Privacy Policy

Last updated: September 27, 2026

This policy explains how xChanze ("we", "us") collects, uses and protects information when you use our website xchanze.com and our app xRetail: Shop & POS Manager ("the app"). If you have questions, contact [email protected].

1. Information we collect

Account information

Your name and email address, and either a password (stored only as a secure hash) or your Google account identity if you sign in with Google.

Business data you enter

Everything you record in the app to run your business: products, prices and stock, sales and invoices, purchases, customers and their dues, suppliers, expenses, team members and their roles, and messages between team members. This data belongs to your business.

Content you send

Images, files and voice messages you attach in team chat or support tickets.

Device and usage information

Your device identifier (Android ID, or identifierForVendor on iOS), device model, operating system and app version; your IP address; a history of sign-ins (time, method, device and IP address); and onboarding milestones (for example, when you created a business or made a first sale).

Diagnostics

Crash reports through Firebase Crashlytics, and short error reports sent by the app (the error message and the screen it happened on).

Notifications

A Firebase Cloud Messaging token so we can send you notifications (for example, new messages or low-stock alerts).

Purchases

If you buy the ad-free subscription, Google Play Billing tells us the purchase and its status. We never receive your card or payment details.

2. How we use information

  • To provide the app: store and sync your business data across your devices and team.
  • To keep accounts secure: detect suspicious sign-ins and prevent fraud and abuse.
  • To fix problems and improve the app, using crash and error reports.
  • To send notifications and service emails, such as email verification and password resets, team invitations, onboarding reminders that help you get set up, and replies to your support tickets.
  • To verify subscriptions and remove ads for subscribers.

3. Advertising

In the app: the free version shows ads from Google AdMob. Where required, the app first asks for your consent using Google's consent tool. AdMob may use your device's advertising ID to show and measure ads. You can reset or limit the advertising ID in your device settings, and control ad personalisation at Google Ad Settings.

On this website: there are no ads and no advertising or tracking cookies. The site is registered with Google AdSense only to verify ownership for the app's AdMob account; no ad code runs on it.

4. App permissions

  • Camera: used to scan barcodes. Images from scanning are not stored unless you choose to attach a photo.
  • Microphone: used only while you record a voice message.
  • Notifications: used to alert you about messages and activity.

5. Sharing

We do not sell personal information. We share it only with service providers that help us run the app, and only for that purpose:

  • Google: Firebase (crash reporting and notifications), AdMob (in-app ads), Google Play (subscriptions) and Google sign-in.
  • Our cloud hosting and email providers.
  • Our team's messaging service, Discord, where our internal alerts are posted so we can respond quickly. These alerts include diagnostic details (device model, operating system, app version, IP address and device identifier) and, when someone creates a new account, that account's email address.

We may disclose information if the law requires it.

6. Data retention

  • Chat attachments can be deleted automatically after a period you choose in the app.
  • Support-ticket attachments are deleted 30 days after the ticket is closed.
  • Uploads that are never attached to anything are deleted after 7 days.
  • Sign-in history (time, method, IP address and device details) and device records are security logs. They are kept after your account is deleted, to protect accounts and prevent fraud and abuse.
  • Other information is kept while your account or business is active.

7. Deleting your account

You can delete your account in the app at More → Delete account, or by emailing [email protected] from your account's email address.

When you delete your account, it is anonymised immediately: your name and email are removed, your password and Google sign-in are removed, and all your sessions are signed out. Security logs of past sign-ins are kept, as described in section 6.

Business data (such as sales, stock and customers) belongs to the business and may be used by other team members, so it is not removed when one person deletes their account. If you own a business and want it and all of its data deleted, email [email protected]. We will complete the deletion within 30 days and confirm by email.

8. Security

All connections use HTTPS encryption. Passwords are stored as secure hashes, access is controlled by roles per business and shop, and access to production systems is restricted to authorised staff.

9. Children

Our services are meant for businesses and are not directed at children under 13. We do not knowingly collect information from children under 13.

10. Your rights

You can ask to access, correct or delete your personal information, or object to how we use it, by emailing [email protected]. We will respond within 30 days.

11. Changes to this policy

We may update this policy. We will change the "Last updated" date above and, for significant changes, notify you in the app.

12. Contact

xChanze, Dhaka, Bangladesh. Email: [email protected].