Privacy

Two kinds of people, and who decides

NepaliMenu is a service operated from Nepal. The registered entity behind it is being set up and will be named here, on this page, before the service is sold to anyone.

This covers two groups. Cafe owners and their staff, who have accounts here. And customers, who may sign in on a cafe’s page and may order from a table.

For a cafe’s own records — its orders, its customers, its reports — the cafe decides what is collected and why, and NepaliMenu runs the system on their behalf. For accounts, billing and the running of the platform itself, that decision is ours.

If you work at a cafe

An account holds:

• your name, email address and username
• your password, stored only as a bcrypt hash — nobody here can read it, including us
• a link to your Google account, if you chose to sign in that way: Google’s stable account id and the email address on it
• your role at the branch, and what that role may do
• if you opened the cafe’s account, which version of these documents you agreed to and when you did
• each session you have open: when it started, the browser it reported, and the IP address it started from — so you can recognise a session in the list and revoke the one that is not you
• if you turned on notifications, the address your browser’s push service gave us, and its keys

A signed-in session lasts 14 days and its access token 15 minutes. Signing out ends it; “sign out everywhere” ends all of them.

If you order at a table

You can look at the menu and order without telling us anything about yourself. A table session lasts two hours and knows only which table it is.

If you sign in with Google — which is optional — the cafe and we hold:

• Google’s stable account id, your email address, your display name and the URL of your Google picture
• which cafes you have signed in at, when you were first seen there and when last
• whether that cafe has marked you as a regular it will take orders from without a tap
• the orders you placed there, and the rewards you earned, spun for or redeemed

A signed-in customer session lasts 30 days on that device. There is no password, because there is no NepaliMenu account for a customer to have — signing in with Google is the whole of it.

Tapping the chip on a table records which tag was tapped, which table it is on, and when. That record is what stops somebody ordering to your table from the street. It says nothing about who tapped it.

We do not ask for your phone number, we do not take card details, and there is no advertising profile of you here — not sold, not shared, not built.

What the system records to keep working

• server logs of requests: the time, the path, how long it took, a trace id, and the IP address it came from
• counters used to rate-limit sign-in attempts, which is what stops somebody guessing at your password
• crash reports, if this deployment has them turned on — configured to send no personal data and no IP address, and used only to find a bug

Logs are kept for as long as they are useful for finding a fault or an attack, which is weeks rather than years.

Who else is involved

• Google — only if you sign in with Google, and only the account details above
• the email provider that delivers invitations, verification codes and password resets
• the company whose servers this runs on, and the object store the photographs sit in
• your own browser’s push service, if notifications are on
• an off-site store that holds the encrypted backups

That is the list. Nobody buys data from us, nobody advertises through us, and no analytics service is watching you read a menu.

How long it is kept

• access token: 15 minutes. Staff session: 14 days. Customer session: 30 days. Table session: 2 hours
• an invitation link: 72 hours. A password reset code: 10 minutes
• invoices, credit notes and payment records: for as long as tax and accounting law requires them, which is longer than an account lasts
• a closed account’s personal data: deleted from the live system within 30 days, apart from those records
• backups: a dump a day, encrypted before it leaves the machine, kept 14 days by default. A deletion reaches them when the last backup holding it ages out

How it is protected

• passwords hashed with bcrypt; refresh tokens stored only as hashes, and rotated on every use
• the session cookie is HttpOnly and SameSite=Strict, so a script cannot read it and another site cannot spend it
• every request is scoped to one cafe, in the query itself rather than by a check that can be forgotten
• what each member of staff can see is decided by their role, by the server, on every request
• backups are encrypted with a public key the server holds; the key that opens them is not on the server

Being honest about the limit: whoever operates a hosted system can reach what is stored in it. Platform administrators here can see the list of cafes, their owners and their billing, and can suspend an account. They go into a cafe’s own records to fix a fault or answer a request from that cafe, and for nothing else.

What you can ask for

Staff: your name and email are yours to change in Settings; your sessions are yours to end; a linked Google account can be unlinked once you have a password.

Customers: ask the cafe to forget you, or write to us. Signing out ends the session on the device; asking removes the record of your visits.

Either way, write to [email protected] for a copy of what is held about you, a correction, or a deletion. We answer within 30 days. Records the cafe must keep by law — an issued invoice — survive a deletion request, and we will say so rather than quietly keep them.

What is stored on your device

A session cookie so you stay signed in, and a note of which table you are at while you are at it. Both are needed for the thing you asked for; neither is advertising, and there is no tracker on any page.

Children

The service is for cafes and their customers and is not directed at children. We do not knowingly keep an account for one. Ordering at a table needs no account at all.

Changes

The date at the top says when this last changed. A change to what we collect or who we share it with is emailed to cafe owners before it applies, and shown on the storefront’s footer link for everyone else.

Contact

Privacy questions: [email protected].