POS PANO · SPANOBRO
Privacy Policy
Effective date: 16 September 2026
About this policy
This policy covers POS PANO (Android package com.pospano.app), provided by SpanoBro, and its optional terminal connection. Contact: spano.bro@gmail.com. The restaurant or other business using POS PANO decides which customer and employee records to enter and is responsible for its use of those records.
Local restaurant data
POS PANO stores restaurant settings, menus, orders, recorded payments, stock, recipes, suppliers, staff records, PIN credentials, timesheets, guest details and reports on the device. Photos or logos selected by you can also be stored locally. The core POS works without a developer account or an internet connection. SpanoBro does not automatically receive the local restaurant database.
Local network and printing
When you pair devices, they exchange the menu, staff access information, orders, guest lookups and operational status directly over your local network using encrypted connections with paired-device verification. Printing sends the selected ticket or receipt to the printer you configure. Printed output and printer connections may expose that content to people with access to the printer or network. Use trusted devices and networks.
Optional terminal connection
If an administrator joins an organisation using an invitation, POS PANO sends the invitation, a generated terminal credential, the chosen terminal name and role, and organisation identifiers to manage.pospano.spanobro.com over HTTPS. The service stores terminal, organisation and venue identifiers, name, role, access status, credential hashes, expiry and connection-management records. Connection checks and renewals may continue in the background while the terminal remains connected. These functions do not upload the local orders, inventory or guest database. The owner console uses Google sign-in to create and manage the online organisation. It verifies the Google identity token and derives an owner identifier from its subject; it does not store Google passwords. The online organisation is separate from local staff PIN accounts.
Hosting and technical records
Our online services use Cloudflare infrastructure. Servers and hosting providers receive the IP address and request metadata needed to deliver and protect the service, and may maintain security or operational logs. We use connection records to operate terminal access and prevent misuse. We do not use these records for advertising profiles or sell personal data.
Camera, Bluetooth and notifications
Camera access is used to scan guest QR codes when you start scanning; camera images are processed on the device. Bluetooth access connects to compatible printers you select. The app can show notifications for the foreground local-network service. You can manage permissions in Android settings. The app does not request access to your address book, microphone or precise location.
Exports, guest links and backups
Exports and local backups are written to the destination you choose. They can contain restaurant, employee or guest data and are not a substitute for secure storage. Android sharing transfers a selected file or guest link to the app you choose. Guest-card links contain an identification token in the URL fragment; anyone given that link may use the card. The fragment is not included in ordinary HTTP requests, but the receiving app and browser can access it. Android system backup or device transfer may copy permitted database and preference data according to your device and account settings.
Optional cloud backups
Starting with version 0.1.0-internal.2, a local administrator can connect their own Google Drive or HTTPS WebDAV storage and choose manual or scheduled backups. Automatic backups are off until enabled. The main POS encrypts the restaurant archive on the device with a separate recovery password, then sends it directly to the selected provider over HTTPS and downloads it to verify the transfer. SpanoBro does not receive or store these archives or the recovery password. The archive may contain the local restaurant, employee and guest records listed above. Google authorization uses the drive.file scope, limited to files created or opened with POS PANO; it does not grant access to Gmail messages or the rest of Drive. The selected account email is read to identify the connected account and is stored locally. Google Play services manages authorization; Google receives the account authorization and service requests. For WebDAV, credentials are sent only to the configured HTTPS endpoint. Credentials and the recovery password are encrypted with Android Keystore on this device and excluded from restaurant backups and system backup. The provider receives encrypted file content, file metadata and ordinary request information under its own privacy policy. After verifying a new copy, POS PANO removes older copies from the same device according to your retention setting; Google Drive copies are moved to Trash, while WebDAV recovery depends on the provider. Disconnecting stops scheduling and removes local credentials but leaves existing cloud files. Manage those files in your storage service. You can revoke Google access through your Google account. The core POS continues to work without cloud backups.
Advertising and payments
This version does not include advertising, advertising identifiers or third-party advertising and analytics SDKs. It records payment methods and amounts entered by staff but does not collect bank-card credentials or execute bank transactions. Future integrations will require an updated policy and relevant disclosures.
Retention and deletion
Local data remains until you remove it through available app controls or delete app data. Uninstalling does not remove exported files, shared copies, printer output or system backups. An organisation owner can delete the online organisation and account through the owner console, reached from Settings → Server and sync → Terminal connection → Delete server account or the public account-deletion page linked below. After owner authentication and explicit confirmation, the active service immediately deletes that organisation, venues, invitations, terminal registrations and access history. Existing online terminal credentials become invalid. Hosting recovery copies may remain for up to 30 days and are not used to reactivate a deleted account. Local restaurant databases, your Google account and files in your own cloud remain under your control. Stop scheduled cloud backups separately and manage existing archives in your storage provider. Locally disconnecting a terminal is not account deletion. If you cannot access the owner account or want to delete information supplied to support, contact spano.bro@gmail.com without sending credentials; identity verification may be needed.
Your choices and contact
You can use the core app without the optional server connection, revoke Android permissions, control exports and contact us about access, correction or deletion of data held by SpanoBro. For records entered by a restaurant, contact that restaurant. Do not email PINs, terminal secrets, full backups or customer lists unless a specific secure support process has been agreed.
Audience and changes
POS PANO is intended for restaurant and business staff, not directed to children. We will update this policy when the app's data practices change and show the revised effective date here.