Privacy, Permissions & App Safety
This page exists so you can check exactly what ShopMate POS does before you install it — without reading any source code. If anything here does not match what the app actually does, email us and we will fix the page or the app.
1. What this app is
ShopMate POS is a point-of-sale and store-management app. You create a store account, add your products and customers, and ring up sales. It is a normal Android app — it is not a browser, a launcher, or a system tool, and it does not modify anything else on your phone.
It is distributed as an APK from this website rather than through the Google Play Store, so it is signed by us directly and you can verify that yourself. See section 6.
2. What stays on your device
Your products, sales, customers, credit ledger and settings are stored in a local database inside the app's private storage. On a normal Android install this area is readable only by ShopMate POS and is not visible to other apps.
Uninstalling the app deletes this local data.
3. What leaves your device
If you sign in, your store data is synchronised to Google Firebase so it can be restored on another device. Concretely, the app sends:
- the email address and password hash you chose when signing up;
- your store name;
- the products, sales and customer records you create.
We do not run advertising, we do not build a profile of you, we do not sell data to anyone, and we do not collect your contacts, photos, SMS, location or call logs. We cannot read what is in your store.
Sync is optional and happens only when you are online. The app is offline-first, so it works fully without a connection.
4. Android permissions, and why each one is needed
The app requests exactly nine permissions. None of them is optional-by-accident, and none grants access to your personal content.
| Permission | Why |
|---|---|
INTERNET |
Cloud sync of your store data, and nothing else. No browsing, no ads. |
ACCESS_NETWORK_STATE |
Detects whether you are online so sync can resume without error popups. |
CAMERA |
Scanning product barcodes. The camera is used only while the scanner is open. |
BLUETOOTH, BLUETOOTH_ADMIN,BLUETOOTH_CONNECT, BLUETOOTH_SCAN |
Printing receipts on a Bluetooth thermal printer. No other Bluetooth use. |
READ_GSERVICES |
Firebase's own check that Google Play services are present before syncing. |
DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION |
An internal AndroidX guard flag. It grants no access to anything. |
Notably, the app does not request contacts, SMS, microphone, location, phone state, or the ability to install other apps. If a build of ShopMate POS ever asks for any of those, it is not ours — please report it.
5. Ads and tracking
None. The app contains no advertising SDK, no analytics SDK, and no third-party tracker. It makes no network request other than to your own Firebase project.
6. How to verify you got the real file
Anyone could put a file called "ShopMatePOS.apk" on a website. These two checks let you prove this one is ours.
Check A — the SHA-256 checksum
After downloading, run:
sha256sum ShopMatePOS-1.3.apk
The result must equal c0e52b94ea2cf2b639f3aaf1db0b10e282730c575379468167be904251c5ca48. A single different character means the file is not the one described here.
The same value is published at SHA256SUMS.txt so you are not taking our word for it from the same page that served the file.
Check B — the signing certificate (jmgcdev.jks)
Android will refuse to install an APK that is not signed, and will refuse to install an update signed by a different key. To see who signed yours:
apksigner verify --print-certs ShopMatePOS-1.3.apk
The binary is signed using our official release keystore (jmgcdev.jks, key alias jmgcdev).
The certificate details and fingerprints are:
| Certificate Owner | CN=jan reil daguil, OU=jmgc, O=jmgc, L=cebu city, ST=cebu, C=63 |
| Keystore File & Alias | jmgcdev.jks (alias: jmgcdev) |
| SHA-256 Fingerprint | 5C:A2:BF:D6:FD:B7:4C:B3:49:EB:36:21:30:2B:2E:47:7C:EF:02:8E:A2:CD:93:5C:CD:A4:D3:33:14:32:F2:3E |
| SHA-1 Fingerprint | F2:95:A3:7C:06:7F:AD:E0:DE:E8:D9:E2:F1:13:05:E7:03:68:82:F2 |
7. Reporting a problem
Found something wrong, or a build behaving differently from this page? Tell us:
- Email jmgc.care95@gmail.com
- Include your device model, Android version, and the app version from Settings.
We investigate reports of unwanted behaviour and remove any build that turns out to misrepresent what it does. You can also report a problem to Google directly at Google Safe Browsing.
8. Changes to this policy
If the app's behaviour changes in a way that affects your data or the permissions it needs, this page is updated before the new build is published, and the "Last updated" date above changes.