Privacy Policy

Effective date: 11 November 2026

This policy explains what ФОП Рудик Андрій Ярославович (FOP Rudyk Andrii Yaroslavovych) ("we", "us") collects when you use the WaiterBolt app, and what we do with it.

1. Data processed by default

This happens whenever you use the app, without any consent switch. Analytics and crash reports are not part of it (see section 2).

• Account data: your email address, or the account identifier and email we receive from Apple or Google if you sign in with them. You sign in with a one-time code sent to your email, or with Apple or Google; we do not use passwords. Also your display name (if you set one) and language.
• Work data you enter: workspaces, tables, orders, order items, menus and menu items, comments, staff names, business details for receipts (name, address, phone, tax rate you type in), payment entries (a label such as cash, card or other, amount received, tip, change), cash shifts, and your app settings.
• Device data sent to our servers: a push token, platform, language and app version (only for staff in a workspace with push notifications on). For a manager's device limit: a random install ID and the device name you type. Our servers do not receive your device model or OS version.
• Subscription state: the status and expiry of a workspace's subscription, received from RevenueCat, which receives purchase information from the Apple App Store or Google Play. RevenueCat identifies a purchase by the workspace ID, not by your email. We do not collect or see your payment card details.
• Menu photos: only if you use menu recognition (see section 4).
• Feedback: if you send a "rate us" message, it goes through a Firebase Cloud Function to our support mailbox, with your email as the reply address.
• Onboarding video: its thumbnail and link are loaded from YouTube (Google), so your device contacts Google when it is shown.
• Technical data: your IP address is processed to apply rate limits and protect the service, and appears in technical server logs (see section 6).

2. Only with your consent

At the end of onboarding the app asks for one analytics consent. It is off by default, and you can change it at any time in the app's Settings. If you have not been asked yet, or you updated the app and never answered, it counts as off. This one switch covers two purposes: usage analytics and crash reports. Until you turn it on, none of the following is collected.

• Firebase Analytics and Mixpanel: events that describe actions in the app (for example "an order was created"), to understand how the app is used. Mixpanel is used only in production builds, and its automatic events are on. The events carry no email, phone number, user ID, workspace ID, staff or guest name, item names or text you type. They can carry random identifiers of objects such as orders, halls, menu items and categories, amounts and prices, a subscription product or plan identifier, and your role (manager, waiter or kitchen). The app does not set a user ID; the Firebase and Mixpanel SDKs use their own installation identifier by default, and, as with any internet request, the providers also receive your IP address. After you withdraw consent no new events are sent; identifiers and properties already stored by the SDKs on your device are not cleared by the app.
• Crash reports (Firebase Crashlytics): when the app crashes or hits an error, a report is sent to Google (Firebase), not to us. A report contains the type of the exception and the stack trace (file paths and function names, not the error message text), the app version, the OS version, the device model, a random installation identifier created by Firebase, a fixed sign-out reason code and a short diagnostic note that contains no workspace ID and no error text (for HTTP errors only a status code). Recent log lines from the app are included after a filter that masks emails, tokens and long identifiers; the filter is best-effort, so we cannot promise that an identifier will never appear in a report. We deliberately do not attach your email or a user ID to reports.
• Meta (Facebook) app events: only after you consent and, on iOS, only if you also allow tracking in the system App Tracking Transparency prompt. Four events are shared for ad measurement: first order, workspace created, trial or subscription started, and first order by a manager. The only parameter sent with them is the store's subscription plan ID. We do not send your email, phone number, user ID or workspace ID to Meta. On iOS, with your permission, the events are sent together with the advertising identifier (IDFA); if you decline the tracking prompt, no events are sent to Meta at all. On Android no advertising identifier is collected: the single analytics consent is enough, and events are sent without one. The Meta SDK adds technical data to these events, such as device model, OS version, language and app version, and, as with any internet request, Meta also receives your IP address. The Meta SDK is initialised when the app starts and may technically connect to Meta (for example to load its settings), but no events are sent before you consent.

Withdrawing. Turn the switch off in Settings: new collection stops immediately and crash reports that were not yet sent are deleted on your device. Reports already sent stay with Google/Firebase under Firebase's own retention. After you withdraw, no new events are sent to Meta. Events already queued on your device before you withdrew may still be sent. On iOS you can also withdraw tracking in the system Settings under Privacy & Security, Tracking. If you decline, the app works the same.

Note: our own servers do not receive your device model or OS version (see section 1); crash reports go to Google, not to us.

3. How we use it

To provide and secure the service, sync your data between your devices and teammates, send the push notifications you have enabled, send one-time sign-in codes and other account emails, verify subscriptions and fix problems. Only with your consent: find and fix crashes, understand app usage and measure advertising. We do not sell your data.

