Privacy Policy

Information we collect

• Account information: name, email address, profile image if supplied by your sign-in provider, provider account identifier, and account role.
• Restaurant orders: name, phone number, pickup details, purchased items, prices, payment status, allergy information, notes, special instructions, and order history.
• Merchandise orders: name, email, phone number, shipping address and method, purchased items, order status, payment reference, and shipping or tracking information.
• Account activity: loyalty activity, game scores, and gameplay records associated with your account.
• Notifications: a browser push endpoint or Apple Push Notification service device token, associated with your account, when you choose to enable notifications. We use it for order and service updates and occasional first-party specials, offers, or other restaurant news.
• Native sign-in information: when you use Google Sign-In in the iOS app, Google's sign-in SDK may process your name, email address, phone number, coarse location, user and device identifiers, and other usage or technical data for authentication, app functionality, and SDK analytics. Google Sign-In is not used for cross-company tracking by Mr. Baby Ramen.
• Website and PWA usage and diagnostics: on our website and installed PWA, public-page views, approximate location derived from network information, browser/device type, and performance information through Vercel Analytics and Speed Insights. These analytics components do not load in our native iOS app or on account, checkout, administration, token-protected, or other non-allowlisted pages. Query strings and fragments are removed before an allowlisted event is sent.
• Essential device and request information: we use cookies and local device storage for authentication, phone verification, carts, active-order access, app preferences, and notification settings. Our hosting and security systems may also process network and request information such as IP address, request time, browser or device type, and error or security metadata to deliver and protect the Service.

Payment-card entry is handled by Stripe. We do not receive your full card number. We receive limited payment status, references, and transaction information needed to complete and support purchases.

The loyalty QR scanner is available only to authorized staff and employees at the register. It uses the camera only to read a customer's loyalty QR code on the device. Camera frames and photos are not uploaded or stored.

How we use information

We use this information to:

• create and secure accounts;
• prepare restaurant orders and provide order-status updates;
• process, ship, support, refund, and account for purchases;
• operate the loyalty program and game leaderboards;
• send requested order and service notifications and, after you opt in, occasional first-party specials, offers, and restaurant news;
• prevent fraud, troubleshoot problems, and protect the Service;
• understand usage and improve reliability; and
• meet accounting, tax, and other legal obligations.

We do not sell personal information, use it for cross-app tracking, or use third-party advertising networks. Promotional notifications advertise only Mr. Baby Ramen and use the notification subscription that you explicitly enabled.

Service providers

Authorized restaurant staff access order and account information only as needed to operate and support the Service. We disclose only the information needed for providers to perform services for us. Our providers include Supabase for database hosting, Vercel for application hosting and analytics, Stripe for payments, Shippo for shipping, Twilio for phone verification, Resend for transactional email, Apple and Google for sign-in, and Apple Push Notification service and web-push providers for optional notifications. These providers process information under their own terms and privacy policies. We require providers with whom we share user data to provide the same or equivalent protection described in this policy and required by applicable App Store rules and law.

We may also disclose information when required by law or when reasonably necessary to protect customers, the restaurant, or the Service.

Retention and account deletion

Account information, loyalty activity, and game activity are kept while your account is active. Notification subscriptions are kept until you disable notifications, the endpoint or device token expires or becomes invalid, or the associated account is deleted. Essential cookies, verification records, and local device storage are retained for their stated workflow, until they expire, or until you clear them or remove the app. Website/PWA analytics and infrastructure request records follow our configured provider retention settings and are retained only as needed for analytics, reliability, security, and abuse prevention. You can permanently delete a customer account from Profile in the app. If a restaurant order is still active, deletion becomes available after that order is completed, cancelled, or rejected so the shop can safely fulfill it.

Account deletion removes your account and its saved profile, loyalty, game, session, and notification data. It also removes your name, phone number, allergy information, customer notes, special instructions, account relationship, and reusable access token from completed restaurant orders. If you used Sign in with Apple, we revoke the associated Apple authorization before deleting the account.

We retain limited restaurant and merchandise transaction records when needed for accounting, taxes, fulfillment, refunds, chargebacks, fraud prevention, dispute resolution, and legal obligations. These may include order dates and numbers, purchased items, amounts, payment references, and necessary payment or shipping records. Stripe, Shippo, Twilio, Resend, Apple, Google, and infrastructure providers may retain records under their legal obligations and documented retention practices.

Staff accounts require assistance from the restaurant because they may be associated with operational and legally retained records. Contact us using the address below for help with a staff account or retained transaction information.

Your choices

• You may use public features without creating an account.
• Enabling notifications opts you in to order and service messages and occasional Mr. Baby Ramen specials, offers, and restaurant news. You can opt out from Profile or iOS settings. Notification permission is optional. If you do not enable it, online ordering can use phone verification and SMS order updates instead.
• Camera access is requested only when an authorized staff or employee account opens the loyalty QR scanner.
• You may delete a customer account from Profile or contact us to request access, correction, or deletion assistance.

Security and children

We use reasonable administrative and technical safeguards designed to protect information. No internet or storage system is completely secure. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes and contact

We may update this policy as the Service or our practices change. The date above shows the latest revision.

For privacy questions or requests, email mrbabyramen@gmail.com.