Privacy Policy

TishTush mobile app (Android & iOS) · Effective October 15, 2026

TishTush is the business platform for independent skincare shops, med spas, and service businesses: CRM, point of sale, front-desk answering (Sophie and John), customer messaging (TishTush Lines), and marketing tools in one app. Retail locations using TishTush are independently owned and managed by third parties — TishTush does not own, lease, manage, or operate any retail location. This policy explains what data the app handles and why.

Whose data the app holds

The app is a tool for a business and its team. Most of the data in it belongs to the business: the business owns its data — its customer lists, appointments, orders, and messages. TishTush processes that data only to run the platform for the business that entered it.

Data the app collects and uses

• Business and account information — business name, team members, and the settings the business configures in the app.
• Customer records the business enters — names, phone numbers, email addresses, appointment and service history, orders, and notes, entered by the business into its own CRM. This data goes to the business's configured TishTush backend and nowhere else.
• Photos — job and work photos the team takes inside the CRM (for example waivers and completed work) are stored with the business's records.
• Camera for QR codes — the wallet's scan-to-pay reads QR codes using on-device barcode scanning (Google ML Kit). Scanned code contents are processed on the device to fill in a payment form; the scanner does not upload camera images.
• Push notification token — if the owner enables notifications in Settings, the app registers a Firebase Cloud Messaging (Google) device token so alerts (a new lead, a missed call) can be delivered. Nothing is registered until the owner opts in.
• On-device settings — the backend address, host key, and wallet handle the owner enters are stored on the device. They are not analytics and are not sent anywhere except the backend the owner configured.

TishTush Lines (messaging)

When a business connects a WhatsApp number or business email through TishTush Lines, conversations with that business's customers are managed on the business's behalf, under the business's own name, through the official WhatsApp Business API and the business's email provider. Message content is processed to answer questions, follow up, and send reminders the business has approved. Meta and Google process those messages as the platforms carrying them.

Payments

Card payments switch on when Stripe activation completes — an owner step we walk you through; until then, bills are paid over the phone. When card payments are on, card details are handled by Stripe and never touch TishTush servers or the app. TishTush receives transaction records (amounts, status, timestamps) so the business's books stay in sync.

What we do not do

• We do not sell personal data — not the business's, not its customers'.
• We do not use app data for third-party advertising, and the app contains no advertising trackers.
• We do not access your location, contacts, microphone, or files. The app requests only internet, camera, and notification permissions.

Sharing

Data is shared only with the processors needed to run the features the business uses: Google Firebase (push delivery), Stripe (payments), Meta (WhatsApp Business), and the business's own email provider — each acting on the business's behalf. We disclose data if required by law.

Retention, export, and deletion

A business can export its data at any time, including when it cancels — the data is theirs. On cancellation or a verified deletion request, business data is deleted from production systems within 30 days, except records we must keep for legal or accounting reasons. Customers of a business who want their record corrected or deleted should contact that business, or write to us and we will route the request.

Security

Data moves between the app and the backend over encrypted (HTTPS/TLS) connections. Access to backend data is gated by the business's own credentials and host keys.

Children

TishTush is a business tool. It is not directed at children, and we do not knowingly collect data from children under 13.

Changes

If this policy changes materially, we will note the change here and update the effective date.

Contact

Privacy questions: tishtush.agent@gmail.com