Qiksy Shelf: Privacy Policy

Last updated: 9 November 2026

In one line: your stock lives on your phone, and if you put it in our cloud, it is encrypted on the phone before it leaves. Its key is kept on our server, encrypted again with a key of our own, so that signing in on any of your devices opens your stock at once. We see the e-mail address you sign in with and who is in which shop; we do not look into your stock, sales or prices. If you connect a fiscal register or a bank, each receipt passes through our server on its way to them, and we keep nothing of it; a shop in the cloud also keeps the register’s and the bank’s keys with us, encrypted, so that its sellers can use them without ever holding them.

Who we are

Qiksy Shelf is a phone app for small shops: stock by expiry date, receiving by barcode, a till, and reports. It is operated by Dmytro Liesniak, sole proprietor (ФОП), Ukraine, registered in the Ukrainian state register (ЄДР) as Liesniak Dmytro Volodymyrovych, D-U-N-S 66-768-5166, trading as Qiksy. Contact: hello@qiksy.app, in any language the app speaks.

This policy covers the Qiksy Shelf app for Android and iPhone and its web version at shelf.qiksy.app.

What stays on your phone

Your stock, sales and settings. Products, batches, expiry dates, prices, sales, write-offs and reports are kept in the app’s own storage on the phone and work with no internet. Uninstalling the app, or Settings → Your data → Erase everything on this phone, removes them.
Barcodes. The camera picture is decoded on the phone. When you receive a product the shop does not have yet, and the AI has not named it, the phone asks Open Food Facts (world.openfoodfacts.org), an open product database, for its name by the barcode. That request carries the barcode and your phone’s internet address, and nothing about your shop.
Product photos from Open Food Facts. When you choose From the database for a product’s photo, the phone downloads that product’s front picture from Open Food Facts (images.openfoodfacts.org). The request carries the barcode and your phone’s internet address. Those pictures are shared under the CC BY-SA licence: if such a photo goes to your Shopify store, the product’s description names Open Food Facts under it.
Expiry reminders. They are scheduled on the phone itself. There is no push server.

The cloud, if you turn it on

The cloud is optional. It keeps the stock safe if the phone is lost and lets several sellers work in one shop. Every product, batch and sale, and the shop’s name (apart from the card of a shop under an e-mail with several shops, described below), are encrypted on the phone with AES-GCM before they are sent. Since 10 October 2026 the shop’s key is kept on our server as well, encrypted with AES-GCM under a key derived for each shop from a secret of ours that is never stored next to the data. A member who signs in gets the key back over an encrypted connection, so the stock opens on a new phone without typing a recovery key. Our server can therefore open a shop’s records; we do not do so, and only use them to run the service or where the law requires it.

What our server does know, and keeps while your account exists:

your e-mail address, and the date you first signed in;
if you sign in with Google or Apple: the e-mail address they confirm for you (with Apple it can be a private relay address). We check the sign-in’s signature and keep nothing else from it, except, for Google, the name and profile picture Google shares, shown to you in Settings, Account, and, for Apple, a token we hand back to Apple when you delete your account;
if a seller joins by the owner’s QR code instead: no e-mail at all, only the name the seller types, which the owner sees in the list of members;
the shop’s key, encrypted as described above;
which shop you belong to, your role in it (owner or seller), and the e-mail addresses (or names) of its members;
if one e-mail has several shops: each shop’s card for the list of your shops, which is its name, colour, kind (a shop, a stock room or a Shopify store) and a small logo if the owner adds one. The card is not encrypted, so that a phone can show your shops before it opens one. It is written only by the owner’s phone and shown only to the shop’s members;
how many encrypted records the shop holds, when they changed, and which member changed each one last;
for 30 days, the earlier encrypted copy of a record a member changed or deleted, so that an owner who removes a seller can take back what that seller did. They are encrypted the same way;
for Face ID or fingerprint sign-in: the passkey’s public key, and the shop key wrapped by a secret only your passkey can produce;
the conversation between a shop and its accountant, its messages and files, so that both can read it from any of their devices; only the shop’s owner and its accountant can open it, and it is not encrypted with the shop’s key the way the shop’s stock and sales are;
the shop’s subscription: the plan and the date it is paid until;
the register’s and the bank’s keys, if the owner connected them (see below).

Sign-in codes are sent by e-mail through Cloudflare Email Service, with Resend as a fallback, and stop working after 10 minutes. To stop abuse we count sign-in requests per address and per network for one hour, using one-way hashes, not the addresses themselves. An invitation link for a seller works for 7 days.

Reading a package with AI

When you ask the app to read a package, the photos you take or choose are sent through our server to Google’s Gemini API, which returns the name, brand, size and expiry date it sees. The smart camera does the same by itself while it is open: about once a second it sends a frame of what you hold up, at most fourteen per product, and stops when it has read it or when you close it. We do not store the photos or the answer. We use Gemini as a paid service, under Google’s terms for which the content is not used to improve Google’s products; Google may keep it for a limited time to detect abuse.

To keep the service within its daily limit we count reads for 24 hours: per shop for a shop in the cloud, and for a phone on its own per phone (a random number the app makes, which names no person) and per network, as a one-way hash of the address.

