Qiksy Shelf: Privacy Policy

Last updated: 5 October 2026

Who we are

Qiksy Shelf is a phone app for small shops: stock by expiry date, receiving by barcode, a till, and reports. It is operated by Dmytro Liesniak, sole proprietor (ФОП), Ukraine, registered in the Ukrainian state register (ЄДР) as Liesniak Dmytro Volodymyrovych, D-U-N-S 66-768-5166, trading as Qiksy. Contact: [email protected], in any language the app speaks.

This policy covers the Qiksy Shelf app for Android and iPhone and its web version at qiksy.app/shelf/.

What stays on your phone

• Your stock, sales and settings. Products, batches, expiry dates, prices, sales, write-offs and reports are kept in the app’s own storage on the phone and work with no internet. Uninstalling the app, or Settings → Your data → Erase everything on this phone, removes them.
• Barcodes. The camera picture is decoded on the phone. When you receive a product the shop does not have yet, and the AI has not named it, the phone asks Open Food Facts (world.openfoodfacts.org), an open product database, for its name by the barcode. That request carries the barcode and your phone’s internet address, and nothing about your shop.
• Product photos from Open Food Facts. When you choose From the database for a product’s photo, the phone downloads that product’s front picture from Open Food Facts (images.openfoodfacts.org). The request carries the barcode and your phone’s internet address. Those pictures are shared under the CC BY-SA licence: if such a photo goes to your Shopify store, the product’s description names Open Food Facts under it.
• Expiry reminders. They are scheduled on the phone itself. There is no push server.

The cloud, if you turn it on

The cloud is optional. It keeps the stock safe if the phone is lost and lets several sellers work in one shop. Every product, batch, sale and the shop’s name are encrypted on the phone with AES-GCM before they are sent. The key stays with you (the recovery key, or a passkey on your devices) and never reaches our server, so what we store is unreadable to us. The register’s and the bank’s keys are the one exception, described below.

What our server does know, and keeps while your account exists:

• your e-mail address, and the date you first signed in;
• which shop you belong to, your role in it (owner or seller), and the e-mail addresses of its members;
• how many encrypted records the shop holds, when they changed, and which member changed each one last;
• for 30 days, the earlier encrypted copy of a record a member changed or deleted, so that an owner who removes a seller can take back what that seller did. We cannot read these copies either;
• for Face ID or fingerprint sign-in: the passkey’s public key, and the shop key wrapped by a secret only your passkey can produce, which we cannot open;
• the shop’s subscription: the plan and the date it is paid until;
• the register’s and the bank’s keys, if the owner connected them (see below).

Sign-in codes are sent by e-mail through Cloudflare Email Service, with Resend as a fallback, and stop working after 10 minutes. To stop abuse we count sign-in requests per address and per network for one hour, using one-way hashes, not the addresses themselves. An invitation link for a seller works for 7 days.

Reading a package with AI

When you ask the app to read a package, the photos you take or choose are sent through our server to Google’s Gemini API, which returns the name, brand, size and expiry date it sees. The smart camera does the same by itself while it is open: about once a second it sends a frame of what you hold up, at most fourteen per product, and stops when it has read it or when you close it. We do not store the photos or the answer. We use Gemini as a paid service, under Google’s terms for which the content is not used to improve Google’s products; Google may keep it for a limited time to detect abuse.

To keep the service within its daily limit we count reads for 24 hours: per shop for a shop in the cloud, and for a phone on its own per phone (a random number the app makes, which names no person) and per network, as a one-way hash of the address.

