Hello Boba Club Privacy Policy

What We Collect

Depending on the features you use, we collect your name, verified phone number, account and device identifiers, birthday month/day, profile photo, preferences, saved drinks, orders and payment status, reward and referral activity, event participation, reviews, poll votes, game progress, photo submissions, and notification choices. Staff-invite workflows may also collect an email address.

Optional allergy and dietary notes help staff prepare orders. We do not use allergy information to target promotions. Gift-card linking sends the entered card number to Square; we retain the linked card identifier, last four digits, label, and balance, not a credit-card number. Ordinary card payment details are entered securely with Square.

We collect app interactions and diagnostic information, such as API route, response status, timing, app/device details, and error reports, to operate and troubleshoot the service. Support requests and cafe-directed text replies may also be recorded. We do not read your device's contacts, email inbox, or SMS inbox; referral records describe the connection between participating app accounts.

How We Use It

We use this information to sign you in, connect your app account to Square, process and prepare orders, show rewards and recent orders, manage events and community features, personalize your experience, prevent duplicate rewards and abuse, provide support, and measure reliability and engagement. With the applicable optional preferences, we use purchase and participation history, interests, birthday information, and location to send relevant cafe offers.

Hello Boba Cafe does not sell app customer data or upload customer lists to advertising networks. Optional sharing to a social platform is initiated by you; we do not automatically post on your behalf.

Referrals and Photo Rewards

Referral links contain a random invite code, not your phone number or name. We record the referral connection, qualifying order, and reward history to apply the offer and prevent duplicate rewards. Joining through a referral does not opt anyone into marketing texts.

A photo you select stays on your device until you choose Submit for review. Submitted reward photos are stored privately for authorized cafe managers to review, with unnecessary image metadata removed. Sharing, saving, or copying a caption does not upload a reward entry or confirm that a social post was published.

Unsubmitted uploads are scheduled for removal after 7 days; submitted reward photos are scheduled for removal no later than 30 days after upload. In Photo entries, you can remove a submitted photo. Removal immediately hides the photo and clears its caption, post link, and cafe-reuse permission, then queues deletion from storage. Account deletion does the same. Minimal order, award, duplicate-prevention, and cooldown records may remain; removing a photo does not cancel an already-earned coupon.

Permission for Hello Boba Cafe to reuse your photo is separate, optional, and off by default. Removing the photo withdraws that permission for future reuse. Nothing is posted publicly automatically. For copies you or the cafe already published outside the app, contact us and the relevant platform; app removal cannot erase independently shared copies.

Profile and Community Photos

Profile, review, and community/quest photos are separate from private photo-reward submissions. They may be publicly accessible when you choose to upload or publish them. New uploads have unnecessary image metadata removed. Account deletion hides your customer reviews and queues removal of your customer-owned uploaded photos. Cafe-owned menu, event, and other business content is not removed by deleting a staff member's account.

Location, Camera, and Notifications

If you enable location sharing, we request your device's precise or approximate location for cafe/event check-ins and nearby cafe offers. We retain the location snapshot, accuracy, and capture time; this is not continuous background location tracking. You can turn location sharing off in Account and revoke the device permission. Location sharing does not by itself enable marketing text consent.

Camera or photo-library access is optional and used for photos you choose. Push notifications, event reminders, order texts, and marketing text promos have separate choices. Notification delivery uses a device registration token.

Marketing SMS Privacy

Hello Boba Cafe does not sell, rent, or share mobile phone numbers, mobile information, SMS opt-in data, or SMS consent with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with third parties or affiliates for marketing or promotional purposes.

Marketing text promos are optional. The only way to opt in or re-consent is for a signed-in customer to select the standalone Text promos setting in Hello Boba Club and choose Agree & turn on text promos. No inbound keyword, including START, creates or restores app marketing consent; START can only remove a Twilio or carrier delivery block after a prior STOP. Message frequency varies. Message and data rates may apply. You can opt out of marketing SMS messages by replying STOP. Reply HELP for help. Carriers are not liable for delayed or undelivered messages. See the Marketing SMS consent page for the public consent details.

Service Providers

We use Square for payments, orders, customer linking, loyalty, and gift cards; Firebase for push notifications; Twilio for phone verification and selected order/marketing texts and replies; Meta/Facebook for cafe event sync; Vercel for hosting and photo storage; and database/cache providers to operate the app. Relevant information is sent to the provider needed for the feature. Provider payment, account, and legally required records are separate from your app profile.

Your Choices

You can browse the menu without creating an account. You can update your profile, location and notification choices, and theme in Account. Optional marketing choices are not required to order. You can request deletion from Account > Privacy & support > Privacy & deletion, or by contacting Hello Boba Cafe without logging in. See account and data deletion details.

Retention and Deletion

Account deletion removes profile and sign-in details, notification devices, preferences and app state, saved favorites/usuals, unticketed RSVPs, poll votes, and saved achievement progress. Customer review comments/photos, personal quest submissions, event check-in location metadata, and your account-merge request notes are cleared. Customer-owned photos are queued for removal with retries if storage is unavailable. Personal app-order notes are removed from eligible local completed/canceled orders; preparation instructions for an active order are retained until fulfillment ends.

Routine API metrics are scheduled for deletion after 45 days and incident records after 90 days. Private photo-reward uploads use the 7/30-day limits above. Order, payment, tax, reward, opt-out, fraud-prevention, and legal records needed for recordkeeping or honoring your choices may be retained. App deletion does not automatically erase payment-provider records, backup copies, or independently published social posts. Contact us to request help with these records, specific retention information, or already-published cafe copies.

Contact

Hello Boba Cafe
359 Third St, Macon, GA
support@hellobobacafe.com