Privacy Policy

Who we are

Coffee360 (“Coffee360,” “we,” “us”) is a product of ExecutorPlus Inc., dba Kinship360, a Delaware corporation, operated in the United States. Coffee360 is a Kinship360 service. This service is intended for users in the United States only. This policy explains what we collect, how we use it, and your choices. If you don’t agree with it, please don’t use the service. Questions: privacy@coffee360.org or by mail at 5865 Neal Ave N, PMB 205, Stillwater, MN 55082-2177.

What Coffee360 does

Coffee360 helps one person (a “coordinator”) collect a group’s coffee or food order, place one combined order, and settle up. We are not a payment processor and never hold or move money — settling up happens directly between people through their own apps (Venmo, PayPal, Cash App, etc.). We only calculate totals and open those apps by link.

Information we collect

You give us:

• Your sign-in identity — your phone number (a one-time code by text), or your email address (a one-time code by email), or the identifier Google or Apple gives us when you sign in with them. It’s your login and isn’t shown to other users. A phone number is required to coordinate a run.
• Profile details — your name, optional avatar, and any payment handles you choose to save (e.g. your Venmo username) so others know where to pay you. These are handles only — we never collect or store card or bank details; settling up is person-to-person, off-platform.
• Your preferences — saved favorite orders, saved places, birthday, and any dietary preferences or allergies you enter.
• Contacts you add — when you add people to coordinate with, we store what you enter about them. If you add information about other people, you’re responsible for having a basis to share it; those individuals may email us to access or remove their information.
• Order activity — the runs you create or join, items, and settlement status.
• Feedback you submit, including any screenshot you attach. Feedback is kept for 90 days and then deleted.
• Push notifications — if you install the Coffee360 app and allow notifications, we store the device’s push token so we can notify you about runs. Tokens are deleted 180 days after the device was last seen.

Collected automatically: basic technical data needed to run and secure the service (session tokens, standard server/security logs including IP address, and error reports that are scrubbed of phone numbers, email addresses and links before they leave the browser). We do not use advertising trackers or analytics cookies, and we do not knowingly collect precise geolocation or biometric data.

How we use it

To provide the service (run coordination, sign-in, saved preferences, payment links), to keep it secure and working, to respond to your feedback and support requests, and to comply with law. We do not sell or “share” your personal information for advertising, and we do not use it for cross-context behavioral advertising.

Text messages (SMS)

If you use a phone number with Coffee360, we text you one-time sign-in codes. These are transactional messages, not marketing; we do not send marketing texts. Reply STOP to any message to opt out of texts at any time. Message and data rates may apply.

Who we share it with, and what others see

You control sharing by choosing who to connect with. When you connect with someone, you share your saved preferences with that person; you can decline or disconnect at any time. Beyond that, information is shared only:

• With other participants in a run — they see what’s needed to coordinate (e.g. the coordinator’s saved payment handles; your order in that run).
• With service providers that run the product for us, each of which processes data only to provide that service to us: Vercel (hosting and server logs), Cloudflare (content delivery, bot protection at sign-in, and cookieless site analytics — all traffic to the site passes through Cloudflare), Supabase (database and sign-in, including delivery of one-time codes by text and email), Google and Apple (only if you sign in with them), Resend (the emails we send), Stripe (membership billing — Stripe, not Coffee360, collects and stores your card details), Expo (push notification delivery), Sentry (error reports, scrubbed as described above), and Neon (feedback storage).
• With people you invite — if you ask us to email an invitation, the recipient sees your display name and any message you wrote.
• With your calendar provider — if you (as a Member) subscribe to the birthday calendar feed, your contacts’ first names, birthdays and favorites are delivered to the calendar app you point at the feed link. Keep the link private; you can reset it in the app.
• For legal reasons — if required by law or to protect rights and safety.

We do not sell your personal information.

Where your data is stored

Your data is collected, processed, and stored in the United States with our providers. This is a US-only service.

Your choices and rights

You can:

• Access / download your data — “Download my data” in your profile exports your information.
• Correct your profile details in the app.
• Delete your account / data — choose “Delete my account” in your profile (we confirm with a one-time code) and your account, profile, preferences, saved places, devices and contact list are erased within 30 days. Your membership is canceled first. Orders in runs still in progress are kept as “Deleted user” without your name, phone or account so everyone else’s totals stay correct; consent and billing records are kept in anonymized form only, because we’re required to. Details: coffee360.org/account/delete. You can also email privacy@coffee360.org.
• Withdraw messaging consent — manage consent in your profile.

Email privacy@coffee360.org to exercise any right. You can manage most settings in your profile.

Your US privacy rights

If you're a California resident, the CCPA/CPRA gives you the right to know and access the personal information we hold about you, to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and to not be discriminated against for exercising any of these rights. Residents of other states with privacy laws (including Virginia, Colorado, Connecticut, and Utah) have similar rights.

To exercise any of these rights, email privacy@coffee360.org. Where state law treats the Global Privacy Control (GPC) browser signal as an opt-out of sale or sharing, we honor it — and because we don't sell or share personal information, there is nothing to opt you out of.

Do Not Sell or Share My Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. This applies to everyone who uses Coffee360, in every state, without your having to ask.

Security

We use reasonable technical and organizational measures (encrypted connections, access controls, parameterized database access). No system is perfectly secure, so we can’t guarantee absolute security.

Retention

We keep your information while your account is active and as needed to provide the service, then delete or de-identify it, except where longer retention is required by law. Some records are removed on a fixed schedule whether or not your account is active:

• Guest preferences — if you order through a link without an account, the preferences we hold for you are deleted 14 days after your last activity unless you claim them by signing in.
• Sign-in and request rate-limit records — kept for 7 days.
• Family-plan seat invitations — if a seat you were offered is withdrawn, the name and phone number on that invitation are removed 30 days later.
• Delegate activity history — the log of what someone acting on your behalf viewed or changed is kept for 30 days, or 180 days for entries that touched dietary or allergy information.
• Pick-a-contact handles — the short-lived codes used to add someone to a run are deleted once used, or 1 day after they expire.

Children’s privacy

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (COPPA). Our Terms require users to be at least 18. If you believe a child has provided us information, please contact us and we'll delete it.

Changes

We may update this policy and will revise the “Last updated” date; we’ll communicate material changes in the app.

Contact

Questions about this Privacy Policy: privacy@coffee360.org — ExecutorPlus Inc., dba Kinship360 · 5865 Neal Ave N, PMB 205, Stillwater, MN 55082-2177.