Privacy Policy

Who this policy covers

Pickup Signal (pickupsignal.com) is used by made-to-order counters to show their own order queue on a screen near pickup. This policy covers two very different groups of people, because we handle their information differently:

• Shop owners and staff — the people who sign up for Pickup Signal, connect a Square, Clover or Toast account, and run the board. We call this group "you" through most of this policy.
• The shop's customers — the people who order a drink at a shop that uses Pickup Signal. They are not our customers. They never sign up for Pickup Signal and are never asked to agree to this policy in the ordinary course of ordering a drink. We collect a small, specific amount of information about them, described below, and we handle it as a processor acting on the shop's instructions — the shop is responsible for its own relationship with its own customers.

Information about the shop owner (your account)

When you create a Pickup Signal account, we collect:

• Your email address, and a password if you sign in with email — your password is stored and verified by Firebase Authentication, our identity provider; we never see or store it ourselves.
• If you sign in with Google or Apple instead, we receive the name and email address those services share with us.
• Your shop's name, and any color or board-style choices you make.
• Your Square connection — your Square password never reaches Pickup Signal: you sign in on Square's own page, and Square issues us a limited, revocable access token — a key that lets us read your orders, items, and merchant profile, and nothing else. We store that token on our servers so orders can flow to your board; it cannot process payments, issue refunds, or view your bank details. If the connection is disconnected — from your Pickup Signal dashboard or from your Square Dashboard — the token is revoked with Square and deleted from our servers immediately; nothing that can reach your Square account is retained.
• Your Clover connection — your Clover password never reaches Pickup Signal: you create an API token in your own Clover dashboard and paste it into Pickup Signal, with your merchant ID. We store that token on our servers and use it only to read your orders, items, customer names and merchant profile. If you disconnect in your Pickup Signal dashboard, the token is deleted from our servers immediately. Because you created the token, deleting it in your Clover dashboard is what ends it on Clover's side; you can do that at any time.
• Your Toast connection — your Toast password never reaches Pickup Signal: you create API credentials and an orders webhook in Toast Web and paste the client ID, client secret, API address, restaurant ID and webhook secret into Pickup Signal. We store them on our servers, use them to sign in to Toast with read-only access to your orders, customer names and restaurant profile, and use the webhook secret to check that order notifications really come from Toast. If you disconnect in your Pickup Signal dashboard, they are deleted from our servers immediately. Deleting the credentials in Toast Web ends our access on Toast's side once our current short-lived sign-in expires.
• Billing information — if you subscribe, our payment processor, Stripe, creates a customer record for your account. Your card number goes directly to Stripe and never reaches Pickup Signal's servers or logs; we store only Stripe's own identifiers and your subscription status (trialing, active, paused, and so on).

Information about the shop's customers (order data)

When a customer places an order at a shop that uses Pickup Signal — whether it arrives automatically from Square, Clover or Toast, is typed in by staff, or is sent by the shop's own website, kiosk, or automation through the integration API — we store:

• The customer's first name and last initial only, in the same short form shown on the board (for example, "Tien T."). Every order passes through the same name-shortening step before it's saved, regardless of where it came from — we never store or display a customer's full name.
• An order number.
• The item(s) ordered — item name and quantity (for example, "Croissant × 1").
• Timestamps for when the order was created, started, and marked ready.
• Which system the order came from (Square, Clover, Toast, typed in by staff, the integration API, or a demo).

We do not collect a customer's phone number, email address, home address, or payment details for this purpose. The shop's own register (Square, Clover, Toast or another) handles the transaction; none of that information reaches Pickup Signal.

Some shops choose a board style that shows only order numbers, with no name at all. If a shop makes that choice, we don't put any customer name on the screen for that shop.

The Pickup Signal app for staff

The Pickup Signal app for iPhone, iPad and Android is the staff side of a shop: the counter screen and the kitchen screen. It has no accounts and no sign-in. A device joins one shop by scanning the owner's staff QR code or pasting the staff link.

• A random device id. When a device joins a shop, Firebase Authentication gives it a random id, and the shop's list of staff devices records it with the time it joined. The owner removes a device from that list, or resets the staff link to remove them all.
• The shop's orders. What staff do in the app (start, ready, picked up, undo, fix a name) and any order they add by hand is saved to the shop's queue, in the same first-name-and-last-initial form described above.
• Crash reports. When the app crashes it sends us an error code, the line in our code where it happened, and the shop's id. Never the error text, the screen's contents, a name or an order, and never the device id. We delete crash reports after 14 days.
• Casting the board. When staff cast the board to a Chromecast or Google TV, that TV becomes one of the shop's screens until someone stops it, labeled with the name staff gave the device (for example "Cast from Front counter"). Google's Cast software in the app sends Google anonymous logs about finding and connecting to TVs, as Google describes in its own documentation; they carry no order, name or shop data.

