Trust & security

Last updated: October 2026

You haven’t heard of us, and you’re being asked to run your takings through our app. That’s a fair thing to be careful about. So TillMint is built so that you need to trust us as little as possible. Here is exactly how.

Your sales live on your device

• The till runs in your browser and records every sale on your phone or tablet first. It works with no signal at all.
• On the free plan, your sales never leave your device. If you sign in, only your stall’s name and product list go online, so your public stall page can show them.
• You can export every sale as a spreadsheet at any time, on any plan, including after you stop paying us. No lock-in, no contract, no exit fee.

If you pay for cloud backup

• Your data is stored with Supabase in Sydney, Australia, sent over encrypted connections, and encrypted at rest by our database provider.
• Database access rules mean each account can reach only its own business. Those rules are checked by an automated test suite that tries to break them: other vendors, signed-out visitors, rewriting a sale.
• A completed sale can’t be edited afterwards, only voided or refunded, and both are kept on the record. That’s what an accountant or Inland Revenue expects to see.
• We take an encrypted backup of our database every night, with a different provider, and keep each one for 30 days.

What we will never do

• Take a percentage of your takings.
• Sell your data, or your customers’ details, to anyone.
• Let AI set or change a price, or run during checkout. AI only suggests product details you ask for, and never invents allergen or dietary claims.
• Hold your records hostage: export and account deletion are yours to do, in the app.

If we ever shut down

We will give every vendor at least 90 days’ notice by email. During that time the till keeps working, exports keep working, and we will send anyone who asks a full export of their cloud data. Then we delete it. Because the till runs on your device, it does not stop selling the day our servers do.

If something goes wrong

If we find a breach of your information, we contain it, work out who was affected, and, if it could cause serious harm, tell the Privacy Commissioner and the people affected as soon as we practicably can, as the Privacy Act 2020 requires. If your customers’ details are involved, we tell you so you can tell them. Details are in our privacy statement.

Found a security problem?

Please tell us at hello@tillmint.nz (also listed in our security.txt). We won’t pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

Who we are

TillMint is built and run in Aotearoa New Zealand by its founder, who also answers the email. Every privacy request, complaint or question reaches a person: hello@tillmint.nz. The full rules are in our terms and privacy statement.