Privacy Policy

Last updated: July 14, 2026

vlo ("vlo," "we," "us") runs a small coffee club: a host app used to run events and manage a live drink-order queue, and a guest ordering page reached through a private per-event link. This policy explains what we collect, why, and who we share it with. We keep it deliberately short because we collect deliberately little.

Information we collect

Hosts (people who run events using the vlo iOS app):

• Sign in with Apple — the name and email address Apple shares when you sign in. If you use Apple's "Hide My Email" relay, we only ever see the relay address.
• Phone number — collected and verified by a one-time SMS code when you create or access a host account.
• Device push token — an Apple-issued token for your device, so we can send order and approval notifications.

Guests (people who order through an event link):

• Name you enter with your order.
• Phone number — optional. If you provide one, it is used only to text you when your order is ready. We store it and only ever show it back masked (last four digits).
• Order details — the items and options you select.

Collected automatically:

• Standard request logs (e.g. timestamps and a request identifier) for reliability and abuse prevention.
• An anonymous per-browser identifier used for aggregate, privacy-preserving usage counts (e.g. how many people viewed an event). It is not tied to your identity.

How we use it

• To operate the ordering flow and the host's live order queue.
• To send transactional notifications — host push notifications (new orders, approvals) and, if you opted in, a guest "order ready" text.
• To verify host accounts and gate access to host features.
• To keep the service secure, debug issues, and understand aggregate usage.

We do not sell your personal information, and we do not use it for advertising.

SMS order notifications

When you place an order through an event link, you may optionally provide a mobile phone number. If you do, you are opting in to receive transactional SMS messages from vlo about that order — specifically, a text letting you know when your order is ready for pickup (for example, "hi alex, your vlo order is ready — come grab it").

• How you opt in. Providing your phone number on the order form, where the consent language appears, is how you opt in. Leaving the number blank means you receive no texts.
• Message frequency. This is not a recurring or marketing program. We send roughly one message per order (an order-ready notification), plus a possible reply to a keyword you send.
• Cost. Message and data rates may apply, depending on your mobile carrier and plan.
• Opting out and help. Reply STOP to any message to opt out of further texts, or HELP for assistance. You can also email us at the address below.

We do not sell or share your mobile phone number or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. Your number is shared only with our messaging provider (Twilio) as needed to deliver these texts, as described below.

Who we share it with

We share data only with the service providers that make the app work, and only as needed to provide it:

• Apple — Sign in with Apple and push notification delivery (APNs).
• Twilio — sending verification and order-ready SMS messages.
• Google Cloud — application hosting, database, and secret storage for the backend.
• Firebase Hosting — serving the guest web page.

We may also disclose information if required by law, or to protect the rights, safety, and security of vlo and its users.

Data retention

We keep information for as long as needed to run the club and its events, and then delete or anonymize it. You can ask us to delete your data at any time using the contact below; note that some records may be retained where we are legally required to keep them.

Security

Data is encrypted in transit (HTTPS/TLS). Credentials and keys are held in managed secret storage, and host authentication tokens are stored in the device keychain. No system is perfectly secure, but we take reasonable measures to protect your information.

Your choices

• Notifications — you can turn off push notifications in iOS Settings, and providing a phone number for guest texts is optional.
• Access and deletion — email us to request a copy or deletion of your data.

Children

vlo is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

Contact

Questions or requests about your privacy? Email milansgupta99@gmail.com.