Privacy Policy

Who this policy covers

Pickup Signal (pickupsignal.com) is used by boba and tea shops to show their own order queue on a screen near pickup. This policy covers two very different groups of people, because we handle their information differently:

• Shop owners and staff — the people who sign up for Pickup Signal, connect a Square account, and run the board. We call this group "you" through most of this policy.
• The shop's customers — the people who order a drink at a shop that uses Pickup Signal. They are not our customers. They never sign up for Pickup Signal and are never asked to agree to this policy in the ordinary course of ordering a drink. We collect a small, specific amount of information about them, described below, and we handle it as a processor acting on the shop's instructions — the shop is responsible for its own relationship with its own customers.

Information about the shop owner (your account)

When you create a Pickup Signal account, we collect:

• Your email address, and a password if you sign in with email — your password is stored and verified by Firebase Authentication, our identity provider; we never see or store it ourselves.
• If you sign in with Google or Apple instead, we receive the name and email address those services share with us.
• Your shop's name, and any color or board-style choices you make.
• Your Square connection — if you connect Square, we store the resulting access credentials on our servers so we can read your orders. That connection requests read-only access to your orders, items, and merchant profile; we do not request or receive the ability to process payments, issue refunds, or view your bank details through it.
• Billing information — if you subscribe, our payment processor, Stripe, creates a customer record for your account. Your card number goes directly to Stripe and never reaches Pickup Signal's servers or logs; we store only Stripe's own identifiers and your subscription status (trialing, active, paused, and so on).

Information about the shop's customers (order data)

When a customer orders a drink at a shop that uses Pickup Signal — whether the order arrives automatically from Square or is typed in by staff — we store:

• The customer's first name and last initial only, in the same short form shown on the board (for example, "Tien T."). Every order passes through the same name-shortening step before it's saved, regardless of where it came from — we never store or display a customer's full name.
• An order number.
• The drink(s) ordered — item name and quantity (for example, "Taro Milk Tea × 1").
• Timestamps for when the order was created, started, and marked ready.
• Which system the order came from (Square, typed in by staff, or a demo).

We do not collect a customer's phone number, email address, home address, or payment details for this purpose. Square and the shop's own register handle the transaction; none of that information reaches Pickup Signal.

Some shops choose a board style that shows only order numbers, with no name at all. If a shop makes that choice, we don't put any customer name on the screen for that shop.

How we use this information

• To run the service: sync orders from Square, show the board and staff view, calculate wait times, and let a shop's team mark drinks ready.
• To operate your account: sign-in, billing, and support.
• To keep the service secure and working — for example, an activity log of order status changes that helps us investigate problems. That log is designed to hold only order numbers and timestamps, not names or drink details; during an ongoing technical transition, a small number of entries created by not-yet-updated devices may still include the customer's first name and last initial in the format described above.

We do not use customer order data, or shop-owner account data, for advertising, and we do not sell personal information to anyone.

Who we share information with

• Square (Block, Inc.) is the shop's own point-of-sale system, not ours. Orders originate in Square under the shop's own agreement with Square; Square's privacy policy governs what Square does with that data on its side.
• Stripe processes Pickup Signal's own subscription billing. Stripe is a PCI-compliant payment processor; we never see full card numbers.
• Google Cloud / Firebase hosts our application, database, and authentication, primarily in the United States. They act as our infrastructure provider and do not use the data for their own purposes.
• We do not share personal information with any other third party, and we do not sell it.

How long we keep information

Being direct about where things stand today:

• Short-lived technical records — TV pairing codes and sign-in session tickets — are automatically deleted shortly after they expire. This is live today.
• Order records — including the customer names, items, and timestamps in them — are not automatically deleted today. They remain in our database indefinitely once created, for as long as the shop's account exists, including after a subscription is canceled. This is the honest current state, not the state we intend to end up in.

If you'd like a shop's data — or your own — deleted sooner than that, see "Your rights" below; we can do it manually on request today.

Your rights and choices

You — or, if you are one of a shop's customers, the shop itself — can ask us to:

• See what we hold about your account or a shop's orders.
• Correct inaccurate information.
• Delete your account, a shop's data, or a specific customer's order record.
• Export your data in a portable format.

Being direct: we do not yet have a self-service button in the product for deletion or export — it's on our near-term roadmap. Today, these requests are handled manually — email hello@bobaqueue.com and we will act on it. For a request about a specific customer's order, we prefer the shop reach out on that customer's behalf where possible, since the shop holds the account and the direct relationship; we will also act on a customer's own direct request. We aim to respond within 30 days.

If you are one of a shop's customers

If you ordered a drink at a shop that uses Pickup Signal and want to know what we hold about you: it is limited to what's described above — your first name and last initial, your order number, what you ordered, and when — tied to that one order, at the shop where you ordered it. We don't have your email address, phone number, or any way to contact you directly, which is also why we rely on the shop, or your own direct email to us, to act on a request.

Cookies and tracking

Pickup Signal does not use advertising or analytics tracking cookies today. We use your browser's local storage to keep you signed in (through Firebase Authentication) and, on the public marketing site, to run the interactive demo board — that demo data stays in your own browser and is never sent to us.

Security

We use industry-standard practices to protect the data we hold: encrypted connections (HTTPS) everywhere, per-shop data isolation enforced by our database's own access rules, and Firebase-managed authentication rather than storing passwords ourselves. No system is perfectly secure, and we can't guarantee absolute security.

Children

Pickup Signal is a business tool used by shop owners and staff, not a service directed at children. We recognize a shop's customers ordering a drink may sometimes be minors; the only information we hold about them is the same first-name-and-last-initial order record described above, handled the same way regardless of age.

Changes to this policy

We may update this policy as the product changes. We'll update the date at the top when we do. If a change is significant, we'll look for a reasonable way to let account holders know.

Contact us

Questions about this policy, or a request under "Your rights" above: hello@bobaqueue.com.