who we are
The Daily Press ("we"), 22001 Michigan Ave, Suite 150, Dearborn, MI 48124. questions about this policy or your data go to support@dailypresscafe.com.
what we collect and why
we only ask for what the order or the account needs. optional fields are marked optional.
| category | what it is | why |
|---|---|---|
| account | name, email, password (stored hashed), optional phone and birthday | run your account, your press pass and rewards, the birthday treat; your phone number, if you add one, lets the barista find your points at the counter (we don't text or call it) |
| orders | items, pickup name, phone, email for the receipt, order history; for delivery, when it's offered, also the address and drop-off notes | make and hand off the order, send the receipt and status, handle problems, keep the books |
| curbside (app) | your car's color, make and model, the plate if you add it, and the spot you park in. if you allow location, the app checks on your phone whether you're at the cafe; your location is never sent to us | bring your order out to the right car |
| rewards | press points ledger, reward redemptions, promo codes you claim, and a one-way code made from your email address (and phone number, if you added one). for points at the counter: which register payment earned them, its time and its amount before tax (read from Clover, never card details) | count and honor your points and promos, and give the sign-up bonus and the birthday treat to each person once |
| gift cards | if you link one: its number and security code (stored encrypted), its last 4 digits, its balance and when we checked it. if you add it to Apple Wallet: your device's wallet id and a push token | show your balance and pay when you choose, and keep the balance on your wallet pass current |
| devices | push notification token and platform, only if you allow notifications in the app | order status pushes; news and offers only if you turn those on |
| website | your cart, your checkout contact details and your last order link, saved in your own browser (see storage below) | keep your order between pages and visits |
| security | counts of failed sign-ins and password reset codes, stored only as a one-way hash of the email or ip address | stop password guessing |
| error reports | when something breaks on the website or in the app: the error message, where in our code it happened, the page or screen (without the end of its address, where order codes go), your browser or phone type, and the version of the site or app. email addresses, phone and card numbers and sign-in codes are blanked out of the message. no name, account, ip address, cookies or device id | find and fix what broke |
we don't use analytics scripts, advertising pixels or cross-site tracking, and we don't make automated decisions about you.
payments
cards are processed by Clover (Fiserv), our payment processor. on the website and in the app the card number is typed into Clover's secure hosted form, so it never reaches our servers and we never store it. we keep only the payment status and Clover's payment reference with the order record. if you pay with Google Pay on the website, Google passes the card you pick, your billing address and your email to Clover for the payment; we don't keep them. if you pay with Apple Pay, Apple sends Clover an encrypted copy of the card you pick, which only Clover can read, with your billing address; we don't keep them either. a gift card you link is different: see gift cards.
gift cards
if you link a gift card to your account, we store its number and security code encrypted, to show the balance and pay when you choose. they only go to Clover, which holds the balance. you can remove a card any time on your account page, and both are wiped. deleting your account does the same.
if you add a card to Apple Wallet, the pass on your device shows the balance, the card number and a barcode of it, never the security code. removing the card stops the pass working.
face id and fingerprint
biometric unlock in the app happens entirely on your device through Apple or Google. we never receive or store biometric data.
who receives it
each service gets only what its job needs:
- Clover (Fiserv), our payment processor: card and gift card payments, gift card balances and refunds, as described in Clover's privacy policy.
- Apple Pay, only when you choose it at checkout: Apple shows its payment sheet and hands your card to Clover, as described in Apple's privacy policy.
- Apple Wallet, only when you add a gift card to it: Apple's push service tells the pass on your device when its balance changes, as described in Apple's privacy policy.
- Google Pay: at checkout, in browsers that offer it, Google's payment script loads in Clover's secure frame and our page checks once, without cookies, that it can reach Google, so Google receives your ip address and details about your browser. only when you choose Google Pay does Google show its payment sheet and hand your card to Clover, as described in Google's privacy policy.
- Vercel: hosts the website and our api; Neon: hosts our database. both in the united states.
- Resend: sends order receipts and account emails.
- Expo: delivers push notifications to the app.
- our delivery partner, only when delivery is offered and you choose it: your name, phone, address and drop-off notes, so the driver can find you.
- Google Maps: the map on our home and contact pages stays off until you tap "show map", so nothing loads from Google before that. once you tap it, the map loads from google.com: Google receives your ip address and may set its own cookies, as described in Google's privacy policy.
- Google reCAPTCHA: Clover's card form uses it to stop fraud. when the card form loads, Google receives your ip address and details about your browser and device, as described in Google's privacy policy.
we don't sell or share personal information for advertising, so there is nothing to opt out of. if that ever changes we will add an opt-out link to the footer before it does.
cookies and storage
we set two cookies, and only when you sign in: they keep you signed in, and scripts on the page can't read them. the site also keeps three items in your browser's local storage. all of them are strictly necessary:
| name | purpose | how long |
|---|---|---|
| dp_at | cookie: shows the site you're signed in | up to 15 minutes, renewed while you use the site |
| dp_rt | cookie: renews your sign-in so you don't retype your password | until you sign out, or 400 days after your last visit (30 days for cafe staff) |
| dp.cart.v1 | your cart and how you're getting it (with the address for delivery, when it's offered) | until you order or clear it |
| dp.contact.v1 | the name, phone and email you typed at checkout, so you don't retype them | until you clear your browser data |
| dp.lastOrder.v1 | a link back to your most recent order's tracker | until you clear your browser data |
on the checkout page Clover's secure card form may set strictly necessary cookies for fraud prevention and to complete the payment. you can clear local storage any time in your browser settings.
news and offers
order updates are part of the service. news and offers are separate: they are off until you switch them on in the app, and you can switch them off any time in account settings. every marketing email has a one-click unsubscribe.
how long we keep it
- account details: until you delete the account.
- the one-way code made from your email address and phone number: kept after you delete your account, so the sign-up bonus and the birthday treat go to each person once. it can't be turned back into your email or number.
- order and payment records: seven years, for tax and bookkeeping. after an account deletion they are kept without your name.
- guest checkout details: kept with the order record above.
- a linked gift card's number and code: wiped when you remove the card or delete your account. its last 4 digits stay on orders you paid with it.
- the device id and push token behind a gift card's wallet pass: until the pass leaves your device.
- push tokens: until you sign out, uninstall the app, or 90 days without use.
- hosting request logs (including ip addresses): kept briefly by our hosting provider for security, then discarded.
- failed sign-in and reset code counts (hashed, see above): up to 25 hours.
- sign-in sessions (the ip address and the app or browser each sign-in came from): deleted 30 days after the session expires or is signed out.
- error reports: deleted after 14 days.
your choices and requests
you can ask to see, correct, export or delete the information we hold about you, or ask us to stop using it. email support@dailypresscafe.com from the address on your account or order so we can confirm it's you. guests can use the email from their receipt. we answer within 30 days.
you can also delete your account yourself in the app (account → delete account). the full steps are on delete your account.
children
accounts are for people 13 and over. we don't knowingly collect information from children under 13; if you think we have, email us and we will delete it.
security
every page and api call runs over https, passwords are hashed, payment card numbers never touch our systems, and linked gift card numbers and codes are stored encrypted. no system is perfect; if something goes wrong we will tell affected people promptly.
changes to this policy
each version is dated at the top of this page. before a material change to how we use your information takes effect we will announce it in the app's news feed and by email to account holders.