Fiscal receipts and card payments

If you connect a fiscal register (Checkbox in Ukraine, Webkassa in Kazakhstan) or a bank for QR payments (monobank in Ukraine, Halyk Bank in Kazakhstan), where the keys you enter are kept depends on the shop:

A shop on one phone keeps them on that phone. For each sale the app sends the receipt lines, the amount and the keys to the provider through our server, which passes the call on and keeps nothing.
A shop in the cloud keeps them on our server, encrypted with AES-GCM under a key that only our server holds, separate for every shop. Only the owner can connect, change or remove them. Every phone of the shop uses them for its sales, and no phone, a seller’s included, ever receives them. For each sale the app sends the receipt lines and the amount; our server adds the keys, passes the call on and keeps nothing of the receipt. Disconnecting the register or the bank, or deleting the account, deletes the keys.

To stop abuse, a phone on its own connecting a register or a bank, and its Webkassa calls, are counted per network for the day, as a one-way hash of the address. From then on the provider handles the receipt and the payment under its own privacy policy.

Your online store (Shopify)

If the owner links a Shopify store, our server keeps: the store’s address; the access keys Shopify gives the app (they are renewed every day); which Shelf shop the store is linked to; which Shopify product and variant each barcode belongs to; which products Qiksy Shelf itself created in the store; and, when the store pays for Qiksy Shelf through Shopify, the date its subscription runs until.

Who opened the app. When Qiksy Shelf opens in the store’s admin before the store is linked, Shopify tells our server who opened it: their e-mail address, whether Shopify has verified it, and whether they own the store. If they own it, the address is verified and they are not a staff member or an outside collaborator, the app offers to link the store to the Shelf stock kept under the same address, and a stock begun in the admin belongs to that address as well. We do not keep this answer; the stock’s owner gets an e-mail when a store is linked this way.

What comes from Shopify. Shopify notifies our server of each new order and each refund that puts goods back on sale: its number and its lines (barcode, quantity, product title), and, for an order that is shipped, the buyer’s name, phone and shipping address (see The store’s customers below). It also tells us the id of each product added, changed or deleted in the store. These lines wait on our server until a phone of the shop takes them, at most 14 days. When the owner lays out the shelf from the store, the phone reads the store’s catalogue through our server: titles, barcodes, prices, quantities, the product picture, and the expiry date if the store keeps one in a field of its own. Nothing of the catalogue is stored on our server.

What goes to Shopify. As stock is received, sold or written off, the phone sends the change in quantity for each barcode. When the owner chooses Send to Shopify for a product, the phone sends that product’s name, brand, sale price (only when the store uses the same currency), quantity, photo, and the label text and nutrition table read from its package. Updating a product or taking it off sale sends only what the owner confirmed. Purchase costs, batches, expiry dates, the till’s sales and everything else stay on the phone.

The store’s customers. For a Shopify store linked to Qiksy Shelf, the buyer’s name, phone and shipping address (city, street lines, postcode, region and country) of an online order that is shipped pass through our server to the shop’s phones, so that the shop can make the delivery waybill (Nova Poshta) for it. Nothing else about the customer is kept: no e-mail, no note, no customer account. Our server keeps these details only until a phone of the shop has collected the order, and at most 14 days; a sale at the Shopify POS brings none. When Shopify asks us to delete a customer’s data, we delete the orders it names together with these details; when it asks what we hold about a customer, it is these details of the named orders not yet collected, if any. On the shop’s phones the details stay with the order, like those of the shop’s other online orders, under the shop’s control.

Ending the link. Removing the app in Shopify, Disconnect on the app’s page in the Shopify admin, unlinking in Qiksy Shelf, or deleting the account ends the link. Removing the app deletes everything we kept about the store at once.

Buying the subscription

The subscription is bought on qiksy.app, not inside the app. The payment is taken by monobank (plata by mono); we never see the card. We keep the e-mail address, the plan, the amount and the invoice, as Ukrainian accounting law requires. A notice of each payment, with the e-mail address and the plan, goes to our own Telegram account.

A shop linked to a Shopify store pays through Shopify instead, on the store’s Shopify bill. Shopify takes the payment; our server only asks Shopify whether the store’s subscription is active and until when.

Analytics and advertising

Shelf contains no analytics, no advertising and no tracking: neither the installed app nor the web version at shelf.qiksy.app counts your visits or builds a profile of you.

Where it runs

Our server is a Cloudflare Worker, and the cloud is stored in Cloudflare Durable Objects. Cloudflare runs our server in its global network, so data may be processed outside Ukraine and the European Union. Cloudflare, Resend, Google and Telegram process data for us only to provide these services. We sell nothing to anyone.

Deleting your account

In the app: Settings → Stock in the cloud → Delete account. The same button is in the web version after you sign in. If you are the owner, the shop is deleted from the cloud for good, with its records, its sellers and its subscription. If you are a seller, you leave the shop and your address is deleted. Nobody, us included, can restore a deleted shop. You can also write to hello@qiksy.app from the address you sign in with, and we delete the account within 30 days. Payment records stay for as long as the law requires.

One record outlives a deleted account: a one-way hash of the address you signed in with, never the address itself, worked out with the dots of a Gmail address and anything after a plus sign left out. Beside it we keep the day that address made its first shop, the day of its first payment, and whether its welcome gift of free actions was given. It is there so that an account made again with the same address does not get the gift a second time, and it is kept for as long as Qiksy Shelf runs.

Children

Qiksy Shelf is a tool for shops and is not meant for children.

Changes to this policy

A change moves the date at the top. If the app ever starts sending something new, this page says so before the update ships.