Privacy Policy

Last updated: October 8, 2026

1. Introduction

RestroQR ("we", "our", or "us") operates the RestroQR mobile application and website. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

2. Information We Collect

For Restaurant Owners (App Users):

Name, email address, and phone number (for account registration)
Restaurant details (name, address, phone, menu items)
Device token for push notifications (FCM)

For Customers (Website Users):

Order contents, table identifiers and order status are stored to process orders
No account creation is required to view menus or place orders
If supplied with an order, customer name and phone number are stored with that order
The restaurant-wide public order board shows order references, table labels, customer initials and status; it does not show full names, phone numbers, totals or order contents
Anyone with the restaurant QR link can view this board. Its recent-order display window is not a database deletion or retention policy
Public loyalty lookup is disabled until customer identity verification is available

3. How We Use Information

To provide and maintain our service
To send push notifications about new orders to restaurant owners
To process and display food orders between customers and restaurants
To generate earnings reports and analytics for restaurant owners

4. Data Storage and Security

The application uses bcrypt for password hashing and AES-256-GCM for table tokens. Production deployments should use HTTPS and restricted database access. Authorized restaurant owners can access their order records. Hosting, image storage and notification providers process data needed to operate those services.

5. Third-Party Services

We use the following third-party services:

Firebase Cloud Messaging — for push notifications to restaurant owners
Cloudinary — for image storage (restaurant logos, food item images)
PostgreSQL hosting provider — for account, menu and order storage; the provider depends on the deployment

6. Data Retention

We retain your account data as long as your account is active. Order history is retained for restaurant analytics purposes. You can request deletion of your account and all associated data by contacting us.

7. Your Rights

Access your personal data
Request correction of inaccurate data
Request deletion of your account and data
Opt-out of push notifications at any time

8. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the new policy on this page.

10. Contact Us

If you have questions about this Privacy Policy, contact us at:

codeuppath@gmail.com