4. Service providers and recipients

• Hetzner Online GmbH (Germany): hosts our servers and database.
• Resend (EU region, Ireland): sends our emails, such as one-time sign-in codes; it receives your email address and the message.
• Apple and Google: sign-in with Apple or Google (we receive the identity token and the account identifier and email you allow), and the App Store / Google Play for purchases.
• Google Firebase: Cloud Messaging (push notifications), Cloud Functions (feedback messages) and, only with consent, Crashlytics (crash reports) and Analytics.
• Mixpanel: product analytics, only with consent.
• Meta: ad measurement events, only with consent and, on iOS, tracking permission.
• RevenueCat: manages and reports subscription status.
• YouTube (Google): onboarding video thumbnail and link.
• Google Cloud Storage (Frankfurt, Germany): stores our encrypted database backups (see section 6).
• Anthropic (United States), menu recognition only: when you use menu recognition, the photo of a paper menu that you take with the camera or pick from the gallery is sent as the original file, without resizing, to our menu recognition service, which sends it to Anthropic's API to extract menu items. The photo can contain metadata such as EXIF data (for example the date, and the location if your camera records it); the app does not remove it. Our service does not store the photo. Anthropic processes the photo under its own terms. This is a transfer of data to the United States; you can avoid it by not using the feature.

Apple, Google, Meta, Mixpanel and RevenueCat may process data outside the EU/EEA under their own terms.

5. Data on your device and sharing in a workspace

Sign-in tokens are kept in your phone's secure storage. Orders, menu and staff data are kept in a local database on your phone, which the app does not encrypt itself. A photo you pick from the gallery for a menu item is copied into the app's private folder on your device and is never uploaded. Only its file name is synced to our server, so your other devices do not show the photo.

Files you create and share. Menu exports (CSV, Excel, JSON, TXT; managers only) and PDF receipts and kitchen tickets are created on your device, without a network call, and go only where you choose in the system share or print dialog. The app has no feature to export all of your data.

Diagnostics log. The app keeps a technical log on your device. A manager can share it from Settings; it may contain technical identifiers, and it is shared only if you choose to.

Database copy after a failed update. If a local database upgrade fails, the app offers to email a copy of the local database to our support address or to share it through the system share sheet. The copy can contain menu, orders and staff names. It is sent only if you choose to.

Data you enter in a workspace is visible to the other members of that workspace according to their role (for example manager, waiter, kitchen). Nothing is shown publicly.

6. Retention, logs and deletion

Logs. Our servers keep technical logs that can contain IP addresses (and, for the menu recognition service, the browser/app User-Agent and the requested URL). Logs are rotated automatically by size, so old entries are overwritten; there is no fixed retention period. We use them only for security and troubleshooting.

Menu recognition usage record. For each menu recognition request our service also writes a technical record: time, the first characters of the client key, token counts, processing time, model, whether it succeeded and an error code. It contains no user ID and no photo. It has no automatic expiry.

Deletion. We keep your data while your account is active. A workspace manager can delete their account in the app (Profile, Delete account). Deleting that account removes:

• the manager's sign-in record (email, sign-in methods) and all their sessions;
• the whole workspace with everything in it: members, invite codes, menus, orders and its subscription record. Other members of that workspace lose access to that data.

Staff accounts. Waiter and kitchen accounts are anonymous: they have no email and no password and are created by redeeming an invite code issued by a manager. A manager of the workspace can remove a waiter or kitchen device in the app. Removal revokes access (sessions end within minutes); it does not delete data. After removal, the staff member's display name, device name and the link between them and the orders they created stay in the workspace records (order history) until the workspace is deleted. Staff have no in-app way to request deletion. A staff member who wants their data removed should ask their manager. They may also write to app-support@andrud-software.com with the workspace name and their name; we will try to pass the request to the workspace manager, but we may not be able to identify them, and the decision on the records of the workspace belongs to the workspace.

What stays outside our systems. We cannot delete records held by Apple, Google and RevenueCat (purchases and subscription history), or data already sent to Firebase (Crashlytics and Analytics, if you consented), Mixpanel and Meta; they keep it under their own policies. Anthropic handles menu photos as described in section 4.

Backups. A nightly encrypted database dump is stored in Google Cloud Storage and automatically deleted after 30 days, so deleted data can remain in backups for up to 30 days.

7. Your rights

Depending on where you live (for example the EU/UK under GDPR, or California under CCPA) you may have rights over your data, such as access, correction or deletion. Requests about your data can be sent to app-support@andrud-software.com, and we handle them as the law requires; for staff accounts see section 6. You may also complain to your local data protection authority.

8. Security

Data is transmitted over HTTPS and access is restricted by role. No system is perfectly secure, so we cannot guarantee absolute security.

9. Children

The service is meant for restaurant staff and owners and is not directed at children. We do not knowingly collect children's data.

10. Changes

Changes to this policy are published on this page with a new effective date.

11. Contact

ФОП Рудик Андрій Ярославович (FOP Rudyk Andrii Yaroslavovych), Україна, м. Тернопіль, вул. Фабрична 5 (5 Fabrychna St., Ternopil, Ukraine)
app-support@andrud-software.com