Privacy Policy
TishTush website & mobile app (Android & iOS) · Effective October 15, 2026
TishTush is the business platform for independent skincare shops, med spas, and service businesses: CRM, point of sale, front-desk answering (Sophie), customer messaging (TishTush Lines), and marketing tools in one app. Retail locations using TishTush are independently owned and managed by third parties — TishTush does not own, lease, manage, or operate any retail location. This policy explains what data the platform handles and why.
About this website: tishtushpos.com is a static site. It contains no contact form. It sets two first-party cookies, listed under The benefits of cookies below. It counts visits with our own self-hosted, cookieless counter (Umami) — page views only: no personal data, no cross-site tracking, nothing sold or shared. When you follow a link to book a visit, the booking page asks only for the details needed to book (name, phone, email, service address, and the problem), and handles them under this same policy.
The benefits of cookies
About this website: tishtushpos.com is a static site. It contains no contact form. It sets exactly two cookies — both first-party, both with a real job, neither for advertising:
- tt_consent — remembers the choice you make in the cookie banner (accept or decline) for 12 months, so the site doesn’t ask on every page. It is set the moment you answer the banner, and it is the only cookie a visitor who declines ever gets.
- tt_chat — set only if you use the chat on this site and have accepted cookies. It holds a random chat number so your conversation keeps its thread. It is a session cookie: your browser drops it when the session ends. Decline, and the chat still works — it just keeps its thread in memory for that visit instead of in a cookie.
That’s the whole list. The site counts visits with our own self-hosted, cookieless counter (Umami) — page views only: no personal data, no cross-site tracking, nothing sold or shared. If you decline, the only cookie stored is tt_consent itself, recording the decline. When you follow a link to book a visit, the booking page asks only for the details needed to book (name, phone, email, service address, and the problem), and handles them under this same policy.
Whose data the app holds
The app is a tool for a business and its team. Most of the data in it belongs to the business: the business owns its data — its customer lists, appointments, orders, and messages. TishTush processes that data only to run the platform for the business that entered it.
Data the app collects and uses
- Business and account information — business name, team members, and the settings the business configures in the app.
- Customer records the business enters — names, phone numbers, email addresses, appointment and service history, orders, and notes, entered by the business into its own CRM. This data goes to the business's configured TishTush backend and nowhere else.
- Photos — job and work photos the team takes inside the CRM (for example waivers and completed work) are stored with the business's records.
- Camera for QR codes — the wallet's scan-to-pay reads QR codes using on-device barcode scanning (Google ML Kit). Scanned code contents are processed on the device to fill in a payment form; the scanner does not upload camera images.
- Push notification token — if the owner enables notifications in Settings, the app registers a Firebase Cloud Messaging (Google) device token so alerts (a new lead, a missed call) can be delivered. Nothing is registered until the owner opts in.
- On-device settings — the backend address, host key, and wallet handle the owner enters are stored on the device. They are not analytics and are not sent anywhere except the backend the owner configured.
TishTush Lines (messaging)
When a business connects a WhatsApp number or business email through TishTush Lines, conversations with that business's customers are managed on the business's behalf, under the business's own name, through the official WhatsApp Business API and the business's email provider. Message content is processed to answer questions, follow up, and send reminders the business has approved. Meta and Google process those messages as the platforms carrying them.
Payments
Card payments switch on when Stripe activation completes — an owner step we walk you through; until then, bills are paid over the phone. When card payments are on, card details are handled by Stripe and never touch TishTush servers or the app. TishTush receives transaction records (amounts, status, timestamps) so the business's books stay in sync.
What we do not do
- We do not sell personal data — not the business's, not its customers'.
- We do not use app data for third-party advertising, and the app contains no advertising trackers.
- We do not access your location, contacts, microphone, or files. The app requests only internet, camera, and notification permissions.
Sharing
Data is shared only with the processors needed to run the features the business uses: Google Firebase (push delivery), Stripe (payments), Meta (WhatsApp Business), and the business's own email provider — each acting on the business's behalf. We disclose data if required by law.
Retention, export, and deletion
A business can export its data at any time, including when it cancels — the data is theirs. On cancellation or a verified deletion request, business data is deleted from production systems within 30 days, except records we must keep for legal or accounting reasons. Customers of a business who want their record corrected or deleted should contact that business, or write to us and we will route the request.
Security
Data moves between the app and the backend over encrypted (HTTPS/TLS) connections. Access to backend data is gated by the business's own credentials and host keys.
Children
TishTush is a business tool. It is not directed at children, and we do not knowingly collect data from children under 13.
Changes
If this policy changes materially, we will note the change here and update the effective date.
Contact
Privacy questions: tishtush.agent@gmail.com