privacypolicy.

Your account

• Email address, a Firebase user ID, whether your email is verified, and your display name. These come from you when you create an account or sign in, and Firebase Authentication (Google) handles them. We use them to sign you in and to tie orders and rewards to you. Our server checks your Firebase sign-in token on every request that needs an account.
• Your password. You type it into the sign-in form. The apps and the website send it to Firebase Authentication, not to the MAD API.
• How you sign in. The website offers email and password. The iPhone app offers email and password, Sign in with Apple and, where available, Google. The Android app currently offers email and password.
• Firebase sends the verification email and the password-reset email itself.

Your profile

You can save a first name and last name (required to finish registration), a phone number, a birthday and a marketing answer (opted in, opted out, or not answered). Phone, birthday and the marketing answer are optional, and you can clear them.

• The phone number is stored in international format and is never verified by us. The Android app tells you it is “for the pickup counter only. Never used to verify you.”
• The profile is limited to those five fields. The service’s contract allows no other field to be collected, stored or returned.
• Your birthday is kept on your profile only. No other feature of the service reads it.

Orders, payments and rewards

• Orders. When you place a pickup order we store the items and options, your notes, the pickup time, the tip, the totals, any discount, the channel you ordered from (web, iOS or Android), the order status, and a link to your account.
• Notes you type. Item notes and the whole-order note are free text, capped at 200 characters. They are sent with your order to the restaurant’s Clover point-of-sale system for the kitchen to read. Do not put sensitive information in them.
• Payment records. For each payment attempt we store the amount, the tip, the status, Clover’s charge ID or a failure code, and the Clover order ID. We do not store a card number, expiry, security code or ZIP.
• What we send Clover for an order. An order title (“MAD-” plus the order’s ID), your note text, the pickup time, line items, modifiers and any discount. Apart from anything you type into a note, the order we send contains no name, email or phone number.
• Rewards. If the rewards program is switched on you can see a points balance, the points you have earned in total, and a list of point changes, each with a reference to its order where there is one. Punch-card progress is stored separately.
• Member code. The iPhone and Android apps can show a QR code that encodes your customer ID, which our server issues. It is generated on your phone and shown on screen.

Order updates (push notifications)

If you allow notifications, the app sends our server a push token (Firebase Cloud Messaging), the platform (iOS or Android), the app version and your language setting. The server uses the token to send order messages. The four message kinds are fixed text (“Your order is ready”, “Order canceled”, “Refund issued” and “Order received”) plus an order ID.

• The Android app registers a token only while you are signed in, notifications are allowed in system settings, and the in-app Notifications switch is on. Turning either off revokes the registration.
• Android keeps a fingerprint of the token on the device, not the token itself.
• The Android app can also post a basket reminder, at most once a day while the restaurant is taking orders. It is scheduled on your phone from your saved basket; no server is involved.

Usage counts

Each time you open a screen category (home, menu, deals, locations, about, order, account, other) the website or app can tell our server that one view of that category happened. The request carries only the category and, from the apps, the platform: no account, no device ID, no page path. It needs no sign-in. The server adds it to an aggregate counter when that counting is switched on.

Technical data

• Network address. Our servers see the address your request comes from. The API works it out only through proxies it trusts and uses it for rate limiting. When you pay by card, the address is passed to Clover with the charge as a fraud-screening hint.
• App name and version. Every request from the Android app carries MADSeafood-Android/version (build; environment) as its User-Agent, with no device model.
• What Google’s Firebase libraries collect on their own on Android. The Android app contains Firebase Authentication and Cloud Messaging, and Cloud Messaging brings Firebase Installations. According to Google’s published disclosure for Android, Authentication collects an IP address for security and abuse prevention, the SDK version and platform, and the Firebase app ID; Cloud Messaging collects the app version; and Installations creates a Firebase installation ID that “does not uniquely identify a user or physical device”. Google also says the Firebase user agent carries the device model, brand, OS version and the app used to install the app, and “is never linked to a user or device identifier”.
• Crash reports on Android. When the Android app crashes, Firebase Crashlytics sends Google the stack trace, the app’s state at the crash, point-in-time device metadata such as the model and OS version, and a Crashlytics installation ID that counts how many installs a crash affects. We add no account, email, order or payment detail to these reports. Only the store version of the app sends them.
• Server logs and telemetry. Log fields are limited to an allowlist of identifiers and codes. Trace data sent for monitoring has the client address, user agent and raw URL path removed.

What the restaurant sees

Restaurant staff with an owner or manager role can see customer records in a staff dashboard: name, email, phone, order history, notes staff add, and labels they define. Staff can build audience lists and export CSV files. A marketing audience includes only customers who opted in; a customer’s consent is the account answer or the Clover answer, and an opt-out from either wins.

When you create an account, a matching customer record is created in the restaurant’s records, linked by your account ID and never matched by email or phone.

Information from Clover about people who never used the apps

The restaurant’s Clover point-of-sale system holds customer records (name, email, phone and a marketing flag). We import those records into the restaurant’s customer list, so a record may exist about you even if you have no account.

Where to delete it

• iPhone: Account tab, then Delete account.
• Android: Account tab, then Delete account.
• Website: sign in, open Account, then Profile, and use the Delete account section below the profile form.

What you are told first

All three show this notice, the website with a slightly different opening:

This deletes your account and erases your name, email, phone number and birthday. Your orders and payment records stay with the restaurant without your details, and unused rewards can’t be recovered. You can sign up again with the same email afterwards.

How you confirm it is you

The website asks for your password only. The apps ask for the method your account uses: password, Google or Apple. If your account signs in with Apple or Google, delete it in the iPhone app. An account with staff access cannot be deleted until an owner removes that access.

If none of this works for you, for example because your sign-in method cannot be confirmed in the app, email [email protected]. We can erase an account for you once we have confirmed the request is yours.

What happens, in order

1. The app or website asks you to confirm your sign-in again, asks our server to erase the account, then deletes your Firebase sign-in and signs you out. The apps also revoke your push registration first, and for an Apple sign-in they revoke Apple’s token.
2. The server accepts the request only if you signed in within the last five minutes, and refuses it for an account with staff access.
3. In one database transaction the server overwrites your account row and deletes every push registration your account made, with its push token, app version and language. In the account row the email is replaced by a placeholder address that cannot receive mail, the name becomes “Deleted account”, and given name, family name, phone, birthday and marketing answer are cleared. The database rejects any erased row that still holds one of them.
4. A background job that runs every minute then anonymizes your customer record in the restaurant’s list (and other records sharing your email or phone that no live account holds), forfeits your unspent rewards points, revokes punch-card progress, and deletes any Firebase login still left.
5. Asking twice is harmless; the second request changes nothing.

After deletion you can sign up again with the same email.

What is kept

• Orders, quotes and payment attempts remain, pointing at the scrubbed account row. They hold no email, name or phone of yours.
• Free-text notes you typed on an order or an item stay with that order.
• A record that links your Firebase sign-in ID to the scrubbed account stays, so that a leftover session cannot recreate the account.
• Records held in Clover, the restaurant’s point-of-sale system, such as the point-of-sale copy of an order and customer records in the restaurant’s Clover account, are not changed by deleting your account.