Legal notice: This document requires review by qualified counsel before public launch.

Privacy Policy

Last updated: 9 November 2026

1. Who We Are

CogsHelper is operated by 1134 Digital LLC, a Florida limited liability company in the United States. This policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

We collect the following categories of data:

Account information: your name, email address, and hashed password.
Inventory and listing data: records, prices, descriptions, images, and location notes you enter.
Integration credentials: the keys for the services you connect (Discogs, WooCommerce, Shopify, eBay, Square, Stripe), stored encrypted.
Shop records: when a shop uses CogsHelper as its till and back office, the records it keeps about its customers and staff: customer names and contact details, delivery addresses, purchase history, receipts (including the card type, last four digits and cardholder name a card payment returns), loyalty points, store credit and gift cards, marketing permissions, and staff names, PIN codes (stored scrambled, never readable), hours and till actions. The shop decides what it records and why.
Payment and channel references: order and payment numbers from Square, Stripe, Shopify, WooCommerce, Discogs and eBay, so a sale can be matched to its payment and listing.
Usage data: log entries, error reports, crash reports from the phone apps, and session metadata used to operate and improve the service.
Device and browser information: browser type, IP address, and user-agent string for security and fraud prevention.

3. How We Use Your Data

We use your data to:

Provide, maintain, and improve the CogsHelper service.
Send transactional emails (account verification, password resets, billing receipts).
Detect and prevent fraud, abuse, and security incidents.
Comply with legal obligations.

We do not use your data to serve advertising, and we do not sell or rent your data to third parties.

4. Data Sharing

CogsHelper runs in the United States. We share data only with the services needed to operate it:

Resend: email delivery, including account emails, receipts and a shop's marketing emails.
Cloudflare: bot checks on sign-up forms, and delivery of our website and web app.
Stripe: billing for CogsHelper subscriptions.
Railway: server and database hosting, in the United States.
Cloudflare R2: storage for photos and files you upload.
Google Firebase: phone notifications and phone-app crash reports. Web notifications go through your browser's own push service (for example Google, Mozilla or Apple).
Google and Apple: sign-in, when you choose to sign in with them. Google Places also powers the record store finder.
Square, Stripe, Shopify, WooCommerce, Discogs and eBay: at your direction, when you connect them to take payments or sell.

Each of these services has its own privacy policy. Our hosting, email, storage and notification providers process data to provide their service to us. Payment, sign-in and selling services you connect also handle the data under their own terms, for their own purposes such as preventing fraud.

Other CogsHelper users. Friends you accept can see your Daily trivia scores, with your display name or @handle. You can turn this off at any time in your profile privacy settings ("Show my Daily scores to friends").

Friends you accept can see your earned badge levels by default. You can turn this off at any time in your profile privacy settings (“Show my badges to friends”).

5. Cookies and Local Storage

CogsHelper uses an HttpOnly session cookie, lasting up to 30 days, to keep you signed in to the web application. We do not use cookies for advertising or tracking. We keep your access token in memory only (not localStorage) to reduce XSS exposure. The web app keeps changes made while offline in the browser until it can send them, and a computer set up as a register keeps its own register sign-in in the browser.

6. Data Retention

We keep your account and inventory data while your account is active. To delete your account, use Settings → GDPR on the website, the phone app, or email us. On the website we email you a link, and your account is deleted as soon as you open it and confirm. In the phone app it is switched off at once and deleted after 30 days. A shop's only owner must email us first, and records that must be kept, such as a shop's finished sales and tax records, can stop or delay deletion. When a shop removes a customer, their contact details are removed from the customer list, but their name, the email address a receipt was sent to and the cardholder name on a card receipt can stay on past sales and invoices, which are financial records. Email [email protected] and we will tell you what remains and why.

7. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data. Shop owners can download their account data in Settings → GDPR on the website. You can delete your account there or in the phone app. Anyone can also email [email protected].

8. Security

Connections to CogsHelper's servers use HTTPS. Passwords and staff PIN codes are stored scrambled (hashed) so nobody can read them, and the keys for services you connect are stored encrypted. No system is perfectly secure; please use a strong unique password and notify us immediately if you suspect unauthorized access to your account.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email. Your continued use of CogsHelper after changes are posted constitutes your acceptance of the updated policy.

10. United Kingdom

This section adds to the rest of this policy for shops in the United Kingdom and for people in the UK whose data CogsHelper holds.

Who is responsible. 1134 Digital LLC is the controller of CogsHelper's own records: accounts, subscriptions, support emails, security logs and this website. When a shop uses CogsHelper for its customers and staff, the shop is the controller of those records and we handle them for the shop under our UK Data Processing Agreement. If your question is about a shop's records of you, ask the shop. If you email us instead, we pass your request to the shop.

UK representative. We will name our UK representative here, with a UK postal address and email, before we accept shops in the UK.

Why we use your data (lawful basis).

Your account, your subscription and the support you ask for: to provide the service you signed up for (contract).
Staff sign-in for a shop, keeping accounts secure, finding faults and handling disputes: our legitimate interest in running a safe, working service, weighed against your rights.
Records the law requires us to keep: legal obligation.
Optional features that ask your permission first: consent, which you can withdraw at any time. Withdrawing it does not affect what we did before.

To have an account you need to give an email address and a password, or sign in with Google or Apple, and a paid plan needs billing details. Without these we cannot provide the account. Everything else you give us is optional.

We do not make decisions about you by automated means alone that have legal or similarly significant effects.

Sending data to the United States. CogsHelper is run from the United States and its servers are there, so UK data is sent to the US. The UK has not decided that the United States as a whole protects data adequately, and we are not certified under the UK-US data bridge, so we rely on the safeguards below. For a UK shop's records we use the UK's International Data Transfer Agreement, which is part of our UK Data Processing Agreement. The providers in section 4 may also handle data in the US and other countries. Information you give us yourself, such as your account details, goes straight from you to CogsHelper in the United States. Railway, Cloudflare, Resend, Google and Stripe, which handle it for us, are certified under the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), and that is the safeguard for what we pass to them. Email [email protected] for a copy of these safeguards.

How long we keep data.

Your account: while it is open. Deleted as soon as you confirm on the website, or after 30 days if you delete it in the phone app, as section 6 explains.
A UK shop's records: while the shop uses CogsHelper. When the shop leaves, we give it a copy and delete its records within 90 days, unless it asks us in writing to keep its sales records for it.
Marketing opt-outs: kept, so that a person who said no is not sent marketing again, even after a shop removes them as a customer.
Our record of data breaches: 6 years.
Security logs and support emails: while we need them to keep accounts secure, fix faults or answer the person who wrote to us. We review them at least once a year and delete what is no longer needed.

Your rights. You can ask to see, correct or delete your data, to limit how we use it, to object to our use based on legitimate interests, and to get a copy you can take elsewhere. You can withdraw consent at any time and object to direct marketing at any time. Email [email protected]; you do not need special wording or a form. We may need to check who you are. A request is normally free, and we reply within one month. If a request is complex we can take up to two more months, and we will tell you within the first month.

Complaints. To complain about how we handle your data, email [email protected]. We acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome without undue delay. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

11. Contact

Questions about this policy? Email us at [email protected].