Last updated: 13 August 2026
MS360 SkuVault removes sold stock from the correct SkuVault bin after a sale is rung up in Music Shop 360. This policy describes everything the extension handles.
SkuVault sign-in details. The extension’s popup asks for the SkuVault
email address and password of the signed-in user. These are sent once,
directly to SkuVault’s own API (https://app.skuvault.com/api/gettokens), in
exchange for a tenant token and a user token.
The password is never stored. It is held only for the length of that one request and is not written to disk, logged, or transmitted anywhere else. Only the two tokens and the email address are saved, so the operator does not have to sign in again on every shift.
Sale contents. While the POS page is open, the extension reads the product lines on the current till — product title, UPC or SKU, and quantity — so it knows what was sold and how much to remove. It also reads the till’s storefront name, and the warehouse list on the SkuVault account, to decide which bins to show first.
The extension talks to exactly two places:
| Destination | What is sent | Why |
|---|---|---|
app.skuvault.com |
Tokens, product UPC/SKU, quantity, warehouse and bin code | Look up bin quantities and remove sold stock |
your *.musicshop360.com store |
Nothing is sent; the page is only read | Detect a finished sale and show the allocation overlay |
There are no analytics, no telemetry, no error reporting services, and no third-party servers of any kind. Nothing is sold, rented, or shared with anyone. The developer has no server and receives no data.
| Data | Location | Lifetime |
|---|---|---|
| SkuVault tokens and email | chrome.storage.local on the operator’s machine |
Until sign-out, or until the extension is removed |
| In-progress sale (products, bin quantities, what has been removed) | chrome.storage.session on the operator’s machine |
Cleared when the browser closes |
Both live only in the browser profile on that computer. Neither is synchronised to a Google account or copied off the device.
Signing out in the extension popup deletes the stored tokens and the in-progress sale immediately. Uninstalling the extension removes everything it has stored.
Stock removals that have already been sent to SkuVault are recorded in SkuVault, not by this extension, and are governed by SkuVault’s own policy.
| Permission | Why it is needed |
|---|---|
storage |
Keep the SkuVault session and the in-progress sale, so a browser restart does not lose a half-finished allocation |
https://*.musicshop360.com/pos-app/* |
Read the till’s product lines and show the bin overlay on the POS page |
https://app.skuvault.com/* |
Call SkuVault’s API to read bin quantities and remove stock |
The extension requests no other permissions. It does not use remote code: all of its code ships inside the package.
Questions about this policy: nhellyer6@gmail.com