Privacy

Updated 28 October 2026

CryptoCart is run by JoldiTech. Questions and requests: [email protected].

CryptoCart runs staff and register apps for the companies that use it. Each company decides who uses its apps and what goes in them.

What CryptoCart keeps

• The people a company adds: name, email address, phone number, the passkeys they sign in with (public keys only) and the devices they sign in on.
• What the company keeps in its apps: its customers, sales, gift cards and customer accounts; its staff's shifts, time records, messages, tasks and documents.
• Card payments go to Stripe. CryptoCart keeps only a card's brand and last four digits.
• A record of changes: who changed what, and when.

Each company's records are kept apart from every other company's.

Cookies

Cookies only for signing in, and for a shared device's own sign-in. No advertising or tracking cookies. The apps keep what they need to keep working offline on the device itself.

Where it is kept

On CryptoCart's servers in the United States, at Linode, with a second copy in another data center. Backups keep 30 days of history; what is deleted leaves the backups within 8 weeks.

Services CryptoCart relies on

• Linode (Akamai): the servers.
• Cloudflare: every request to CryptoCart passes through it, and it receives mail sent to cryptocart.dev.
• Stripe: card payments, for a company that takes cards.
• Telnyx: sign-in codes by text from the platform's own number, and receipts and payment links by text from the company's own number, through the platform's Telnyx account.
• Brevo: sign-in codes and sign-in notices by email from the platform's own address, [email protected], through the platform's Brevo account.
• Google: email sent from the company's own Gmail (below), and address suggestions and maps from Google Maps when a shop's address is typed.
• Apple's, Google's and Mozilla's push services: notifications to phones.
• Anthropic: an assistant a company can turn on, which reads that company's records through CryptoCart's API.

CryptoCart doesn't sell anyone's data or share it with anyone else.

Google user data

When a company's Owner connects the company's Gmail, CryptoCart asks Google for one permission: to send email on the account's behalf (gmail.send).

• CryptoCart only sends. It never reads, lists, searches or deletes mail, and that permission doesn't let it.
• It sends only the company's own email from the company's own address: invitations and sign-in codes to its staff, notices to its staff, and receipts to its customers.
• It keeps the address it sends as and the token Google gives it, encrypted on CryptoCart's server, and no copy of what it sends. These are never shared, sold or used for advertising, and nobody reads them.
• Disconnect, in the company's settings, deletes the token and the address, and sending stops at once. To remove CryptoCart's access at Google as well, remove it from the Google Account's third-party connections, at myaccount.google.com/connections.

CryptoCart's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting

A company's Owner can remove people and records in the company's apps. To have what CryptoCart keeps about you deleted, write to [email protected]. Records a company must keep by law are deleted once that time has passed.

Changes

Changes to this page are posted here, with the date.