email address or mobile number, never a password. A shop's administrator can also download a backup file from the app (Backup & restore); that file is then in their hands, and they are responsible for keeping it safe.
Messages sent for you
The service can send emails, text messages (SMS) and WhatsApp messages: sign-in, verification and password-reset codes to you, notices about closing your shop, and, when the shop uses these features, messages to its customers, such as instalment reminders and emailed invoices.
These go through an outside provider only when one is set up on the server: an email (SMTP) server, Twilio or another SMS gateway, or Meta's WhatsApp Cloud API. That provider then receives the recipient's address or number and the text of the message. Today none of them is set up on our server, so no message leaves it: the server writes such messages to its log instead (see Logs below).
Sharing an invoice on WhatsApp from the app opens WhatsApp on your own device; the app does not send it for you.
Egyptian e-invoices and e-receipts
If a shop connects its Egyptian Tax Authority (ETA) e-invoice or e-receipt account in the app, the server sends that shop's invoices and receipts, with the buyer details the ETA requires, to the ETA's systems, as Egyptian tax rules require. The shop's ETA credentials are stored encrypted and are never put in backups.
Error reports
The app and the server can send crash reports to Sentry, an error-monitoring service, but only when that is switched on in their configuration. It is switched off on our servers, in the web app and in the Windows app, so no crash reports are sent anywhere. If we switch it on, we will update this policy first; the reports are set up to carry the error and technical details only, without request contents, cookies or user details.
Payments
The app is currently free: there are no plans, subscriptions or payments, and no payment provider is connected to our server.
Logs
The server keeps technical logs for 30 days: each request with its time, path and result and the number of the shop and user that made it, errors, and, while no message provider is set up, the messages described above. We use them only to keep the service running and to fix problems.
What we do not do
- No advertising.
- No third-party analytics, tracking or advertising tools, in the apps or on our website.
- We do not sell or rent personal data, and we share it only as this policy describes or when the law requires it.
Security
- The connection between the apps and our servers is encrypted (HTTPS), on its way through Cloudflare's network too.
- Passwords and one-time codes are stored only as hashes; two-step sign-in secrets are encrypted.
- Every query is limited to the signed-in shop, and SQL Server row-level security refuses one shop's rows to another even if a query forgot that limit.
- Sign-in attempts are limited, and permissions are checked by the server, not only by the app.
No system is perfectly secure. If you think your account or data is at risk, write to us at once at support@marlysoft.com.
Keeping and deleting data
We keep the data while the account and the shop are in use.
- Delete your account in the app: Settings → Account & security → Delete my account. Your sign-in is deleted at once. Each shop keeps your name on what you did (an invoice still shows who made it), but nobody can sign in with the account again. If you are the only person in a shop, that shop is closed with it; if you are its only administrator and others work there, make someone else an administrator first.
- Close a shop: its administrator uses Close the shop on the same screen. Everyone is signed out at once. The data is kept for 30 days in case you change your mind (write to us to restore it), then it is erased for good, together with the shop's files, messages and backups.
- By email: you can also ask us to delete your account or your shop's data at support@marlysoft.com. Write from the account's email address, or tell us the mobile number it uses, so we can check that the request is yours.
- Nightly backups roll off after 14 days and logs after 30 days, so data deleted inside a shop that stays open is gone from them within 30 days.
If you are a customer of a shop and want your details changed or removed, please ask the shop first, because it decides what it keeps; we will help it do so.
Children
TillCaptain is a business app for adults and is not directed at children. We do not knowingly create accounts for children.
Changes
If this policy changes, the new version will be published on this page with a new effective date.
Contact
MarlySoft (operated by Zakarya Atef, Egypt), developer of TillCaptain: support@marlysoft.com. Emails to this address pass through Cloudflare Email Routing and are delivered to our mailbox at Google (Gmail). See also TillCaptain support and the MarlySoft privacy policy for our website.