How this site uses cookies and storage.

Strictly necessary storage

Signing in. Our sign-in provider, Firebase Authentication, keeps your session in the browser so you stay signed in between visits. Guest orders use an anonymous session in the same way, which is what lets you track an order without creating an account.

Order drafts. While you put an order together, a draft is saved in your browser (newOrderDraft, guestOrderDraft) so you can pick up where you left off. An unfinished guest order is kept for 24 hours (guestOrderResume) so you can continue it after leaving the page. Drafts stay on your device.

Payments. During checkout our payment provider Stripe sets its own cookies, used only to process the payment and prevent fraud. Card details go directly to Stripe and never reach our servers.

Sign-in security. Phone sign-in is protected by Google reCAPTCHA, which may store tokens while it checks that a request is not automated abuse.

Your cookie choice. The choice you make in the cookie banner is itself stored in your browser (cookie_consent) for 12 months — that is how the site honors it on your next visit.

Preferences and functional storage

Language. Your language choice is saved in the browser (app_locale) so the site opens in your language on the next visit.

Invitations. If you open an invitation link from a friend, the invite code is kept in your browser (pendingReferralCode) until your first order, so your friend receives the credit. It is only created because you opened that link.

Promotions. If you open a promotional link or scan a promo QR code, the promo code is kept in your browser (pendingPromoCode) until it is applied to an order, so your discount is not lost if you come back later. It is only created because you opened that link.

Order form origin. For the length of one visit, the browser notes which of our pages opened the order form (guest_marketing_src). We use this to count which pages lead to orders. It is deleted when you close the tab.

Repeat guest orders. If you order as a guest, your contact details can be kept on your device (guestQrMemory) for 14 days, so scanning the QR code again means a one-tap reorder. They stay on your device and are removed automatically.

Measurement without cookies

Basic usage statistics are collected with PostHog, hosted in the European Union (Frankfurt) and running in cookieless mode: it sets no cookies, writes nothing to your device and uses no identifiers that follow you across websites. Visitors are counted with a privacy-preserving hash that is computed on the server and changes every day, and your IP address is not stored with the data.

This tells us how many people visit, which pages they read and where ordering is abandoned — for all visitors, without profiles. Because nothing is stored on your device and no one is singled out, this measurement runs without consent. The consented analytics below is separate and comes on top of it.

Analytics — only with your consent

If you allow analytics, we measure how the site is used with Google Analytics (Google Ireland Ltd). It sets the _ga and _ga_* cookies (13 months) to tell visitors and sessions apart. We send it which pages are visited and where ordering is abandoned — web addresses are masked before sending, so order tracking links and room codes never reach Google, and Google Analytics discards EU IP addresses at collection.

Without your consent Google Analytics is not loaded and no analytics cookie is set; only the cookieless statistics above and our own order records remain.

Marketing — only with your consent

If you allow marketing, we measure whether our ads on Google and on Meta platforms (Facebook, Instagram) lead to orders. Google Ads sets the _gcl_* cookies (3 months) to connect an ad click to an order. The Meta Pixel sets the _fbp and _fbc cookies (3 months) and reports order and inquiry events to Meta Platforms Ireland Ltd; the same events may be sent from our server, with your consent recorded on the order. Contact details used to improve the measurement (email, phone number) are hashed on your device before anything is sent.

For collecting this data through Meta business tools, Meta and CleanOmar act as joint controllers under Meta's terms; what Meta does with the data afterwards is described in Meta's own privacy policy.

Rejecting marketing costs you nothing: prices, features and service are exactly the same.

Managing your choice

You choose in the banner on your first visit. You can change or withdraw your choice at any time via the Cookie settings button on this page, in the site footer or in your profile — withdrawing removes the cookies of the switched-off categories from your browser.

Your choice is remembered for 12 months, then we ask again. If your browser sends the Global Privacy Control signal, we treat it as a rejection and do not show the banner at all.

If you have questions about a specific entry, the full inventory is in the table at the bottom of this page.

Third parties

The providers named above handle data under their own policies: Stripe (stripe.com/privacy), Google (policies.google.com/privacy), Meta (facebook.com/privacy/policy) and PostHog (posthog.com/privacy). What they do with personal data on our behalf — and together with us — is described in our privacy policy.

Managing storage

You can clear cookies and site data at any time in your browser settings. Clearing them signs you out, discards unfinished order drafts and resets your language choice. The service keeps working, you simply start fresh.

Changes and contact

If the way we use storage changes, we will update this page and its date. For questions, write to [email protected].

What we store, in detail