Sample template. This notice describes what the Yare app and its checkout server do with personal data, as they are built. It is not legal advice. Before publishing the app, the publisher adapts this page to their business and the laws that apply to them, and replaces the contact details with their own.
Who is responsible
Launchy, demo@launchy.ca
Questions about your data and requests to see or delete it go to this address.
Your account
You sign up with an email address and a password. Accounts are handled by Supabase Auth: the password goes to Supabase, which stores it hashed. Neither the app nor the checkout server stores it.
The store's database keeps your email address with your account. Supabase sends a confirmation email when you sign up (if the store asks for email confirmation) and a password-reset email when you ask for one.
Orders and delivery addresses
When you place an order, the checkout server records it in the store's Supabase database: the products, quantities and prices, the shipping cost and total, the payment status, the date, your account's email address, and the delivery address you enter at payment (name, street, city, state or province, ZIP or postal code and country, United States or Canada only).
My Orders shows your own orders. Other shoppers cannot read them.
Payments
Card details are entered in Stripe's own payment forms and go directly to Stripe. Neither the app nor the checkout server receives or stores them.
Stripe receives the order's amount, the order and account IDs, and the delivery address. For a personal account (not a shared demo login), the checkout server also creates a Stripe customer with your email address, so Stripe can email a receipt and, on iOS and Android, offer to save your card with Stripe. Stripe handles this data under its own privacy policy.
On your device
Your sign-in session is kept on the device: in the system's secure storage on iOS and Android, in the browser's localStorage on the web. Signing out removes it.
Your cart and favourites are kept in the device's storage (localStorage on the web) and stay there after you sign out. They are sent nowhere, except the product IDs and quantities of the cart when you place an order.
Abuse protection
The checkout server counts requests per IP address (per minute) and per account (per 10 minutes) to limit abuse. The counts are kept in the server's memory or in an Upstash Redis database and expire at the end of each window.
What the app does not do
Yare has no analytics, advertising or tracking code and sets no cookies of its own. On the web, Stripe's payment form is loaded from Stripe only when you open it to pay, and Stripe may set its own cookies to prevent fraud.
Keeping and deleting data
Orders stay in the database until they are deleted. You can delete an unpaid order in My Orders; paid and refunded orders are kept as the store's records.
The app has no screen to delete an account. To delete your account and its orders, or to get a copy of your data, write to the address above.