Privacy policy

What we collect

We collect the name or nickname, Hong Kong mobile number, optional email address and member identifier you provide. We also process membership tier, account balance and wallet entries, purchase and order history, drink choices and notes, discounts, pickup status, security events and session identifiers. If you choose to review a completed drink, we also process its star rating and optional written comment. Reviews are private: they are used by authorised shop staff to improve drinks and service, and are not published in the menu or shown to other members. Authorised shop staff may also record drink or service preferences that you explicitly share, together with a private service note. The profile can show summaries derived only from your completed orders, such as frequently ordered drinks and options. Staff are instructed not to record or infer sensitive traits such as health, ethnicity, religion or political views. We do not use this data for cross-app tracking or sell it.

While an order is active, the staff order board may show its current notes alongside relevant preference tags, the private service note and a summary of that member's completed-order reviews for the same drink. These reminders are not automated instructions: staff are told to prioritise the current order note and confirm uncertain requests. They are not shown to other members or published publicly.

Why and how data is linked

Contact and member identifiers are linked to your account so you can sign in, pay with your balance, view history and receive the correct order. Purchase, wallet and security records are linked while needed to operate the service, prevent abuse, resolve disputes and meet accounting obligations. Staff access is limited to operating the shop and supporting members.

Retention and account deletion

You can request deletion inside the app after confirming your PIN. Active orders must first be completed or cancelled, and any balance must first be refunded or settled with the shop. Once confirmed, all member sessions are revoked and direct identity data—including nickname, phone, email and PIN credentials—is irreversibly removed from the live account. Internal preference tags and service notes are also deleted rather than retained with the anonymous transaction record.

Completed order details and wallet/accounting records are retained under an anonymous tombstone for seven years. Order, item and wallet notes, drink-review comments, member-linked review records and member-identifying actors are removed. Anonymized security audit records are retained for 12 calendar months. These retained records cannot be used to restore the deleted account.

Backups and recovery copies

Our live database uses Cloudflare D1 Time Travel, which can retain a recoverable historical copy for up to 7 days on the current plan, or up to 30 days if the plan changes. A signed, non-PII deletion marker is held separately for 35 days. After any database restoration, that marker must be replayed and verified before service reopens, so a restored copy cannot silently reactivate deleted identity data. Historical recovery copies expire on the provider schedule rather than disappearing instantly.

Your choices

You may correct your profile in the app or ask the shop for help. You may withdraw optional information such as email, stop using the service, or request account deletion. Necessary transaction records remain only for the periods described above.

Security and contact

We use encrypted transport, access controls, limited sessions and security monitoring. No system is risk-free. For privacy questions or responsible security reports, email security@notitle.coffee. For order or account help, visit Support.