🔒 Your data, explained

How the Templehall Cafe app and website handle information, in plain English. Checked 28 October 2026.

This is a demo preview, with no lock. It holds made-up example data, and nothing on it is encrypted, so please don't type real customer details into it. Gav's real app works as described under “The real app” below: it's always locked.

The app keeps your cafe's information on your phone. The one thing that leaves the phone without you choosing is a website order when kitchen printing or “pay first” is on. A copy of that order waits on our server so the printer can collect it, and it's deleted 48 hours after the order was made.

The lock

The real app is always locked with your passcode or Face ID / fingerprint, and you can't switch the lock off. Everything on it (orders, customers, takings, receipts and their photos, prep lists, the food safety log, notes and your logo) is encrypted on the phone.
This demo preview has no lock, so anyone with the link can open it, and its example data is stored on the phone without encryption. That's why it only holds made-up examples.

Website orders and the kitchen printer

When a customer orders on the website with kitchen printing or “pay first” switched on, their order (what they ordered, collection or delivery time, name, any note, and the phone number and delivery address if they gave them) is sent to Clarity's server, which runs on Cloudflare. It waits there so the printer can collect it and print a ticket, and so a payment can be matched to it.
Each order is deleted from the server 48 hours after it was made. New orders don't keep older ones for longer.
Only the cafe's app can list those orders, using a key kept in the app. The printer has its own private link that only collects tickets. A customer can only pay for, or switch to cash on, their own order.
Ordering by WhatsApp or text goes from the customer's phone straight to the cafe's phone. It doesn't pass through our server.
With printing and “pay first” both off, website orders aren't kept on our server at all.
Demo: orders on this preview go to a test queue on the server, for this browser only, and are deleted after 48 hours in the same way. Nothing is charged.

What's public, by your choice

When you tap Publish, your menu, prices and opening hours go on your website for anyone to see. The server also keeps a copy of your menu prices, so website orders are always priced from your menu and not from the customer's phone.

Counting visits

The website's visit counter doesn't use cookies or keep IP addresses. Each visit becomes a scrambled code that changes every day. Daily totals are kept for up to 13 months, then deleted.
Clarity's visit counter is also on this page and the app. It notes the time, the device type (phone, tablet or computer) and the rough town. Clarity HQ can get a note the first time a preview is opened. No names, no IP addresses kept, and nothing you type. Counts are kept for 13 months, then deleted.
No cookies or ads. You can turn both counters off for your device with “Don't count me” on the privacy page.

Backup

Real app: you pick a backup password (separate from your passcode). The backup is encrypted on your phone with it before it's saved, either as a file or, if you switch it on, in Clarity's cloud storage. We store only the scrambled backup, when it was saved and its size. We can't read it.
Demo: cloud backup is switched off on this preview. You can still save a backup file.
Forget the backup password, and nobody can get the backup back, not even Clarity HQ. Save it in iPhone Passwords or write it down somewhere safe.

What Clarity HQ can and can't see

We can see: your published menu and prices (public anyway); website visit totals (no names); website orders while they're in the print queue, for up to 48 hours (we only use them to print and match payments); a scrambled copy of your website PIN, not the PIN itself; and, if you switch on cloud backup, that a scrambled backup exists, its size and when it was saved.
We can't see: what's saved inside the real app (orders and customers you keep there, takings, receipts, prep, the safety log, notes), your passcode, your backup password or what's inside a backup.

Honest limits

Forget your passcode and have no backup? Nobody can get the real app's data back, not even us. Switch on backup.
Our web host, Cloudflare, carries every connection and, like any web host, sees IP addresses as they pass. We don't store them. To stop anyone flooding the order system, the server keeps a short-lived count per connection under a scrambled code, dropped after about 12 minutes.
While the real app is unlocked, anyone holding your phone can see it. It locks itself after 5 minutes away.

Check it yourself

Padlock: the address bar shows a padlock and https://, so the connection is encrypted.
Lock test (real app): close the app and open it again. It asks for Face ID or your passcode before anything shows. (This demo opens straight away because it has no lock.)
Print queue: 🖨️ Print orders in the app lists the tickets on the server. Anything older than 48 hours has gone.

Technical note (real app): the app is encrypted with AES-256-GCM using your browser's built-in Web Crypto. A random key encrypts the data, and that key is itself locked by your passcode (PBKDF2-SHA256, 600,000 rounds) or a Face ID / fingerprint passkey (WebAuthn PRF + HKDF). Backups use a key from your backup password (PBKDF2-SHA256, 600,000 rounds, random salt). Print queue: each order is its own record on Cloudflare KV and is deleted 48 hours after it was made (6 hours if it's waiting for payment). The list of orders holds no names, phone numbers or addresses, just order ids, times and payment status. The owner and printer keys are stored only as SHA-256 hashes.