Legal

Privacy Policy

Effective date: June 25, 2026 · LocalPour LLC, Denver, Colorado

The short version: We collect only what we need to run your orders. We never sell your data. We never share it with anyone except the shop you ordered from and Square (which processes your payment). You can request deletion of your account at any time.

1. Who we are

LocalPour LLC ("LocalPour," "we," "us") operates a mobile ordering platform for independent coffee shops. Our principal place of business is in Denver, Colorado. Questions about this policy can be sent to privacy@localpour.app.

2. Information we collect

We collect information you provide directly and information generated by your use of the service:

Account information: Your display name and email address when you create an account.
Order information: Items ordered, modifiers, special instructions, order totals, and timestamps.
Payment information: We do not store your card number, CVV, or bank details. Payment cards are processed directly by Square (a PCI DSS Level 1 certified processor) on behalf of the shop. We receive only a confirmation that the payment succeeded.
Device information: Push notification token (to send you order-ready alerts). Device type and OS version for crash reporting only — not linked to your identity.
Optional: Phone number, if you opt in to SMS order-ready alerts.

3. How we use your information

To process and fulfill your orders
To send you order status notifications (push and/or SMS if opted in)
To track loyalty stamps at shops you order from
To send order confirmation emails
To improve the platform and diagnose issues

We do not use your information for targeted advertising. We do not profile you for the purpose of selling advertising.

4. Who we share your information with

We share your information only in these limited circumstances:

The coffee shop you ordered from: Your name and order details are shared with the specific shop so they can prepare your order. Shops cannot see the data of customers who have not ordered from them.
Square: Your payment card is processed by Square on behalf of the shop. Square's privacy policy governs their handling of payment data.
Service providers: We use Supabase (database hosting), Expo (push notifications), Twilio (SMS, if opted in), and Resend (email). Each is bound by data processing agreements.

We do not sell your personal information. We do not share your information with data brokers, advertising networks, or social media platforms.

5. Data retention

Order history is retained for 2 years, then anonymized (items and totals are kept for analytics; your identity is removed).
Account information is retained while your account is active and for 30 days after a deletion request, then permanently deleted.
Push notification tokens are updated automatically by your device's operating system and rotated on each app open.
Crash and device data is retained for 90 days.

6. Your rights under the Colorado Privacy Act

If you are a Colorado resident, you have the following rights regarding your personal data:

Right to access: You may request a copy of the personal data we hold about you.
Right to correction: You may update your name, email, and phone number in the app at any time. For other corrections, contact us.
Right to deletion: You may request that we delete your account and associated personal data. We will fulfill deletion requests within 30 days.
Right to data portability: You may request your data in a portable, machine-readable format.
Right to opt out of profiling: We do not engage in profiling for advertising purposes. There is nothing to opt out of.
Right to opt out of sale: We do not sell your personal data. There is nothing to opt out of.

To exercise any of these rights, email privacy@localpour.app. We will respond within 45 days. We will not discriminate against you for exercising these rights.

7. Security

All data is transmitted over TLS 1.3. All data at rest is encrypted with AES-256. OAuth tokens from Square are encrypted before being written to our database and are never stored in plaintext. We follow industry-standard practices for access control and secret management.

8. Children

LocalPour is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe we have collected information from a child under 13, contact us at privacy@localpour.app and we will delete it promptly.

9. Changes to this policy

If we make material changes to this privacy policy, we will notify users via email or a prominent notice in the app at least 14 days before the change takes effect. The effective date at the top of this page reflects the most recent update.

10. Contact

For privacy questions or to exercise your rights:

Email: privacy@localpour.app
Mail: LocalPour LLC, Denver, Colorado