How we use data

Last updated 15 September 2026

This is the plain-language version. For the full detail, see our Privacy Policy.

The short version

We collect only what we need to run your orders, we never sell your personal data, and you can export or delete your account at any time from settings. Here's the quick tour.

What we collect when you use Queshot

Account - your name, email, phone and suburb.
Orders - what you order, your "usual", and your order history.
Payments - handled by Stripe; we never see or store your full card number.
Location - only your approximate location, only while you have an active order or have turned on Kerbside or auto-order, and only with your permission.
Device & usage - basic device information and how you use the app, to keep it working and fix problems.
Security records - records of failed or suspicious sign-in attempts (the email entered, IP address and browser/device information - never the password), kept to protect accounts and prevent fraud. See Privacy Policy clauses 2 and 10.

Cookies and similar technologies

Our website uses essential cookies to work properly, and may use analytics cookies to understand how the site is used. You can control or clear cookies in your browser. The mobile app does not use website cookies but uses similar device identifiers for analytics and error monitoring. In particular:

Name	Set by	Purpose	Type
`ph_*_posthog`	PostHog (United States)	Recognises your browser between visits so we can measure product usage, heatmaps and session replay	Cookie / local storage
`_fbp`	Meta Pixel (only set when advertising campaigns are active)	Identifies your browser to Meta so we can measure ad performance	Cookie
`_fbc`	Meta Pixel (only set when advertising campaigns are active)	Records that you arrived via a Facebook/Instagram ad click, for ad measurement	Cookie
`_ga`	Google Analytics/Ads (only set when advertising campaigns are active)	Distinguishes your browser for Google ad and analytics measurement	Cookie
`_ga_*`	Google Analytics/Ads (only set when advertising campaigns are active)	Site/property-specific counterpart to `_ga`	Cookie
`_gcl_au`	Google Ads (only set when advertising campaigns are active)	Stores a recent ad click so a later conversion can be attributed to it	Cookie
`_gcl_aw`	Google Ads (only set when advertising campaigns are active)	Records that you arrived via a Google Ads click, for conversion measurement	Cookie

Advertising pixels

Only while our advertising campaigns are active, we use the Meta Pixel and Google Ads tag (gtag) on our website to measure whether our ads work - for example, whether someone who clicked an ad went on to join our waitlist. We use your browser's reported time zone to avoid enabling them for visitors who appear to be browsing from the EU/EEA, UK or Switzerland. You can turn them off at any time with the "Turn analytics off" control at the bottom of this website (the same switch that turns off PostHog), or directly through Meta's and Google's own ad-preference pages:

Meta: facebook.com/adpreferences
Google: adssettings.google.com

Analytics and session replay

We use PostHog (autocapture, heatmaps and session replay - with everything you type masked) and Sentry (to catch and fix errors and crashes) to understand how the Platform is used and to keep it working well. We do not put personal identifiers such as your name, email or phone number into analytics events - events and recordings are keyed to an internal account identifier, or an anonymous device identifier if you are not signed in. Analytics events may include a coarse, city-level location worked out from your IP address; where we retain an IP address, we keep it for security and fraud-prevention purposes. See our Privacy Policy clauses 5 and 10 for full detail.

Location and geofencing

Kerbside and auto-order use your approximate location to time your order to your arrival. A single privacy radius controls when auto-order triggers. You can turn location off any time in your device or app settings - the rest of Queshot still works.

Who we share data with, and where it goes

We share data only with the venue you order from (to fulfil your order) and the service providers that run the Platform: Stripe (payments), Supabase (database, sign-in, image storage), Resend (email), ClickSend (SMS codes), Google (Maps and push delivery), PostHog and Sentry (analytics and error monitoring), and - only while our advertising campaigns are active - Meta Platforms and Google again, for advertising measurement (see "Advertising pixels" above). Some of these store or process data overseas, including in the United States and the EU/EEA. We take reasonable steps to ensure they protect your information consistently with Australian privacy law.

Your choices and controls

Notifications - service messages (order updates, security codes) come with the service; marketing is opt-in and you can unsubscribe any time.
Analytics - turn analytics and session replay off any time in Settings → Privacy, or ask us at [email protected].
Your data - access, correct, export or delete your account and data in Profile → Settings → Delete account, or by emailing [email protected]. If you delete your account, we delete or de-identify your data; we may keep de-identified records - which no longer identify you - solely to improve Queshot's forecasting models. We keep security and fraud-prevention records as well - such as records of failed or suspicious sign-in attempts - for as long as necessary for security, fraud-prevention and legal purposes (Privacy Policy clauses 10 and 12). We also keep a record of how the app was used on your account, with your account identifier swapped for an internal reference so it no longer identifies you directly - never your name, contact details or anything you typed. We can still link that reference back to your former account, so we keep treating the record as personal information; we do not claim it is anonymous. Ask us at [email protected] (with your order number) if you would rather we deleted it outright.

Learn more

Full detail - including your rights, retention, overseas disclosure and how to make a privacy complaint - is in our Privacy Policy. Questions: [email protected].