Privacy Policy — Hibiko
Effective date: 30 September 2026 Last updated: 30 September 2026
Who we are
Hibiko (ဟီဘီကို) is a sales-record app for shops in Myanmar, made by Kaung Htet (trading as Hibiko).
- Viber: +95 9 404 202 140
- Email: hibikopos@gmail.com
- City: Kanchanaburi, Thailand
If you have a question about your data, message us on Viber or email. A person answers.
The short version
- Your sales records live on your phone first. The app works with no internet.
- If you sign in, a copy is synced to our server so you do not lose your shop when you lose your phone.
- We do not sell your data, we do not show ads, and there is no advertising or analytics tracking in the app.
- The names and phone numbers of your customers that you type into the owe book belong to you and your customers. We store them so the app works across your devices. We never contact them and we never sell them.
- You can delete your account, and everything in it, from inside the app at any time. See Deleting your data.
What we collect
1. Your account
Collected when you create an account and required for the app to work.
| Data | Why |
|---|---|
| How you sign in: a mobile number, an email address, or your Google account | This is your login. For a mobile number we send a one-time code (OTP) by SMS; for email, a one-time code by email; for Google, Google confirms it is you. |
| Shop name (Burmese and/or English) | Shown in the app and printed on receipts. |
| Owner name | Shown in the app; printed on receipts if you choose. |
| Email address | If you sign in with email or Google, or add one for account recovery. |
| Password | Optional, and only if you set one. Stored as a bcrypt hash — we cannot read it. |
| Shop address, receipt footer, receipt phone number, timezone, currency | Shop settings, mostly printed on your receipts. |
| Shop logo | Optional, if you upload one for receipts. |
2. Your shop's records
Created by you as you use the app, kept on the phone, and copied to our server when your device syncs:
Products and categories · sales and refunds · discounts · stock levels, adjustments and stock-takes · expiry dates · suppliers, payables and goods receipts · expenses · cash shifts, drawer movements and Z-reports · your payment QR settings.
3. Your customers' data — please read this part
If you use the customer list or the owe book (အကြွေးစာရင်း), you type in:
- the customer's name
- optionally their phone number
- optionally your own notes about them
- what they owe you, what they have paid, and when
These are your customers, not ours. You decided to record them; you are responsible for telling them that you keep a record, and for being fair and accurate about what you write. We store this information only so that the owe book works and so that it survives on your other device or a new phone. We do not contact your customers, we do not market to them, and we never sell or share this information with anyone.
When you send a payment reminder over Viber, you send it, from your own Viber, in your own words. The app only prepares the message.
If a customer asks you to remove their record, you can delete it in the app.
4. Staff
If you add staff, we store each person's name and a hash of their PIN (not the PIN itself), plus which sales and shifts belong to them. Please tell your staff that the app records who rang up each sale — it is one of the reasons shops use it.
5. Your device, and keeping the account safe
| Data | Why |
|---|---|
| A device identifier | So your subscription works on the right devices, and so you can see and remove a device you no longer use. |
| Notification token | Only if you allow notifications, so we can send you things like a licence confirmation. |
| Sign-in attempts and OTP attempts, with time and result | To stop other people breaking into your shop's account, and to stop abuse of our SMS. |
| App version, and technical error reports | To fix crashes. |
6. What we do not collect
- No location. The app never asks for it.
- No contacts. The app never reads your phone's address book.
- No advertising identifier, no ad networks, no ad profiling. There are no ads in Hibiko.
- No photographs from your camera. The camera is used to read barcodes, and the image is discarded immediately — it is never saved or uploaded. See Permissions below.
Permissions the app asks for, and why
| Permission | What it is genuinely for |
|---|---|
| Camera | Scanning barcodes. The picture is processed on the phone to read the barcode and then thrown away. Nothing is stored or sent. |
| Bluetooth (connect / scan) | Finding and printing to your thermal receipt printer. Nothing else. |
| Photos / storage | Only when you choose a shop logo, or save or share a receipt image. |
| Internet, network state | Syncing, and knowing whether you are offline so the app can queue your work. |
If you refuse any of these, the rest of the app still works.
Where your data is kept
- On your phone, in a local database. This is the copy the app uses to sell, which is why it works with no signal.
- On our server, hosted in Singapore, if you are signed in. Traffic between the app and the server is encrypted (HTTPS).
- We run Hibiko from Thailand. When we look after the server or answer a support request, we reach your data from there, over an encrypted connection. It is not copied anywhere else.
Who else sees it
We use a small number of outside services. Each one receives only what it needs.
| Service | What it receives | What for |
|---|---|---|
| Twilio | Your mobile number and the one-time code | Sending the login SMS |
| Google Sign-In | Only if you choose it. Google tells us your email address, whether Google has verified it, and your Google profile name. We never see your Google password. | Your email identifies your account; your profile name is saved as the owner name. We sign you in only if Google has verified the email. |
| Google Firebase | A notification token; crash reports; basic device information | Sending you notifications, and telling us when the app crashes |
| Our hosting provider | Everything above, as the machine it runs on | Running the service |
We do not sell your data to anyone, ever. We do not share it with other shops, with advertisers, or with data brokers.
We will only give your data to the authorities if we are required to by law, and we will tell you unless we are forbidden from doing so.
How long we keep it
- While your account is open, we keep your shop's records so that they are there when you open the app.
- Payment records (your transfers to us for Pro) are kept for 180 days, then removed automatically.
- Sign-in and OTP attempt logs are short-lived and cleared automatically.
- After you ask us to delete your account, see below.
Deleting your data
You can delete your account and everything in it, at any time.
In the app: Settings → Account & security → Delete account. You confirm with your PIN. Your shop is deleted from our server straight away, and this phone's copy is wiped at the same moment. Any other phone signed in to your shop is signed out.
If you can no longer open the app (lost phone, uninstalled): message us on Viber at +95 9 404 202 140 or email hibikopos@gmail.com from the number or address on the account, and say you want it deleted. We will delete it within 30 days and tell you when it is done. The same instructions are at hibikopos.com/delete-account.
What is deleted: your shop profile, sales and refunds, products, stock, customers and the owe book, suppliers and payables, expenses, shifts and Z-reports, staff, devices, licences, your payment QR settings, and the records of sign-in and OTP attempts.
What we keep:
- Proof of payments you made to us for Pro. Removed automatically after 180 days.
- Our own log of actions we took on the account (for example, issuing a licence), which we keep for security and accounting.
Export first. Once it is gone, it is gone — we cannot restore it. Use Settings → Export Data to keep a copy of your sales first.
Keeping it safe
- Traffic between the app and our server is encrypted.
- Passwords are stored as bcrypt hashes; staff PINs are stored hashed. We cannot read either.
- Sign-in sessions can be revoked, and you can see and remove the devices on your account.
- Repeated wrong PIN entries lock the screen.
No system is perfect. If something does go wrong and your data is affected, we will tell you using the phone number or email on your account.
Children
Hibiko is a tool for running a business and is not directed at children. Do not create an account for anyone under 18.
Changes to this policy
If we change it, we will update the date at the top and — for anything that matters — tell you in the app or on Viber. We will not quietly reduce your rights.
Contact
Viber +95 9 404 202 140 · hibikopos@gmail.com · Hibiko, Kanchanaburi, Thailand.
You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Message us and a person will answer.