CafeKeeperPrivacy policy
Last updated 24 October 2026
In short
- Your café's data (orders, stock, prices, books) is locked on your phone before it leaves. We can't read it.
- We don't sell data, show ads, or use tracking or analytics.
- We can see only what we need to run the service: your Google email and name, when you sync, and how much locked data you store.
- Questions or deleting your account: cafekeeper-support@googlegroups.com.
Who we are
CafeKeeper is made and run by Daedalus Labs. When this policy says "we", it means Daedalus Labs. Contact us at cafekeeper-support@googlegroups.com.
What is locked: everything you enter
Everything you put into CafeKeeper (orders, customers, stock, suppliers, prices, recipes, books) and the names of your phones are encrypted on your phone (AES-256) before they're saved to our servers. Backups are copies of that locked data. Only phones signed in to your Google account can unlock it. Not even we can read it.
What we can see
To run the service, our systems can see:
- your Google account's email address and name;
- when you sign in and when your phones sync;
- how many phones are signed in to your account;
- how large your locked data is;
- if you asked for an invite: the name, Gmail address and note you sent, and whether you were invited.
Google sign-in and Google Drive
You sign in with your Google account. CafeKeeper asks Google for one extra permission: a hidden app folder in your Google Drive that only CafeKeeper can use. We keep one small, locked file there: the key your phones need to unlock your data. CafeKeeper can't see or change any of your other Drive files, and the folder doesn't appear in your Drive.
Google's access token is used once on your phone to read or save that file, then forgotten. It is never sent to our servers or stored.
CafeKeeper's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
On your phone
What CafeKeeper saves on your phone is also locked, with a key kept in your phone's secure hardware (Android Keystore). It isn't included in your phone's cloud backups.
Who processes data for us
| Service | What for | What it handles |
|---|---|---|
| Supabase | Database and sign-in (servers in Mumbai, India) | Your email and name, sign-in records, your locked data and backups |
| Sign-in, the hidden Drive folder | Your Google account, the locked key file | |
| Cloudflare | This website | Website visits |
We don't use Google Fonts, advertising or analytics services.
How long we keep data
- Your account and locked data: as long as you use CafeKeeper.
- Automatic backups: every 6 hours, kept for up to 7 days.
- If you ask us to delete your account: we delete it and all its data, including backups, from our servers. Data saved on your phone stays there until you uninstall the app.
Your choices and rights
You can ask us to see, correct or delete the information we hold about you by writing to cafekeeper-support@googlegroups.com. We answer within 30 days. This is also our contact for complaints under India's Digital Personal Data Protection Act, 2023.
Children
CafeKeeper is a tool for businesses and isn't meant for anyone under 18.
Security
Besides the encryption above, access is invite-only, every request is checked by the database itself, and a lost phone can be signed out from another phone. No system is perfectly secure, but your data's contents stay locked even if our servers were breached.
Changes to this policy
If we change this policy we'll update the date above. For important changes we'll tell you in the app or by email before they take effect.