The camera is used only to scan the staff QR code; the code is read on the device, and no photo or video is kept or sent. On iPhone and iPad the app asks to use the local network only when someone taps "Cast board to TV", to find the TV. The app does not use the microphone, photos, contacts, location or notifications, and has no advertising or analytics of its own. The device keeps its own settings and a copy of the current queue in its secure storage, so the screen works after a restart or a Wi-Fi drop; "Leave shop" in the app clears them.

The Pickup Signal app for Fire TV only opens our TV page, the same page a TV's web browser shows. When the TV is paired it gets a random id, and the shop's list of screens records it with the last time it was online and the TV's screen size in pixels, so the shop can see which TV is which shape. The TV keeps the pairing so the board comes back after a restart. The app does not use the microphone, camera or location, and has no advertising or analytics.

How we use this information

• To run the service: sync orders from the shop's register (Square, Clover or Toast), show the board and staff view, calculate wait times, and let a shop's team mark drinks ready.
• To operate your account: sign-in, billing, and support.
• To keep the service secure and working — for example, an activity log of order status changes that helps us investigate problems. That log is designed to hold only order numbers and timestamps, not names or drink details; during an ongoing technical transition, a small number of entries created by not-yet-updated devices may still include the customer's first name and last initial in the format described above.

We do not use customer order data, or shop-owner account data, for advertising, and we do not sell personal information to anyone.

Who we share information with

• Square (Block, Inc.) is the shop's own point-of-sale system, not ours. Orders originate in Square under the shop's own agreement with Square; Square's privacy policy governs what Square does with that data on its side.
• Clover (Clover Network, LLC) is the same arrangement as Square for a shop that connects a Clover register. Orders originate in Clover under the shop's own agreement with Clover; Clover's privacy policy governs what Clover does with that data on its side.
• Toast (Toast, Inc.) is the same arrangement for a shop that connects a Toast register. Orders originate in Toast under the shop's own agreement with Toast; Toast's privacy policy governs what Toast does with that data on its side.
• Stripe processes Pickup Signal's own subscription billing. Stripe is a PCI-compliant payment processor; we never see full card numbers.
• Resend delivers our account and billing email — address verification, password resets, and trial or payment notices. It receives your email address and your shop's business name. No customer order information is ever sent by email.
• Google Cloud / Firebase hosts our application, database, and authentication, primarily in the United States. They act as our infrastructure provider and do not use the data for their own purposes.
• Google Cast is the software in our staff app that puts the board on a Chromecast or Google TV. It sends Google anonymous logs about finding and connecting to TVs, as described above.
• We do not share personal information with any other third party, and we do not sell it.

How long we keep information

Being direct about where things stand today:

• Short-lived technical records — TV pairing codes and sign-in session tickets — are automatically deleted shortly after they expire. This is live today.
• Order records — including the customer names, items, and timestamps in them — are not automatically deleted today. They remain in our database for as long as the shop's account exists, including after a subscription is canceled. This is the honest current state, not the state we intend to end up in.

If you'd like a shop's data — or your own — deleted sooner than that, see "Your rights" below; we can do it manually on request today.

Your rights and choices

You — or, if you are one of a shop's customers, the shop itself — can ask us to:

• See what we hold about your account or a shop's orders.
• Correct inaccurate information.
• Delete your account, a shop's data, or a specific customer's order record.
• Export your data in a portable format.

Being direct: you can delete your whole account yourself, from the dashboard — it cancels billing, revokes the connections we hold, and removes your shops and their order records. For export, and for a request about one customer's order record, there is no self-service button and we are not planning one; those are handled manually — email hello@pickupsignal.com and we will act on it. For a request about a specific customer's order, we prefer the shop reach out on that customer's behalf where possible, since the shop holds the account and the direct relationship; we will also act on a customer's own direct request. We aim to respond within 30 days.

If you are one of a shop's customers

If you ordered a drink at a shop that uses Pickup Signal and want to know what we hold about you: it is limited to what's described above — your first name and last initial, your order number, what you ordered, and when — tied to that one order, at the shop where you ordered it. We don't have your email address, phone number, or any way to contact you directly, which is also why we rely on the shop, or your own direct email to us, to act on a request.

Cookies and tracking

Pickup Signal does not use advertising or analytics tracking cookies today. We use your browser's local storage to keep you signed in (through Firebase Authentication) and, on the public marketing site, to run the interactive demo board — that demo data stays in your own browser and is never sent to us. The staff app keeps its settings in the device's secure storage instead, and does not track you.

Security

We use industry-standard practices to protect the data we hold: encrypted connections (HTTPS) everywhere, per-shop data isolation enforced by our database's own access rules, and Firebase-managed authentication rather than storing passwords ourselves. No system is perfectly secure, and we can't guarantee absolute security.

Children

Pickup Signal is a business tool used by shop owners and staff, not a service directed at children. We recognize a shop's customers ordering a drink may sometimes be minors; the only information we hold about them is the same first-name-and-last-initial order record described above, handled the same way regardless of age.

Changes to this policy

We may update this policy as the product changes. We'll update the date at the top when we do. If a change is significant, we'll look for a reasonable way to let account holders know.

Contact us

Questions about this policy, or a request under "Your rights" above: hello@pickupsignal.com.