Privacy Policy

TL;DR — sa madaling salita

Pharmacy data mo (sales, inventory, expenses) — naka-save lang sa device mo. Hindi namin nakikita. Walang cloud sync.
Account info (email, full name, pharmacy name) — naka-store sa Supabase para sa authentication at admin approval.
GCash receipt — kinukuha namin para ma-verify ang bayad. Admin lang ang may access.
Walang ads, walang tracking, walang analytics sa current version.

What we collect

Account information

Kapag nag-sign up ka, kinukuha namin:

Email address
Password (hashed — hindi namin nakikita yung plaintext)
Full name
Pharmacy name

Payment receipt

Kapag nag-upload ka ng GCash receipt screenshot, sini-save namin yung image file sa private storage. Pwede mo siyang i-replace anytime sa/upload-receipt page.

Server logs

Standard web server logs (IP address, browser type, timestamps). Hindi namin tini-tie ito sa account mo for tracking purposes — para lang sa security and debugging.

What we DO NOT collect

Yung mga produkto sa inventory mo
Yung mga sales transactions mo
Customer names na in-type mo
Yung expenses na ni-record mo

Lahat ng nasa list na yan, nasa localStorage ng browser mo lang. Walang network call na nagdadala niyan sa server namin.

How we use it

Authentication — para malaman kung sino ka pag mag-login
License verification — para malaman kung approved ka na
Admin review — para ma-verify ang bayad mo
Communication — kung kailangan namin i-message ka tungkol sa account mo

Where data lives

Pharmacy data → sa localStorage ng phone/browser mo. Hindi kami may copy.
Account data → Supabase (PostgreSQL, hosted sa Southeast Asia region). Encrypted at rest, encrypted in transit (HTTPS).
Receipts → Supabase Storage, private bucket. Per-user folder protected by row-level security policies — kahit ibang user, hindi makikita yung receipt mo.

Hindi namin ibinibenta o sini-share ang data mo. Period.

Exceptions (legal requirements lang):

Kung mag-request ang Philippine authorities through a valid legal order
Kung kailangan para ma-protect against fraud or abuse

Cookies

Ginagamit namin ang cookies para sa authentication only — para ma-remember ka pag mag-login. Walang tracking cookies, walang third-party cookies, walang ad cookies.

Your rights (under the Philippine Data Privacy Act of 2012)

Right to access — pwede mong hingin yung copy ng data namin tungkol sayo
Right to correct — kung mali yung info, pwedeng baguhin
Right to delete — pwedeng i-delete ang account mo anytime (email us)
Right to object — pwedeng mag-stop sa processing ng data mo

Email mo lang kami para i-exercise ang rights mo. Sasagot kami within 15 business days, max.

Retention

Account data: hangga't may account ka. After account deletion, 30 days backup retention.
Receipts: hangga't approved ang status mo. After deletion, immediately purged.
Admin audit log: 12 months para sa security review.
Server logs: 30 days.

Children

Pharmetriks ay para sa licensed pharmacy staff and adult business owners. Hindi namin sadyang kinokolekta ang data ng mga under 18. Kung sa tingin mo may bata na nag-sign up, message us at i-delete agad namin.

Changes

Kapag may significant changes sa policy na ito, mag-eemail kami sa registered email mo at i-update yung "Last updated" date sa taas. Yung full history pwede mong makita sa GitHub commit log.

Contact

Privacy concerns? Email support. Sa Pilipinas, pwede ka rin mag-file ng complaint sa National Privacy Commission (NPC) kung sa tingin mo may violation.