Privacy Policy

Last updated: June 2026

1. Who this policy covers

This policy applies to the PrepFlow mobile application ("the App") and the self-hosted PrepFlow server software. It describes what data is stored, where it lives, and how it is handled.

PrepFlow is a business-to-business (B2B) tool. The restaurant or food-service operator who installs and runs PrepFlow is the data controller for all operational data stored on their server. PrepFlow (the developer) does not have access to that data.

2. Data stored on the restaurant's server

When staff use PrepFlow, the following information is recorded in the restaurant's own database:

• Prep logs — item name, quantity, unit, location, timestamp, and which staff member performed the prep
• Waste logs — item, quantity, reason category, cost, location, timestamp, and which staff member recorded it
• Inventory counts — on-hand quantities per item per day, recorded by staff
• Stockouts and outages — items that ran out during service, flagged by staff
• Staff accounts — name, role (staff / manager / sysadmin), and a bcrypt-hashed PIN. PINs are never stored in plain text.
• Operator account — the email address and bcrypt-hashed password used to register the restaurant's PrepFlow instance
• Shift notes — messages written by staff for handoffs, including author name and timestamp
• Item library — prep item names, categories, shelf life, costs, notes, and optional photos
• Audit logs — a record of changes to items, users, and settings (who changed what, before and after values)
• App settings — label printing preferences, PIN length requirements, session timeout duration

This data is stored on the server operated by the restaurant at the address they configure (e.g. their own domain). PrepFlow the developer has no access to this database.

3. Data stored on the device

The PrepFlow app stores a small amount of data locally on each device it is installed on:

• Authentication token — a short-lived JWT used to keep you logged in, stored in the device's secure encrypted storage (iOS Keychain / Android Keystore)
• Printer configuration — the name and IP address of any label printers added in Settings, stored locally on the device
• Item cache — a local copy of the item library used to support offline access, stored in the device's private app storage

This data never leaves your device except to communicate with your restaurant's own PrepFlow server.

4. Local network access

PrepFlow connects to thermal label printers on your local Wi-Fi network using the IPP (Internet Printing Protocol) to print prep labels. It does not access the internet to do this — communication is between the device and the printer directly on the local network.

On iOS, the system will prompt for permission to access the local network the first time you attempt to print. This permission is required for printing to work.

5. What we do not collect

• We do not use any third-party analytics, advertising, or crash-reporting SDKs
• We do not collect device identifiers, advertising IDs, or location data
• We do not access contacts, camera, microphone, or photos
• We do not sell, rent, or share any data with third parties
• We do not build user profiles for any purpose
• We do not track users across apps or websites owned by other companies

6. Data retention

All operational data (prep logs, waste logs, inventory counts, staff accounts, etc.) is stored on the restaurant's own server and retained for as long as the restaurant operates their PrepFlow instance. PrepFlow the developer has no control over, and no access to, this data.

Data on the device (authentication token, printer configuration, item cache) is retained until the app is uninstalled or the user signs out. Authentication tokens expire automatically after 12 hours.

If a restaurant wishes to permanently delete all their data, they can do so by removing their PrepFlow server installation and its associated database files. Staff accounts can be deleted at any time by a manager or sysadmin within the app.

7. Account deletion

Staff accounts can be deleted at any time by a manager or system administrator within the PrepFlow app (Staff Management → select user → Delete). Deleting a staff account removes the user's login credentials. Historical records (prep logs, waste logs, etc.) that reference the staff member's name are retained on the restaurant's server for operational continuity — these records are controlled by the restaurant operator, not by PrepFlow.

The restaurant operator account can be deleted directly within the app. In Settings, scroll to the Danger Zone section and tap "Delete Account." You will be offered the option to download all your data before confirming. Deletion is permanent and immediate — all prep logs, waste logs, items, staff accounts, and settings are removed.

If you are unable to access the app, you may request deletion by contacting [email protected]. We will respond within 30 days.

8. App updates (Expo)

PrepFlow uses Expo's over-the-air update service to deliver bug fixes and minor improvements without requiring a full App Store download. When the app starts, it checks Expo's update servers to see if a new version is available. This check transmits the app version and your EAS project ID — no personal or operational data is included.

9. Security

PrepFlow is designed with security in mind:

• All PINs and passwords are hashed using bcrypt before storage — they cannot be recovered even by the server administrator
• Authentication tokens expire after 12 hours and are stored in the device's encrypted secure storage
• Login attempts are rate-limited to prevent brute-force attacks
• All significant actions (user changes, item edits, deletions) are recorded in an audit log

The restaurant operator is responsible for securing their PrepFlow server (keeping it updated, using strong credentials, and controlling network access).

10. Children's privacy

PrepFlow is a professional tool intended for use by adults in food-service businesses. It is not directed at children under 13 and does not knowingly collect information from children.

11. Changes to this policy

If this policy changes in a material way, we will update the "Last updated" date at the top of this page. Continued use of the app after changes are posted constitutes acceptance of the updated policy.

Contact