How we use data

This is the plain-language version. For the full detail, see our Privacy Policy.

The short version

We collect only what we need to run your orders, we never sell your personal data, and you can export or delete your account at any time from settings. Here's the quick tour.

What we collect when you use Queshot

• Account — your name, email, phone and suburb.
• Orders — what you order, your "usual", and your order history.
• Payments — handled by Stripe; we never see or store your full card number.
• Location — only your approximate location, only while you have an active order or have turned on Kerbside

or auto-order, and only with your permission.

• Device & usage — basic device information and how you use the app, to keep it working and fix problems.

Cookies and similar technologies

Our website uses essential cookies to work properly, and may use analytics cookies to understand how the site is used. You can control or clear cookies in your browser. The mobile app does not use website cookies but uses similar device identifiers for analytics and error monitoring. In particular:

| Name | Set by | Purpose | Type | |---|---|---|---| | `ph_*_posthog` | PostHog (United States) | Recognises your browser between visits so we can measure product usage, heatmaps and session replay | Cookie / local storage | | `_fbp` | Meta Pixel (only set when advertising campaigns are active) | Identifies your browser to Meta so we can measure ad performance | Cookie | | `_fbc` | Meta Pixel (only set when advertising campaigns are active) | Records that you arrived via a Facebook/Instagram ad click, for ad measurement | Cookie | | `_ga` | Google Analytics/Ads (only set when advertising campaigns are active) | Distinguishes your browser for Google ad and analytics measurement | Cookie | | `_ga_*` | Google Analytics/Ads (only set when advertising campaigns are active) | Site/property-specific counterpart to `_ga` | Cookie | | `_gcl_au` | Google Ads (only set when advertising campaigns are active) | Stores a recent ad click so a later conversion can be attributed to it | Cookie | | `_gcl_aw` | Google Ads (only set when advertising campaigns are active) | Records that you arrived via a Google Ads click, for conversion measurement | Cookie |

Advertising pixels

Only while our advertising campaigns are active, we use the Meta Pixel and Google Ads tag (gtag) on our website to measure whether our ads work — for example, whether someone who clicked an ad went on to join our waitlist. We use your browser's reported time zone to avoid enabling them for visitors who appear to be browsing from the EU/EEA, UK or Switzerland. You can turn them off at any time with the "Turn analytics off" control at the bottom of this website (the same switch that turns off PostHog), or directly through Meta's and Google's own ad-preference pages:

• Meta: facebook.com/adpreferences
• Google: adssettings.google.com

Analytics and session replay

We use PostHog (autocapture, heatmaps and session replay — with everything you type masked) and Sentry (to catch and fix errors and crashes) to understand how the Platform is used and to keep it working well. We do not put personal identifiers such as your name, email or phone number into analytics events — events and recordings are keyed to an internal account identifier, or an anonymous device identifier if you are not signed in. Analytics events may include a coarse, city-level location worked out from your IP address; we discard the IP address itself immediately after that lookup. See our Privacy Policy clause 5 for full detail.

Location and geofencing

Kerbside and auto-order use your approximate location to time your coffee to your arrival. A single privacy radius controls when auto-order triggers. You can turn location off any time in your device or app settings — the rest of Queshot still works.

Who we share data with, and where it goes

We share data only with the café you order from (to fulfil your order) and the service providers that run the Platform: Stripe (payments), Supabase (database, sign-in, image storage), Resend (email), ClickSend (SMS codes), Google (Maps and push delivery), PostHog and Sentry (analytics and error monitoring), and — only while our advertising campaigns are active — Meta Platforms and Google again, for advertising measurement (see "Advertising pixels" above). Some of these store or process data overseas, including in the United States and the EU/EEA. We take reasonable steps to ensure they protect your information consistently with Australian privacy law.

Your choices and controls

• Notifications — service messages (order updates, security codes) come with the service; **marketing is

opt-in** and you can unsubscribe any time.

• Analytics — turn analytics and session replay off any time in Settings → Privacy, or ask us at

support@queshot.com.

• Your data — access, correct, export or delete your account and data in Settings → Account, or by

emailing support@queshot.com. If you delete your account, we delete or de-identify your data; we may keep de-identified records — which no longer identify you — solely to improve Queshot's forecasting models.

Learn more

Full detail — including your rights, retention, overseas disclosure and how to make a privacy complaint — is in our Privacy Policy. Questions: support@queshot.com.