Privacy Policy — OrderUp KDS / Steel KDS

Last updated: October 11, 2026

1. Who we are

OrderUp KDS, now known as Steel KDS (the "app", "we", "us", "our"), is a point-of-sale and kitchen-display system used by food & beverage concessions. The app is published on Google Play under the developer display name 918 Mike. This policy applies to the app under both names, including all versions published as OrderUp KDS, and explains what data we collect, why, and how you can control or remove it.

2. Data we collect

We store only what is required to run your POS and Kitchen Display System:

• Account information — email, hashed password, role (admin/staff), organization name, email-verification status.
• Menu configurations — item names, categories, descriptions, custom sizes you create.
• Order history — order number, items, optional customer name typed by staff, status, timestamps, staff email.
• Verification & password-reset codes — short-lived 6-digit codes stored as one-way hashes.
• Device and location identifiers — a random installation ID generated by the app (not a hardware ID, phone number, or advertising ID), the device's role (order input or kitchen display), your organization's business location ID, and registration/last-seen timestamps. Used to route orders to the correct kitchen display.
• Data stored on your device — the app keeps order drafts, recent orders and kitchen tickets, pending uploads, and a copy of your menu in local storage on the device so it can keep working without internet. This data stays on the device until it syncs, expires, or the app is uninstalled or its data is cleared.
• Local network communication — when devices are on the same Wi-Fi network, the app discovers your organization's kitchen displays on that local network and sends order tickets to them directly. The local announcement includes your organization ID, location ID, device ID, and device role; tickets contain the order contents. This traffic stays on your local network and is not sent to us.
• Operational logs — anonymous server logs used to diagnose crashes. These do NOT include your menu or order data.

3. What we do NOT collect

• Payment/credit-card information — Steel KDS does not process payments.
• Customer profiles or loyalty data — optional customer names on tickets are freeform and never used for tracking.
• GPS or other geographic location data, hardware device identifiers (such as IMEI or serial number), or advertising IDs.
• Any personal data about your customers beyond the optional name typed on the ticket.

4. How your data is isolated

Steel KDS is multi-tenant. Every record is tagged with your organization ID and every API call is filtered by that ID before reading or writing. Users from other organizations never see your menu, orders, users, or sales reports.

5. Your deletion rights

You can selectively delete specific data or delete your entire account at any time. No support ticket required.

• In-app: open Settings → Data & Account. Admins can delete completed orders by date range, delete an entire menu category, or delete their account (which also deletes the organization, its orders, and its menu if they are the last user). Records containing only random device and location identifiers may remain until removed on request by email. Data stored locally on a device is removed by uninstalling the app or clearing its data.
• Publicly (no login required): visit /api/delete-account to request full account deletion OR selective data deletion (orders by date, custom menus, categories). Requests are actioned within 30 days.
• By email: contact support@steelkds.com from your registered email and include what you would like removed.

6. How long we keep data

We keep your account and order history for as long as your organization has an active account. Deletion requests are honored within 30 days. Backups rotate on a 30-day cycle; after that, deletions become permanent.

7. Sharing & third parties

We do not sell your data. We share it only with:

• Our transactional-email provider (used to send verification and password reset codes).
• Our infrastructure provider (hosts the API and database).
• Law enforcement, only when compelled by a valid legal order.

8. Security

Passwords are hashed with bcrypt. Sessions use signed tokens (JWTs) that expire after 24 hours. All traffic between the app and our servers uses HTTPS. Order tickets sent directly between your devices over your local network are not encrypted; use a private, trusted Wi-Fi network. Verification codes expire in 24 hours (email verification) or 1 hour (password reset). We never store plaintext codes or plaintext passwords.

9. Children

OrderUp KDS / Steel KDS is a business tool and is not directed to children under 13.

10. Changes to this policy

If we make material changes, we will notify admins by email and update the effective date at the top of this page.

11. Contact

For any privacy question, deletion request, or data-portability request, contact support@steelkds.com. We aim to respond within 5 business days.