Fiscal receipts and card payments

If you connect a fiscal register (Checkbox in Ukraine, Webkassa in Kazakhstan) or a bank for QR payments (monobank in Ukraine, Halyk Bank in Kazakhstan), where the keys you enter are kept depends on the shop:

• A shop on one phone keeps them on that phone. For each sale the app sends the receipt lines, the amount and the keys to the provider through our server, which passes the call on and keeps nothing.
• A shop in the cloud keeps them on our server, encrypted with AES-GCM under a key that only our server holds, separate for every shop. Only the owner can connect, change or remove them. Every phone of the shop uses them for its sales, and no phone, a seller’s included, ever receives them. For each sale the app sends the receipt lines and the amount; our server adds the keys, passes the call on and keeps nothing of the receipt. Disconnecting the register or the bank, or deleting the account, deletes the keys.

To stop abuse, a phone on its own connecting a register or a bank, and its Webkassa calls, are counted per network for the day, as a one-way hash of the address. From then on the provider handles the receipt and the payment under its own privacy policy.

Your online store (Shopify)

If the owner links a Shopify store, our server keeps: the store’s address; the access keys Shopify gives the app (they are renewed every day); which Shelf shop the store is linked to; which Shopify product and variant each barcode belongs to; which products Qiksy Shelf itself created in the store; and, when the store pays for Qiksy Shelf through Shopify, the date its subscription runs until.

What comes from Shopify. Shopify notifies our server of each new order and each refund that puts goods back on sale: its number and its lines (barcode, quantity, product title). Shopify sends us no customer’s name, e-mail, address or phone at all. It also tells us the id of each product added, changed or deleted in the store. These lines wait on our server until a phone of the shop takes them, at most 14 days. When the owner lays out the shelf from the store, the phone reads the store’s catalogue through our server: titles, barcodes, prices, quantities, the product picture, and the expiry date if the store keeps one in a field of its own. Nothing of the catalogue is stored on our server.

What goes to Shopify. As stock is received, sold or written off, the phone sends the change in quantity for each barcode. When the owner chooses Send to Shopify for a product, the phone sends that product’s name, brand, sale price (only when the store uses the same currency), quantity, photo, and the label text and nutrition table read from its package. Updating a product or taking it off sale sends only what the owner confirmed. Purchase costs, batches, expiry dates, the till’s sales and everything else stay on the phone.

The store’s customers. We keep no personal data of the store’s customers. When Shopify asks us to delete a customer’s data, we delete the orders it names; when it asks what we hold about a customer, the answer is nothing.

Ending the link. Removing the app in Shopify, Disconnect on the app’s page in the Shopify admin, unlinking in Qiksy Shelf, or deleting the account ends the link. Removing the app deletes everything we kept about the store at once.

Buying the subscription

The subscription is bought on qiksy.app, not inside the app. The payment is taken by monobank (plata by mono); we never see the card. We keep the e-mail address, the plan, the amount and the invoice, as Ukrainian accounting law requires. A notice of each payment, with the e-mail address and the plan, goes to our own Telegram account.

A shop linked to a Shopify store pays through Shopify instead, on the store’s Shopify bill. Shopify takes the payment; our server only asks Shopify whether the store’s subscription is active and until when.

Analytics and advertising

The installed app contains no analytics, no advertising and no tracking. The web version at qiksy.app/shelf/ is counted like the rest of the site, with cookieless Google Analytics and Cloudflare Web Analytics: pages and visits, no profile of you.

Where it runs

Our server is a Cloudflare Worker, and the cloud is stored in Cloudflare Durable Objects. Cloudflare runs our server in its global network, so data may be processed outside Ukraine and the European Union. Cloudflare, Resend, Google and Telegram process data for us only to provide these services. We sell nothing to anyone.

Deleting your account

In the app: Settings → Stock in the cloud → Delete account. The same button is in the web version after you sign in. If you are the owner, the shop is deleted from the cloud for good, with its records, its sellers and its subscription. If you are a seller, you leave the shop and your address is deleted. Nobody, us included, can restore a deleted shop. You can also write to [email protected] from the address you sign in with, and we delete the account within 30 days. Payment records stay for as long as the law requires.

Children

Qiksy Shelf is a tool for shops and is not meant for children.

Changes to this policy

A change moves the date at the top. If the app ever starts sending something new, this page says so before the update ships.